{ "Event": { "published": true, "date": "2025-04-26", "threat_level_id": 2, "info": "URLhaus IOCs for 2025-04-26", "timestamp": 1745712189, "analysis": 1, "event_creator_email": "urlhaus@abuse.ch", "distribution": 3, "uuid": "1f995a28-e15b-4872-ac41-85a058b11989", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce1ee42-7fdd-11eb-99ee-ac162dbe2a66", "comment": "Malware payload (Mirai)", "timestamp": 1745625666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625666, "uuid": "4281c5eb-c4ee-4460-9bed-6158da987ba2", "comment": "Malware payload (Mirai)", "value": "eec5c6c219535fba3a0492ea8118b397", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "bashlite", "colour": "#942e2b", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "curl", "colour": "#c2a286", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#a35340", "exportable": true, "hide_tag": false }, { "name": "wget", "colour": "#5D3E49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625666, "uuid": "4c844387-eab1-403b-aaf5-3f8673060a17", "comment": "Malware payload (Mirai)", "value": "12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "bashlite", "colour": "#942e2b", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "curl", "colour": "#c2a286", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#a35340", "exportable": true, "hide_tag": false }, { "name": "wget", "colour": "#5D3E49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625666, "uuid": "8ae7e3af-8a16-4eca-8ebe-aabff6f756d9", "value": "13643A8AFD81AE25D5C126BBFE2F4289331317B8D2EB71029D145F2876CA94F0F7A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625666, "uuid": "18ca0a48-ee64-42c9-be8b-99543bc71b60", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745625666, "uuid": "6f49b633-d409-4d2e-b350-127f50be3e17", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d6b18c-7fdd-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745625786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625786, "uuid": "2e9ff683-e2e7-4bf1-8f41-6ebd2794e16f", "comment": "Malware payload", "value": "3849f30b51a5c49e8d1546960cc206c7", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "curl", "colour": "#c2a286", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "wget", "colour": "#5D3E49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625786, "uuid": "5a113220-e260-4739-a82e-c4278aa9ba0a", "comment": "Malware payload", "value": "f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "curl", "colour": "#c2a286", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "wget", "colour": "#5D3E49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625786, "uuid": "67e486f3-7d47-4add-ba3d-78dc3192c235", "value": "59D31322D3130C4FC02579FA7A2BE62A39873E6A24CE449C45F5D66A2FB7084ED71753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625786, "uuid": "b7e147e9-f414-4318-99e2-008bc810ad59", "value": "3072:biMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:fYFJvwe1gKCYVl2szN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745625786, "uuid": "dc73b72f-9fb9-45a1-a16a-21310dad9413", "value": 137480, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c38d0cc-2232-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745625879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625879, "uuid": "40ca2164-6521-42e1-aa03-d3b5e1d36027", "comment": "Malware payload (Healer)", "value": "07ed7622016ec48dba5efd75f699e475", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625879, "uuid": "1da496ed-779c-4b04-8f18-dc701ec89b8a", "comment": "Malware payload (Healer)", "value": "637e27a37b35e8695678a957ab247aafdc8dc7638694dc37da4cffad7dd49a01", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625879, "uuid": "805a7655-356b-42ec-b283-5a646844c91a", "value": "T18C85330AFF118E1FD69FC83657F6E38A1BB22B020F87343F744165B6ACAE35489164", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625879, "uuid": "bb658d95-fea3-4b79-a097-2587e4a23fe4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625879, "uuid": "2ecc5ccd-2ba7-4123-a042-b06467225177", "value": "24576:qaMOY6c1R2tlM/a+s0KyABMkbTBJpXLk8HLLEK/NcTN9KqidHEfYdE2zJjt:5MdrklYa2KyAZbT1Lk8H+6uYdhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745625879, "uuid": "a372a0e1-df26-4215-a7a0-68d2c17888c2", "value": 1752064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625879, "uuid": "9d49e9b0-d15f-41d9-8d28-bf1725ad85cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de0fb99-2232-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745625909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625909, "uuid": "876f75a8-841b-489d-af82-171d0e317528", "comment": "Malware payload (Amadey)", "value": "26f6136bee9a06d4b0b96dd60074503e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625909, "uuid": "a6d6a182-8826-4873-a2ba-5e8f6f7482e7", "comment": "Malware payload (Amadey)", "value": "e1d6395e2c1b1b37a911395ce3a422acd8aba241224a9cc25bc33645663975a3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625909, "uuid": "ad39f4f7-9eb3-44ed-9c5e-cf689f056bf9", "value": "T1E8159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625909, "uuid": "cbd75121-d344-46ff-a4d9-115ebc29a25b", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625909, "uuid": "5cdcc4b3-0eec-4d65-b1a8-4e8678ad2138", "value": "24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8aehV:9TvC/MTQYxsWR7aeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745625909, "uuid": "9e89126d-babe-421d-bce7-f8c504a137c2", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745625909, "uuid": "ba5a748d-4011-40d6-bf40-9874ee1a7852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73bd3fc-2232-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745626166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626166, "uuid": "02a23298-54b5-40e4-ba12-9c6203368494", "comment": "Malware payload", "value": "64911e99a76c2d6ef6925d1500323903", "object_relation": "md5", "Tag": [ { "name": "Lumma", "colour": "#4dc764", "exportable": true, "hide_tag": false }, { "name": "lummac", "colour": "#64ba0e", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#55c590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626166, "uuid": "21dd91b4-7323-46f0-b45e-fe94e048b88c", "comment": "Malware payload", "value": "714e9be09c6a9a397a88e8b2cee5fed08ad5c4cec1de41789d68fd2886d77c2f", "object_relation": "sha256", "Tag": [ { "name": "Lumma", "colour": "#4dc764", "exportable": true, "hide_tag": false }, { "name": "lummac", "colour": "#64ba0e", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#55c590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626166, "uuid": "7a0644c7-86de-42c3-8e70-df70b11da0d4", "value": "T14D250225D19214E6F5A742326666A610F2267C67C33546FB63F0FB712E8B6C04D3FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626166, "uuid": "bd8190b9-eaa1-4b5a-b3c8-41c729ef20ab", "value": "d6937b39d566e5795f3eb7422ac303be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626166, "uuid": "fec010e5-3344-495a-ab93-dbe966531e0a", "value": "24576:BkdmeVduOtjIn69eY50cma/yjk1AeVduOtjIn69eY50cma/yjk1:BIm0VIOf50cxJA0VIOf50cxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745626166, "uuid": "c5e59f2b-8aa7-4e48-b1dc-da429567c166", "value": 1021952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626166, "uuid": "0648fe9d-3595-4da3-97b4-20cb2864c6d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f28c5ac-2233-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745626394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626394, "uuid": "045fe6e6-75b3-4859-a3b9-97c5784b84a7", "comment": "Malware payload (Amadey)", "value": "9d8fc80ec7ea3906f2ab0dd7e4eb5491", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626394, "uuid": "f06acac1-d5b6-4560-a701-071a951c9961", "comment": "Malware payload (Amadey)", "value": "88105fb26093675b10c1b861611344d5b405227b537802b9b7b58adac2eb63a0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626394, "uuid": "d0a899a3-ae50-4674-ab11-ee9d6da51096", "value": "T1CFA5330BE7FCD9B9D9A95B704DF313C30772FE6019604185A58EAC4908A72A1B9F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626394, "uuid": "cde78da1-4a91-40e0-98fb-945035f2c57d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626394, "uuid": "5fad5839-641d-45b8-a681-ecbab19851fe", "value": "49152:Db75Cp7FL9y6qZirsdHKNTEKczSuuRr+o6O0SjpuNLNouo:W9y6qZirsUpyrEr+zkjpuNLNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745626394, "uuid": "5743a360-85ce-452c-9bab-5b59050fc4f6", "value": 2193408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626394, "uuid": "4bb85d2b-df21-4f4c-a28f-e3c2b22bc96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa24975-2233-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745626498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626498, "uuid": "b7d6874b-9a80-4040-b114-20099e39dc60", "comment": "Malware payload", "value": "4bfcaa50e4550ccae82997d578f608cb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626498, "uuid": "dd5709dc-f720-48dd-b694-5913e93a82a1", "comment": "Malware payload", "value": "38d387610416e4bd2e1d2cd37bcfe467f6770de236822199bc155135050dcbd8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626498, "uuid": "be2841b7-ec41-4800-aaab-2e5d1844faf3", "value": "T1EC95337E3FA1CA1CD3BBC278BAD43552B7B85C1420B8BC6E1701F5210A671C6A5A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626498, "uuid": "591cb07d-13c8-479f-b6a9-e042bcd3b1e2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626498, "uuid": "5d9c20a9-012d-4c21-8142-22cb310905ea", "value": "49152:seu9J7FaLugxigYQz4dALOmhsRXaaWoO4cH:xu9xOugiJdALO0sRXaaWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745626498, "uuid": "f373e63b-3099-4147-8993-04a2e556ff2f", "value": 1887232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745626498, "uuid": "ceee94b0-0d20-44d7-8558-f41c48e5a23b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f651b819-2235-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745627560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627560, "uuid": "04b0dd6c-0d3b-4ea6-844e-0a72d6361f53", "comment": "Malware payload (CredentialFlusher)", "value": "9b6d946cbafa56253aa97d90fe0cce58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627560, "uuid": "4969fb46-e87d-4241-897b-05dc8be0dc8f", "comment": "Malware payload (CredentialFlusher)", "value": "6f1f402332e361d6df8a97a5b5f9a10ecee2665339f9a8cbfd2a2f1c873c3d51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745627560, "uuid": "389479cc-a45d-4d3c-9e40-873abf53028c", "value": "T1AD259E0273D1C062FF9B92334B5AF6515BBC69260123E62F13A81D79BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745627560, "uuid": "4376dd4d-991b-4d39-ac9e-f9742a2a3044", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745627560, "uuid": "ab78d637-ebf3-46a6-a93c-0cfc49f67b67", "value": "24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8aHNRp:FTvC/MTQYxsWR7aHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745627560, "uuid": "ddc0ec94-d342-42c6-8ee7-e673a9b6146a", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745627560, "uuid": "fa443672-b11e-4eae-b44a-58f8bf90c70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2843d226-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745627789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627789, "uuid": "0e72880e-c6c3-43ca-8fb1-0be4c8bd762d", "comment": "Malware payload", "value": "5ea3839ef4effebf0c57e18742d1d284", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627789, "uuid": "a0d41f61-6824-4996-b1fa-928c45491d52", "comment": "Malware payload", "value": "64d671e954c370655d61855ba22381f9bbd929ac713322765686619cebeac480", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745627789, "uuid": "491aec05-f0aa-42c1-9971-cefdc43809e0", "value": "5A831229135414EAD62681F1D3FD1F84AD591F69CEE2EC157C12BC99EE333AD2CC2618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745627789, "uuid": "24e040cb-38b6-4085-99cd-18e2608af4e2", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uo:yYI0ARqw1qAEv7UIFM8oJorFquyjkRke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745627789, "uuid": "a750faa7-0fca-4a95-af54-0b4724bae74c", "value": 83984, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc1a347-223a-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745629375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745629375, "uuid": "15eda876-ac55-4856-b2f6-11961c06fc94", "comment": "Malware payload", "value": "d97d96490709fef04405b09ea9a96287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745629375, "uuid": "d525a0a8-9515-4810-b9bb-1dcb21c03d56", "comment": "Malware payload", "value": "624057093fbdcf29b8cd10cd6da1bae10e7e858947c3af1619ef755af45a94fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745629375, "uuid": "4c699a55-fb8d-4241-b70a-3f2252568839", "value": "T171953304DE0699B0C24E99BBC5E2CB4A797B4FBA79865A0531148B33C99F3B8072C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745629375, "uuid": "6d55c040-9e03-4719-af78-9f65739710d5", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745629375, "uuid": "7cb66e41-562c-4ab7-bcca-01aab63a8dc6", "value": "49152:51hd76gfmldrTA6pPFGicjEbO3yqtjf3nlmYsXwJshpQ:5XsgfGrTA6dMEvA3nlHsgOhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745629375, "uuid": "0b0bda5e-b391-40e6-a51c-d95325ae23a0", "value": 1988608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745629375, "uuid": "940c1146-6952-4174-a69a-e8c5e7d6304b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47349872-223a-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745629414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745629414, "uuid": "905d90ef-aa48-493d-9de8-bf10c974585d", "comment": "Malware payload (CredentialFlusher)", "value": "c0cd86e25dac0250774b85855db513d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745629414, "uuid": "6635e83a-6215-479b-a302-948a989d877b", "comment": "Malware payload (CredentialFlusher)", "value": "74dbcc6d77fc5aa3faf34a353f12acd313e94a951e16ad6eb0d416a8d323701b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745629414, "uuid": "700ea4bf-2840-42da-968a-fbf35f73fd35", "value": "T1B6259E0273D1C062FF9B92334B5AF6515BBC69260123E61F13A81DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745629414, "uuid": "f360fb51-267f-44a2-ae88-b4a5be89d74e", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745629414, "uuid": "d4db7927-1b59-4176-9a02-f60325bdd67b", "value": "24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8aknfF:yTvC/MTQYxsWR7akf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745629414, "uuid": "72de0c2a-5e8d-4a27-a91d-c0dfa2b3482e", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745629414, "uuid": "8de42004-9cee-4148-81c9-5eb40b5de7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c04cc9-223b-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745630115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630115, "uuid": "1ce287da-6273-4229-a315-707d1d1e4cbe", "comment": "Malware payload", "value": "25331bfbb70601f20eb2788e75286bba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630115, "uuid": "f7f43475-b0e7-4b3b-a113-5a29c64ac4c0", "comment": "Malware payload", "value": "02e3d92c35ff4f493964048074c85b4dabcb1ab56bb1cf568d6152e34b3ae43f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630115, "uuid": "6e5ad537-f962-4b0b-8867-581c12d56bb0", "value": "T1DF95337952A2FAD0C6CA15F96698C3842E887A5170CDF6021F4705DED5CBECE09FE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630115, "uuid": "e496bdd8-8ac2-4521-85dc-783997b0d1da", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630115, "uuid": "2b369721-5b07-4df6-b608-67b8fe755d7d", "value": "49152:0VCGmGBp/Cmg2w1d1OHxCoMDFlyiF2xO/cP:0GGpaW8OuwxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745630115, "uuid": "9c6926b4-3c0f-4b76-890b-cff856ba6e28", "value": 1887232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630115, "uuid": "7e25663e-573a-4044-ba70-c6751bea0fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3617ee0-223c-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745630508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630508, "uuid": "a52bdad8-a3a1-4c55-a37a-5bc6f5b48f81", "comment": "Malware payload (Healer)", "value": "5a6d2f7a5099e6f9b340d6a30c2b13f8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630508, "uuid": "80d0c201-d164-48b0-ad10-5d54507d34e8", "comment": "Malware payload (Healer)", "value": "4716cec71f765b4235463ee945ba230d8f79eb277324412b9c3dfb414ce934c4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630508, "uuid": "87b6f931-abc3-41de-89ae-8d5af2646396", "value": "T14E8533204E833B5AF46B8E3315DF92B137E46B4648D9F9EAEA9C136CB413151FF454", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630508, "uuid": "5df63244-4f73-4942-adf1-7edabdb96b18", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630508, "uuid": "e55817df-6c6d-4c8e-a47e-7ce9dacbc690", "value": "49152:ILIsOSKDZ/WL35QoSe3hJ/pYUdsTzAVUqW+:I8FSKD1W9B13vBY6EzAyJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745630508, "uuid": "4557a01d-7a64-4b80-8a8a-3d7793a906f0", "value": 1767424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630508, "uuid": "dda97bdf-06b4-4896-adad-f4c5b97375fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e60b7db-223d-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745630768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630768, "uuid": "80bb419a-3c8e-4c02-83d2-43b6d9f283c2", "comment": "Malware payload (CredentialFlusher)", "value": "1cbece441e717e149803db388de7824d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630768, "uuid": "c55b3ffe-44bd-41bd-90c8-c31e6d33b354", "comment": "Malware payload (CredentialFlusher)", "value": "ec23bab1f22624524ff09f7fdda4ef099415f53fa9b2793a2e318f2989b623e1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630768, "uuid": "1ce2ca0b-c39f-494d-bfe0-7337bfab4207", "value": "T183159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630768, "uuid": "43afa325-4cc6-4c2c-97b8-a3b167b43f01", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630768, "uuid": "ac18d84c-3ef2-423b-9c22-192608d27610", "value": "24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8aepV:RTvC/MTQYxsWR7aep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745630768, "uuid": "fa691dfb-40ec-468d-93fa-4ad320716658", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630768, "uuid": "622d9114-86fb-4170-bbfe-d2a5f2f162f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b0e8b0-223d-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745630831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630831, "uuid": "10ba13d7-8ba2-4e86-866f-01390a285dc8", "comment": "Malware payload (Amadey)", "value": "1048880e9fc168b232b33776c7ff4137", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630831, "uuid": "cf157827-b310-4813-aa8e-aa39c1ddb398", "comment": "Malware payload (Amadey)", "value": "3b1aa646c2a86019423f5384873f66613c9ed92f79cd7bb96a09427139f595a7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630831, "uuid": "67e607ae-bfd7-4e72-bdd2-fc32b7555ebd", "value": "T155A53312D2FD8026EC571B7509EA16C30F343E626B359652768E5CB91BB2A927C303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630831, "uuid": "f770eecf-a0a9-477b-a6c8-2edfa1f05d90", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630831, "uuid": "13ec2f1e-22ae-41a5-a225-2b7583a8f29e", "value": "49152:6d75COL9JCAQ539bmHoqV2OuhLprY9tlmcoa9Ewww:SfCAeqV2OOLprzc99Bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745630831, "uuid": "c5734f17-c18a-4338-8cae-2861c3f2f078", "value": 2194432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745630831, "uuid": "9b6f8025-f817-4567-aa0c-65864ca3ae8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2afa1dc-7fdd-11eb-99ee-ac162dbe2a66", "comment": "Malware payload (Mozi)", "timestamp": 1745632385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632385, "uuid": "cde68fb8-8adf-4cfc-9051-752d7a0edfdc", "comment": "Malware payload (Mozi)", "value": "59ce0baba11893f90527fc951ac69912", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "bla", "colour": "#FA8229", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#b6b48d", "exportable": true, "hide_tag": false }, { "name": "curl", "colour": "#c2a286", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#fa4634", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "wget", "colour": "#5D3E49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632385, "uuid": "71c53925-3dbd-43e7-b604-cc7fe5a7c32e", "comment": "Malware payload (Mozi)", "value": "4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "bla", "colour": "#FA8229", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#b6b48d", "exportable": true, "hide_tag": false }, { "name": "curl", "colour": "#c2a286", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#fa4634", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "wget", "colour": "#5D3E49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745632385, "uuid": "bd17d875-6a28-4b87-b3a0-13604eca6955", "value": "E5D3128BEF36DC1ECF001EB226DA5B9E9C6D756B41CBF0A4B9C1818F13A01C97D52215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745632385, "uuid": "060f69f9-6537-4497-ad76-19206eeb5943", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745632385, "uuid": "cbb9a630-f191-46c5-9314-fb55d0284290", "value": 135784, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9a1d0b-2243-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745633181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633181, "uuid": "95fb1f3a-4993-4d63-b63d-f94539e132ef", "comment": "Malware payload", "value": "05499d23d535101cbb1d202a7b7741d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633181, "uuid": "1697254e-1e02-401a-936a-f84252d9c63d", "comment": "Malware payload", "value": "376ce4025a9c67925070e4d545c7e79d91d9ab9921451ddf40ab4f214b451bb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633181, "uuid": "7b7605b8-2c26-4f0e-ada0-a439ceeb8690", "value": "T170952258A7844DDFFB7225785E51AB76E0FC88D32A35321FD53683B4D41E2A804AA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633181, "uuid": "b93ba64e-1ba9-4ff5-99d3-e7f3130d6952", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633181, "uuid": "662e0dc3-c11d-4a62-aca0-b88648b8e3ec", "value": "49152:TQzrR2uFT92dW2/ig9HqJNQso12Dk4CjBoEr6+IukFw4ngr6T:wR2ul92dVig9wNQAjCjBiDw4ug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745633181, "uuid": "2f6dd1d0-c9fb-43f4-beb7-3834bb111954", "value": 2046464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633181, "uuid": "57723cf5-fd0b-46bd-b205-45c64a0813c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22239939-2243-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745633217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633217, "uuid": "b38865f3-413c-4d82-8821-e3d80c8a61a2", "comment": "Malware payload (Healer)", "value": "8e703936fdf55efaecb1936a475fd681", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633217, "uuid": "61337eeb-1c19-4666-a4f7-1f949038aa11", "comment": "Malware payload (Healer)", "value": "4b90a2e269d0adbbc6e5f0cd1d6e8a8ee4a17e82c14e59bbc7a8638546aa8c1e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633217, "uuid": "707f85f2-7fd9-475c-80d0-5908bfa43a13", "value": "T10F8533481E7D3B33EF4CB97004827752BE1F040895FF9548654CB1E296BFAABA505A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633217, "uuid": "202afd7c-35ea-48c7-b9bf-56c2234cd9be", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633217, "uuid": "8599ea00-81f2-4cdf-b9d4-a32f57ade36d", "value": "49152:Lvg/nk/AEfNInCw1ey58a4r3GOAhj/UFlUdJD:sJw7w1ey5y3GH5/CUdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745633217, "uuid": "24ada963-72bc-416c-b2a2-b7c91b1405d8", "value": 1744896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633217, "uuid": "7970f9fd-8e47-4732-b689-33247903bb30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718091da-2243-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745633351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633351, "uuid": "c550bef9-b6b9-4d34-88df-cc1006d51ae0", "comment": "Malware payload (CredentialFlusher)", "value": "48747d950ce9490b910779bfc9ce6416", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633351, "uuid": "68432aec-3007-4d4f-b795-4b416d701340", "comment": "Malware payload (CredentialFlusher)", "value": "7dca01e5897404646b259ca66b4666ebc651dc1b3fbd21115e5bab9dbdf136d5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633351, "uuid": "54338bc2-bc00-496d-a4b4-04013a1db9ef", "value": "T1F4A52315A6D8A032E99D677408FA02CB0B26BEB04E7145DDAB0EDC4F1C717E8B6347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633351, "uuid": "600299ec-5f1e-4f1f-b4b9-5d829a08965f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633351, "uuid": "9dd16edf-5f21-4c3b-a902-190f5c838436", "value": "49152:Ja75CUsjQjvbAoJA2ULZAmXatA2neJzInHDL3tFREOA3:hQfDisgJUnHDLdkOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745633351, "uuid": "8602859a-355f-44b9-95b5-0f182b98834a", "value": 2176000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633351, "uuid": "3e067040-f976-42de-9c59-40aafb38309a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ace87c5-2243-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745633366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633366, "uuid": "37be953c-4f76-4da4-855e-daf09e3c024b", "comment": "Malware payload", "value": "610a9d7eb1c7178dd14cc2398b8556da", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633366, "uuid": "e77677df-886c-4c80-a4a6-73cc0222eba2", "comment": "Malware payload", "value": "7246498174a209dd7ebb710b38bb6abc340c938c27daa29dbfa65ff60f8fbc4f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633366, "uuid": "4201649b-d90f-4d73-91f0-db99aafe7577", "value": "T18485339E96E5C8BEE50784FE1F684FF67A260A0D71EE03D8800ED439B71B75329964", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633366, "uuid": "821f46c7-92d6-4499-a70b-ea02d75909e4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633366, "uuid": "b8b65596-8a52-4e10-b85c-aca184299398", "value": "49152:6gURMofQpT8QEGJ6qCjAbVdh9ryBW3umQj2j3QlfZKT+h:6gcSTCX8j3k8umL3QyT+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745633366, "uuid": "fb1a39d3-f06b-44de-a4ed-b7e42ff940a3", "value": 1868288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633366, "uuid": "4c30d1fa-82eb-4655-baec-380301347a02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c3dd85-2243-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745633376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633376, "uuid": "effb1902-fe4d-49bd-bb19-0e980bbe20cb", "comment": "Malware payload (Amadey)", "value": "cc1b50661060c049d3e198edc14277aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633376, "uuid": "64e7d1ae-c751-4d29-a441-421b30ced53b", "comment": "Malware payload (Amadey)", "value": "bb0b27ea4200e7cfc32db84f171ee58a562ae170ccd71b4a55ca4eb5826138e3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633376, "uuid": "67668fbc-215f-4478-b145-071bf5b3aa45", "value": "T1F7159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633376, "uuid": "675d2834-ad13-4cb8-ad8e-8e00b66742c7", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633376, "uuid": "a63d03bd-bbdf-4851-8b93-2ae7f4ecca45", "value": "24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aeRV:CTvC/MTQYxsWR7aeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745633376, "uuid": "4eeb9950-cd1f-44b0-af25-b048071526dd", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633376, "uuid": "d007f19f-7b49-4f12-803f-cc2ef8c037c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8506a15b-2243-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745633383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633383, "uuid": "ffa05b84-8366-4778-85fc-ec04d67d84ed", "comment": "Malware payload (CredentialFlusher)", "value": "aa5d440eff37e2d81e66eb80cb9ec21c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633383, "uuid": "416e84ea-ffd9-44e7-8154-bff29aa570f4", "comment": "Malware payload (CredentialFlusher)", "value": "b0b9d70befd2774955d087ad8a16169cc79eaa8a97351e85b13c4fbe12bb422c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633383, "uuid": "8b924a59-896c-4a7a-a403-5a4e06e0cc62", "value": "T1B6259E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633383, "uuid": "1f36e613-b009-4cde-8111-3939eccb09d6", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633383, "uuid": "df7c4639-d6f0-496d-b332-c0f9ce1bdb4b", "value": "24576:fqDEvCTbMWu7rQYlBQcBiT6rprG8arWU4:fTvC/MTQYxsWR7arWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745633383, "uuid": "bbb937e7-7710-439c-bacd-82a61058862b", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633383, "uuid": "a0c1c81d-a75c-4213-bf0e-3f98e9e15207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f76c3a1-2244-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745633642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633642, "uuid": "c886c084-d044-48dc-8d08-d70d0faf56df", "comment": "Malware payload", "value": "c4d58ee755de161e44ca2f76df2c7654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633642, "uuid": "4303d09b-b5e0-4317-9661-f2f733993c2b", "comment": "Malware payload", "value": "74cdd6fb06a1e1dfa7b13574bc4bbf74f10db853e925175d200f48204e2774e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633642, "uuid": "71a40310-5155-4600-8710-84f968857522", "value": "T1749533A50CB77A31CCB942705D63D00EA7BF9A52989F7888EB8B234457931CC5F91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633642, "uuid": "8d2b698b-60fb-4860-8c1f-ce7608e82d08", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633642, "uuid": "7c65db0f-3d2f-4b02-b544-85f826ca7f29", "value": "49152:vMAg6+yMEJDSvotoHm7yelfksnMrAm4axvYignzTrMD3q9g/RH38tnyscW:dmsD1tZmpsMlhpYVrSq9+H3EylW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745633642, "uuid": "41a1e05b-dcb4-4246-9967-198b4755a483", "value": 2032128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745633642, "uuid": "d9bf0e96-9f83-4584-954c-1740bf346f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a29e50-7fd8-11eb-99ee-ac162dbe2a66", "comment": "Malware payload (Hajime)", "timestamp": 1745634680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745634680, "uuid": "641116b0-c138-40f9-bcff-1f792eee3106", "comment": "Malware payload (Hajime)", "value": "9b6c3518a91d23ed77504b5416bfb5b3", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "botnetofthings", "colour": "#afe480", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "ddos-bot", "colour": "#52e413", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "hijame", "colour": "#81ec61", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#3b1ba6", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745634680, "uuid": "0cf3ae9d-0f63-46fe-94a6-1fccc0b81089", "comment": "Malware payload (Hajime)", "value": "a04ac6d98ad989312783d4fe3456c53730b212c79a426fb215708b6c6daa3de3", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "botnetofthings", "colour": "#afe480", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "ddos-bot", "colour": "#52e413", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "hijame", "colour": "#81ec61", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#3b1ba6", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745634680, "uuid": "157b37c0-826e-4d72-a3b5-01cb282d42e8", "value": "6D7312E017B517CC1371A8353BED205E9128223972AE35302E97528DF957703BAB2DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745634680, "uuid": "1a97b9af-bb67-405f-883e-4bd043777229", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBht5:8D+CAXFYQChaAUk5ljnQssL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745634680, "uuid": "92f449db-ad79-49bc-b26f-569f88ec58fa", "value": 80280, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449d013f-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745635901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635901, "uuid": "1f0719fd-388e-49c7-96ed-4f885331d0f1", "comment": "Malware payload", "value": "454c9bf6bdfaf41e58406b098e236dc8", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635901, "uuid": "1af1237b-8b5c-4c54-9af0-c6ca2fcfd272", "comment": "Malware payload", "value": "c0b1ac2a4e9df27794b10c8738057ba5476357bd5129bee50a2a1ab9f8183853", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745635901, "uuid": "9d6f6584-4a89-4213-b930-263fa0add421", "value": "EB531202339A297192714AF1E7FDBB48E64E3D588FF16C246C113D68F93239D5CC8909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745635901, "uuid": "707c1c00-2938-41fe-80cb-07eed5ed6661", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxI:yYI0ARqw1qAEv7UIFM8oJorFquyj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745635901, "uuid": "7dc29f21-8e74-44e2-8518-7c4442fa5092", "value": 66608, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf71082-224c-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745637074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637074, "uuid": "0463aa5e-bbe1-41b0-b14e-0154d936f98f", "comment": "Malware payload (CredentialFlusher)", "value": "db822c796a31e4502bb3faccb2d2612c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637074, "uuid": "8d65aa9b-f2eb-4407-b8ee-835a8ba596e0", "comment": "Malware payload (CredentialFlusher)", "value": "b1da880fb91baf0a9d146fdb87c2c45626a86042a62242ccf124004c5813e973", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637074, "uuid": "ffdcdf79-8b19-461c-88b7-1f6c43cdc265", "value": "T1F125AE0273D1C062FF9B92334B5AF6515BBC6A260123E61F13981D7ABE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637074, "uuid": "44a75c7b-4d57-48d6-ba5b-dde55933a31c", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637074, "uuid": "faded4b1-9788-4583-9d9e-6a34cc22e5e5", "value": "24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8aiF9DS:wTvC/MTQYxsWR7aiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745637074, "uuid": "303f313a-0802-468a-800b-c69df4661063", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637074, "uuid": "6c07f8d3-f787-4549-aef3-765bb898734b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1e9bd0-224c-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745637289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637289, "uuid": "0cee253c-45e6-474b-8c69-d8853e481c16", "comment": "Malware payload (CredentialFlusher)", "value": "1e2c782f8dcc5f1e1556edeb855080e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637289, "uuid": "5432ef2a-fca5-45c8-99e3-c6fc47d2dc3b", "comment": "Malware payload (CredentialFlusher)", "value": "1d2db32deefc2c22c2d689ca42a62e68d8b93cd7b16ed465970e6ccf116ad35d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637289, "uuid": "10bd6a20-a401-4577-a710-87c1ffd6b837", "value": "T16A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637289, "uuid": "d26d93eb-22f6-4c8d-a218-0f024f93c25d", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637289, "uuid": "889ed581-9737-4f39-bc11-2d9c0f0a1bbb", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8aeOV:WTvC/MTQYxsWR7aeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745637289, "uuid": "cfe4b955-dd39-4e62-8390-edb47825df29", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637289, "uuid": "d69d555d-ff93-4b56-907a-063c68211ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f934575d-224c-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745637444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637444, "uuid": "fe6ceede-2f3f-4955-9348-8f41ac61b602", "comment": "Malware payload (Healer)", "value": "3965474fe258e6e45b7c2698a0be05a7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637444, "uuid": "428bf666-d54a-43a9-8abb-a416726050a3", "comment": "Malware payload (Healer)", "value": "f03547d679364e10711251bc4470a529d788bf4ec9d4837caa51630a4695467e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637444, "uuid": "8071fba3-c67c-4d2f-b880-0785acc34e34", "value": "T1AC8523248E529719C5EAC0FA852694976AEFD4C74FB5062BEE0C13681EE1332DF25C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637444, "uuid": "c2a13163-286a-4cb7-8adc-fd1638acd592", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637444, "uuid": "4831a45f-8615-423a-84f4-900976d2c2da", "value": "49152:Lh7PuSbpeYwraiYa5DkcJOvTswf6VdMEoW2:972SPwpTJOvgwadMEf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745637444, "uuid": "e4edd6e5-c4b1-4cb6-9364-14bcb81d79f2", "value": 1752064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637444, "uuid": "2efc62f1-6b52-4bba-9e9e-6e70e00b1e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed17299d-206b-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745637647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637647, "uuid": "83d4beb4-5d8a-426d-b66f-97b37d47a295", "comment": "Malware payload", "value": "d6e92132ebf836aba71feb0502802b2c", "object_relation": "md5", "Tag": [ { "name": "infostealer", "colour": "#21f8dc", "exportable": true, "hide_tag": false }, { "name": "revoked-cert", "colour": "#90a8b0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#2b24f5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#55c590", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#3b1ba6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637647, "uuid": "6fd6984f-979a-436f-9b69-10bb959c82bb", "comment": "Malware payload", "value": "ae84f2fffc3788e7d8d8581a79ceaa098be45798821e30526aca4874979e1543", "object_relation": "sha256", "Tag": [ { "name": "infostealer", "colour": "#21f8dc", "exportable": true, "hide_tag": false }, { "name": "revoked-cert", "colour": "#90a8b0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#2b24f5", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#55c590", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#3b1ba6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637647, "uuid": "f24f32c6-4fea-45e7-96b6-282fa4f2f4ac", "value": "T19B694A317A9BC53BE56219B1693CCA9F5069BF650F7094C7A3D80EAE44B08C34636F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637647, "uuid": "9daeb5b3-6c67-473a-826f-d0427d62dd46", "value": "d25b29054fccfd62c3ed5a8a3d014883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637647, "uuid": "732447fd-0ca0-4994-a637-c0d16f671ad7", "value": "49152:7R5CbBq56hIF1XrwzMtmEMQh2Uc0Rx6lxSDfsWBxTh28h/kY:tEThIF1XrwzMtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745637647, "uuid": "ad46d1d8-32fa-437c-aff5-4dbd0630c510", "value": 687152424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637647, "uuid": "2f2e2c56-ba68-43d2-ad03-c4dfaaa614f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15121162-1905-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745637664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637664, "uuid": "8b4eb22c-936a-4f3a-af4e-0e0ef91283da", "comment": "Malware payload", "value": "ffc17dc3993e79642746e725f538dab8", "object_relation": "md5", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637664, "uuid": "c9b31ffc-97c2-43be-b55c-b9fd02f16c68", "comment": "Malware payload", "value": "85c57b6512b9483301828f4a50d36e4c707454bd912ead9f287fa0cd2a3e8cbc", "object_relation": "sha256", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637664, "uuid": "eace0d7f-7170-4b22-8a5a-30df518df39b", "value": "T14FE3124BEF369D1ACF402DB32ADF4B8D786A665E81DBB0A4E9D0814F13911CA7E121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637664, "uuid": "c89fc08f-89ce-4596-b691-155977ac4f3d", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioKav:p3lOYoaja8xzx/0wsxzSi/av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745637664, "uuid": "c499b178-4cbd-4568-a122-a0c480be5a83", "value": 145024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637664, "uuid": "3443ff8f-c0f4-4085-ab69-59ac61f76dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b39470e-224d-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745637689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637689, "uuid": "80e0b7b2-72da-4aab-a1f9-a8ba2d94b779", "comment": "Malware payload (Amadey)", "value": "275d371b8458301ad7d00f50a88351d5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637689, "uuid": "e02d43be-aa2c-4ca6-99a8-62e514458dbc", "comment": "Malware payload (Amadey)", "value": "e77c3f3145b23a16e0aa40359729608f4ae01d9feae2d5a30d3263e1f874fdb4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637689, "uuid": "f46e4fbd-80e8-405c-bff2-97497822509d", "value": "T11DA5334BFDF88236C4AAA3B118F303D304367EA19D7456DF73465D9A1C32A61A7243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637689, "uuid": "f66d6d84-fc9e-44c0-abb5-90088d48400b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637689, "uuid": "efc33689-ab66-46e7-8900-a0c6d613e476", "value": "49152:s/75Cj/RadpEKo3QwGvRA1i6ML+q28/PikWw/Ts7ITjOUostH97JF:f/klvRA1istOPii/Qe6UostH9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745637689, "uuid": "8f042b7a-0452-419e-b153-d2ca40223643", "value": 2181120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745637689, "uuid": "c21a03a4-90b7-479d-9c36-78948074b4b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bced534-224e-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745638119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745638119, "uuid": "30a782ce-236f-4b04-adbb-36e1080674ef", "comment": "Malware payload", "value": "5652f0cf0259bc782877a85c5ef810a7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745638119, "uuid": "4ac66d52-b676-403e-9b2b-92cc868ac91f", "comment": "Malware payload", "value": "01e2ed3c54dd3406d6a5628422359c4724fd31aae02ed6b76c22c7124c07267f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745638119, "uuid": "fb648263-c0e6-41bd-ba1b-6bbbb031660f", "value": "T137853336AC0BAB4ECBAD1A7D1C858110A63551C04F9654DFEE6137BE18DB63783CB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745638119, "uuid": "722ba4f7-c241-4b33-b2f3-02c079aae663", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745638119, "uuid": "3bb63e4f-e363-4d45-babd-bd3b837619ee", "value": "24576:tHr90ry+iHYgHVwRoMe/bjrHgVb0ig1EVqQSERekczzRMGWi34HAgTqWAG4l/QH4:JJ0rJ+HVwObjfg0igAGMw9bbHE/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745638119, "uuid": "0917e207-9ac2-4208-a794-2a28c418a39d", "value": 1874432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745638119, "uuid": "10668541-3688-4097-b9e4-debaa056d33f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59899205-2252-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745639753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639753, "uuid": "9b544c7b-3556-4516-9cc5-5ecf9096892d", "comment": "Malware payload", "value": "ee83d96f859bd007e2a06a217c77115f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639753, "uuid": "fe41c02b-eb0a-4a0f-ae33-21125efa9b00", "comment": "Malware payload", "value": "419c0dda8f193801352e3b449a0f3be7a7ec5e47918995d7ab100feb611d8407", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745639753, "uuid": "69fff6ce-1caf-493c-a9e2-d9ee8541c02c", "value": "T1FEA522260CEFDDDDE2AA4E35F225F3F68013A9194F9582F9305274E300AB635E5916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745639753, "uuid": "9e67399c-baef-4574-a543-9dd3b82b8cf6", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745639753, "uuid": "7fab2af8-a6da-430d-9408-3d80fa50067b", "value": "49152:ysI2vdnh3O3fLr85Mz0YW25sxahymTqfHqJskGE7XKDh:yCH3O3jg5o56xPID5KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745639753, "uuid": "3673841a-dde9-433d-8c7e-1c1172fb4582", "value": 2074624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745639753, "uuid": "4a8289f2-e4bd-42fb-8c35-b9b04a5dfb73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca66a4fa-2252-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745639942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639942, "uuid": "da25d783-9e0a-48d0-9834-8f8115648c6d", "comment": "Malware payload", "value": "b623cc11c8174974cc192f275b1c110f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639942, "uuid": "c4789aa3-6bc3-463d-8a91-3aa40f16faaa", "comment": "Malware payload", "value": "265b189818adcd11b8fe63a26f1c8b8276e54cb019060e00b9d0c7c5041ce904", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745639942, "uuid": "c0d25f86-d6c8-40b1-86ac-fd63da68440e", "value": "T13A067C23B385753EE46F1E364837D664AC377B61BA128D475BF4080C8F39A417A3AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745639942, "uuid": "9ef783e3-fba1-4a86-b2c9-a4f5a048e343", "value": "49152:zFRkrbhuIg+4ExgSMe+I00CbbJz4Hr60t6Nw1vZF:zrkrbQI2PHU60tZ1vZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745639942, "uuid": "974507de-8ad9-4534-a1ef-1b2bd11b65f7", "value": 3682516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745639942, "uuid": "585f9b70-d9cb-42e7-a192-c6bc2f9b6099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16862a84-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745640346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640346, "uuid": "6a6cf3c9-eebf-45ba-b87a-405b617c13af", "comment": "Malware payload", "value": "3f5605d15ff19e86b136c29857d93101", "object_relation": "md5", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640346, "uuid": "1d464ae4-73d1-4a89-b9d0-b8f77dddbaea", "comment": "Malware payload", "value": "6d1a5e0ef0615180c6cfc9e2194a82c32b7992a3ec3073547170797515422eff", "object_relation": "sha256", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640346, "uuid": "60160185-9bb4-4b11-9537-ece48ed89519", "value": "5473121623A92971627146F1E7FE6F8CE10D3A688FF16C247C217C68B93236E5CD8519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640346, "uuid": "b2673620-a4e8-42cf-bf27-3c654d7a9541", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3O:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745640346, "uuid": "aa59e4e3-22c4-488d-8bb9-3f2175ab9f07", "value": 73848, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b90199-2254-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745640659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640659, "uuid": "d0027228-d813-4113-a846-bc70b923cb82", "comment": "Malware payload (Amadey)", "value": "ecc7279ed3af4aa6ffc09962fa6762ee", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640659, "uuid": "295d7ea0-ad11-408f-a530-1924216b6d6b", "comment": "Malware payload (Amadey)", "value": "c2e107e425814cb98f9841eeb0c874250cc5da0b14a9e5e560ad5be30bafcc53", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640659, "uuid": "243a725f-52b3-4dd4-b0c1-4947bf6deb78", "value": "T198159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640659, "uuid": "088d466c-5bc2-4960-bd4d-574994fd0f33", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640659, "uuid": "b1a45418-eb7a-4df4-b8b2-023da346b8a2", "value": "24576:BqDEvCTbMWu7rQYlBQcBiT6rprG8aesV:BTvC/MTQYxsWR7aes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745640659, "uuid": "ed0e3e78-b707-4656-9b79-ca1e6fa93bf5", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640659, "uuid": "e3d19752-5455-41a9-9697-5d0aab5e5b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd5a830-2254-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745640777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640777, "uuid": "adba46a9-7500-4dac-8505-308457d2832f", "comment": "Malware payload (Amadey)", "value": "41cc0fc9a9d7aede2b330e505f552e13", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640777, "uuid": "0cf59a92-9ec9-4e1f-9dfc-5f9c3daa734a", "comment": "Malware payload (Amadey)", "value": "8c84e977877a4032428ce3f484e9ef0158f6bc6b728c7bfa1769345e4b29ac45", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640777, "uuid": "be370251-25a9-4361-ad5f-b2ff9e227398", "value": "T1B8A52387BAF84132C97163B16DF712F309357DA29878874E368A6C691C726D1E6313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640777, "uuid": "bc7e4efa-d280-4486-97a1-a04e2b9e7c3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640777, "uuid": "79098807-0a3d-4c45-9f9e-ff4d4ac552a7", "value": "49152:qu75Cs+SiAC9sFYHPSjCYoqIORyuwXny9NxHPNqoqDpV+EIew:n+SiAC92oqjCYoBzy9Nxs7pgEIew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745640777, "uuid": "6b935977-6254-478e-9f2b-77819b310bd7", "value": 2185216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640777, "uuid": "548c9d2b-a8b3-4e7b-a4c5-dbe48b0883f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcdd0b81-2254-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745640832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640832, "uuid": "390a26ed-c162-4a2e-be59-ad6051d22806", "comment": "Malware payload (Healer)", "value": "4be4d0443c17bcda175ae0ddbb008bea", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640832, "uuid": "467b4aa6-832b-4635-beea-6097038a40d4", "comment": "Malware payload (Healer)", "value": "f56a787fe0f6135389c916e7cd86f58d060f5b169eb21db4fe7af29f84bde5a1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640832, "uuid": "729f7c48-831f-46b3-bcab-599084c3541f", "value": "T1598533665811DF1DFC20AB39D4D2941DBE59DBE808B20ECBAD871023437B2999F17B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640832, "uuid": "151157d3-564a-4ec4-b274-75a0fea44747", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640832, "uuid": "8426db40-f678-400c-a93d-ad1bd45f19a2", "value": "49152:QqCbJXV8gCLPHsXFr0j8Wtd/BcKjlMiOrI:QqCpVXCLUXl0j8O2KjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745640832, "uuid": "082af942-3367-4f0e-9174-3d4ecd4d7913", "value": 1732096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745640832, "uuid": "6effcc82-b2b0-48a3-b89c-548efc9c8669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc20eaf0-52f3-11ec-8eb9-fa163e7ea96e", "comment": "Malware payload (Mirai)", "timestamp": 1745641267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641267, "uuid": "855e4a1f-74e5-427b-8135-ac0e792e7275", "comment": "Malware payload (Mirai)", "value": "dca7be1e8a9e190610e179119d08e2d1", "object_relation": "md5", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641267, "uuid": "2f71ce2b-b23e-489b-a2ea-c73d46156f6d", "comment": "Malware payload (Mirai)", "value": "caa9e0eb07ba2c9e18a0b4625cbcef39f2958fca65bb482aa96c0fef79addbcb", "object_relation": "sha256", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641267, "uuid": "c675cbbe-6e67-4902-be05-0b8a4f8196ca", "value": "T1C664F1CAEF01AD3AE9C006767A9F074DB3758FA9D3C3F151F250C61A399A1899F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641267, "uuid": "963ef699-9123-47e0-b1dd-cbdbd24c492c", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xiovsKqqwPa5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiasKqqfPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745641267, "uuid": "2a232228-fe9a-4d11-aa5d-b5af1bfc8cde", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641267, "uuid": "845b86b1-af82-471c-9324-d24247a2c1f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c97dd7-2256-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745641547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641547, "uuid": "ba4a95de-f61c-47fa-bcf4-0de22ca8f18f", "comment": "Malware payload", "value": "07225f93398af61b6bcf4c06bc238606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641547, "uuid": "debe18df-04db-4a81-b4e1-bace153701b4", "comment": "Malware payload", "value": "2f8ec8d2f870e08c3120d5c04de44d6085c4d39d0876aedb83bf45373034f23f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641547, "uuid": "6208b95f-7c9d-4a1b-bf87-108547a53fd1", "value": "T11EA5332EA5CB2033EBA049FD940ABBD176B5FA7DA9CF0F71F06D2E960203500BB555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641547, "uuid": "90619493-c5b3-49ef-9b30-b7b23110b601", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641547, "uuid": "65518369-539a-4af3-ae1d-461607bc7c6b", "value": "49152:Yu1ZZ0T+jOUv376P4tvwWQJb7BurXPMBErFL7mZG5:J/LOeyKvwWUbcTMErlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745641547, "uuid": "590aa9ed-9844-4415-8fe9-7c26af58b969", "value": 2067456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641547, "uuid": "faa4e436-3fcb-4510-9fb5-34e4f0d8611b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29750359-2257-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745641820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641820, "uuid": "536cb9a9-6aba-4f27-bc75-c45c6ef6f518", "comment": "Malware payload (CredentialFlusher)", "value": "645a33cc2a69f4f7f3099383237ab5b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641820, "uuid": "db23ed25-b339-4219-a242-590b6169defa", "comment": "Malware payload (CredentialFlusher)", "value": "9990c1fd607a41471cc0fd430abc451865e72623269ef8301be33c401195398d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641820, "uuid": "485abfea-c206-46b2-b604-765de45d63bc", "value": "T1DA259E0273D1C062FF9B92334B5AF6515BBC69260123E61F13A81DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641820, "uuid": "3af94edd-f355-4cb5-b6da-877bcf8e452a", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641820, "uuid": "f8dfa44a-54ac-41de-a41d-d3f3f43394bd", "value": "24576:DqDEvCTbMWu7rQYlBQcBiT6rprG8a9HSma:DTvC/MTQYxsWR7a9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745641820, "uuid": "c6e866ed-8760-4ed4-a02c-00d8c3feb7c2", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745641820, "uuid": "1f60cc51-43ec-4a17-a0c0-d421c41fbd2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d547e0b-2258-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745642202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642202, "uuid": "b75a9f97-9c52-48a4-b12e-fa73868dacee", "comment": "Malware payload", "value": "ddfb4219039439dd6f828c07d19d8180", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642202, "uuid": "e9b60223-4497-4ca0-8ab5-4bbc598e2b43", "comment": "Malware payload", "value": "44f87b24527db6fd4cbb2897cae9edc92cd519d2e9e0d12c629ec4e5b5473b69", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745642202, "uuid": "5c0b29a5-8053-4aed-ac9e-3005eca84e02", "value": "T1E295331D0DFA1B9EE23498734285C4FB7A90902381BF73F2A52552322ED7D879B479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745642202, "uuid": "d906ea60-1dd4-4d60-9e26-589c6b5b12d9", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745642202, "uuid": "9f15fef0-3dc1-4f0f-ac79-5e885b8a46bd", "value": "49152:+Y2BHIaKBOx//JdILQ6uKt0GTQBOdgO077:+YfFBOhxdsRQBFO07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745642202, "uuid": "e3cf8ec4-2f5c-4868-bed4-9212bdb181ed", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745642202, "uuid": "1a391415-6f01-4501-b6cb-c5ae54a673d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfc3d2b-2259-11f0-82df-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745642763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642763, "uuid": "2acb5d02-39b8-47c1-beb6-9bed8f4a9312", "comment": "Malware payload (RedLineStealer)", "value": "71af825d7875ca4989d7f6e643fa467e", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642763, "uuid": "9c2d7c99-851d-4c38-81b1-8c22b01b4b7b", "comment": "Malware payload (RedLineStealer)", "value": "31e7ce62fbcc7671a9713ea6800fe70234a2c3dd13ed660c3cb266cbb493c886", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745642763, "uuid": "a9034aaa-d6aa-482a-b727-f029a41e9e07", "value": "T1ED66330B2582A17FD817003844E55ED9BBA3A4727BBE6AD735EC2E353C953B062306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745642763, "uuid": "bc16f0d2-58d6-46f4-aa71-695489c4abcd", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745642763, "uuid": "b223aa3c-03b5-4329-a008-7e363778329c", "value": "196608:m/Be/kElannQQv539WoerRStIZp9G9qthQbL2:2okElannQU+04IqtO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745642763, "uuid": "f20f8255-e44b-4ec1-9d2e-e3080316e632", "value": 6619648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745642763, "uuid": "57cf5019-509f-44fe-a9fa-eea9382f3131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790b0875-225b-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745643671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643671, "uuid": "d9520afc-9482-460a-8ac7-de1d6feb15c1", "comment": "Malware payload", "value": "3214e7da3a50b13260b5f9c24556ae46", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643671, "uuid": "6486b702-fe74-4bfc-b971-2371e7cd3659", "comment": "Malware payload", "value": "e6bbc3fe61ccb51576d7786b8f5d68d3adf8355684a033bbb41d14a99ade5b56", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745643671, "uuid": "d1f30255-f4ce-4007-8f07-ceff3435d8f6", "value": "T175F533EC8EBE6AE9341CC7BC35B8534075A86C7A09DC48D16BBEC6071631AD5A7C23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745643671, "uuid": "23f8c921-322f-4cdf-9b3e-3459987c2ff8", "value": "98304:bD/5IVaPY06J3Rh3Vc4smM/THIVvcDUh6+8zgNmHaZ2FTi:P5IVaq3rVamM/jPzgU1Ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745643671, "uuid": "b8d9623c-a2c4-4b85-a47f-714dc3d23f2b", "value": 3610344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745643671, "uuid": "6992bedb-6265-42df-92bb-d17fdef4555c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a0111d-225b-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745643884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643884, "uuid": "01a8ecae-7b09-47d2-b719-7e764a91cbab", "comment": "Malware payload", "value": "7523285a54c69105fd5a86d009f0622c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643884, "uuid": "b063392a-2483-47e5-8cb1-aa2cfad797ba", "comment": "Malware payload", "value": "e053815031b58d54176c802f6e4ba3ba7cf554d26f6ffee94937e73f279874d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745643884, "uuid": "2f5eea6e-0085-47fd-8a96-3b57920969c3", "value": "T159A52252E9A0F5FBC6EAAFB4782F4931E21564B9007493791B031C9BB4F81ADE43C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745643884, "uuid": "bbbed0f4-569c-45cd-899f-ab605a401d1c", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745643884, "uuid": "cf5081ec-75e9-4439-92a9-36aed6b9e1ec", "value": "49152:/D5kxq40/qvMDP2z7x2jV+mTZZU9W3zLsNq8+:r5kMi0j2z7xanZmI3fyq8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745643884, "uuid": "2ef61822-363d-4df3-9b45-2af6a166f3f3", "value": 2075136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745643884, "uuid": "b09c7770-4e54-4ee5-be5f-3dba830e276e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce4b71d-225d-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745644537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745644537, "uuid": "b0c94900-bd22-4af9-8211-3b7f40b4c655", "comment": "Malware payload (CredentialFlusher)", "value": "4c1115e4ea5b3199a2a8d846b93ca12b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745644537, "uuid": "3f028575-4bdd-498a-aeb4-bad588e34973", "comment": "Malware payload (CredentialFlusher)", "value": "dd723583414a126470eba2a94ae6b0b73e3dd8a980cec1b25524e08dc9d6fa85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745644537, "uuid": "60f04cac-dd67-4d68-9be8-befff03dd75f", "value": "T192259E0273D1D062FF9B92334B5AF6115BBC69260123E62F13A81D79BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745644537, "uuid": "f5e24594-044c-4f96-9188-6b9fba926dfc", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745644537, "uuid": "f9411de6-51fc-485f-afd0-1865286620d4", "value": "24576:fqDEvCTbMWu7rQYlBQcBiT6rprG8aLcAZqZJ:fTvC/MTQYxsWR7aLJZqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745644537, "uuid": "5f97e499-1a6e-475c-802e-e291f96435f5", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745644537, "uuid": "9002dfc0-4ffa-4b16-9115-29cd8dea7d7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51db6fc1-225e-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745644894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745644894, "uuid": "202cc63c-f161-4ac3-a4fb-2eeda1ecbf34", "comment": "Malware payload (Amadey)", "value": "8bf4e7f78891d781adcfba290f504afc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745644894, "uuid": "ce8c1dce-a499-496c-a99b-8b238a41d238", "comment": "Malware payload (Amadey)", "value": "40f1059e2606449559ec94ebffc659695193c813990b8d274cc413c025193988", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745644894, "uuid": "7f279161-e2e7-4b5e-b8bc-d6213dbf9c2b", "value": "T1B0A5334BDBEE0572EA45A7704DF602E30936BE10EC6A574B3E57B91B1D70A10A2307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745644894, "uuid": "fd26e3ae-73f9-4a96-8511-9382461c7fef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745644894, "uuid": "ec48dc84-4184-4851-8b4b-c8cfa7d64f71", "value": "49152:+E75C7TaB/PMIpGX6+4mb0psuz7bUetO:yphZeZtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745644894, "uuid": "67d81a4f-1fa7-435b-acd2-9260bd4d53a6", "value": 2191360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745644894, "uuid": "aace076d-086f-437a-820c-9509799ac254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5ba1ab-225e-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745645126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645126, "uuid": "5c44718b-b96d-4412-a53c-a783a70f36e4", "comment": "Malware payload (Amadey)", "value": "999825a4d4b8e6b5c1c0a8273c1d900a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645126, "uuid": "5e0faabb-2b62-4fb8-aeb0-97f11f668afa", "comment": "Malware payload (Amadey)", "value": "46f144e4412210b5750c791d9e53f97b1727feb6e0d99affa99e71678b4cb037", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645126, "uuid": "82f61ecf-93d8-4c96-aadc-a085cde7f133", "value": "T13F159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645126, "uuid": "ac6201a4-d951-43eb-9a74-599ef5393db3", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645126, "uuid": "72280300-66f2-4d57-9657-df5c899ca8ed", "value": "24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8aezV:dTvC/MTQYxsWR7aez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745645126, "uuid": "ecbe8066-fb90-4a83-80a0-260522ddf64c", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645126, "uuid": "6e100d58-c395-49b5-9cb0-52175d80f0d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aedcc81-225f-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745645312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645312, "uuid": "2115c790-b731-417f-905d-5dbb3ea7937c", "comment": "Malware payload", "value": "aac77d6b4981da5c1a5ec111e96eb116", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645312, "uuid": "12919327-f1e9-419b-ab31-b6f79f30a228", "comment": "Malware payload", "value": "4e7c3becb70c45712b3a62662d99bc8921a4e73c867d49c48c10b550589d36ea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645312, "uuid": "18c31ffa-3e52-4caf-b66f-b0f483773459", "value": "T1BA953323EEC5E693C84882FF8A5B5E1E1407D734D6CE95B4D49204FB920684D72A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645312, "uuid": "a758fbcb-e206-48e7-a998-05af6f11984f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645312, "uuid": "d88d8f42-d3fc-4cfa-9cf9-ab080b578a8f", "value": "49152:g5hzNWQDbCi4p5zmo4PjBtaxeXDgOenPu:oN9DOnp5ywxya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745645312, "uuid": "0979a314-014f-469d-97a2-25fe9cb7f346", "value": 1884160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645312, "uuid": "6cf260b1-4764-4892-8f35-fc4f69e2514b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93aa6bca-225f-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745645434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645434, "uuid": "559ad103-a9e9-4997-8c18-aa2f2d4c7239", "comment": "Malware payload (Healer)", "value": "e5ee14fc3621fbe841012cb0e88acee1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645434, "uuid": "24f75735-0489-4d4a-8f3b-246bbb738ec4", "comment": "Malware payload (Healer)", "value": "a433b8c2d8d70b7da1dc2d582d05c112713ea452d6320065d1f8ab493d6294d7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645434, "uuid": "9b2efc9c-c116-47b6-b41c-c85698a00b34", "value": "T150853361BE7185A7C803C83E42BF868853C6A036035791A5317CBE32FEA76755AD3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645434, "uuid": "b3075ab3-8f30-4b32-8192-743b991d1bc4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645434, "uuid": "792dcb66-119a-45b2-aba2-f38130a6124b", "value": "49152:W0AD90HNU0V5qbzAlyhRY62r1ZV8jF2n9otadV:W0XZmSyh+T8j0nm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745645434, "uuid": "713b34ca-510d-4c74-813b-ca8a9c36cef5", "value": 1776128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745645434, "uuid": "0f6f19a2-2a7d-49c3-b829-7bb1ee3ee8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c01d35-2261-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745646379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646379, "uuid": "d9bfa8b7-c46b-430c-891a-7bf9b5514261", "comment": "Malware payload", "value": "aab119a68cf4753749a2b4be71bcbd6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646379, "uuid": "2fadabd6-add7-415f-b220-306e5ee41f74", "comment": "Malware payload", "value": "9eec27e20b242c47f9eb7cd484455353566ef85277c68a05bb6d706495989395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745646379, "uuid": "dead4b56-d43f-4872-8a5e-55631e0663c4", "value": "T1979533707D763A3DF36181BF9D49B00D3BF9FB894A413E2B2684966B09634148DFA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745646379, "uuid": "715cb1f0-9829-4bba-9acd-7c6a38c5be10", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745646379, "uuid": "e54ee3f0-17c7-493a-84d3-d779d79ab712", "value": "49152:VedskrNy7bxwY6jZsA6M6qJAXglCIWnh7H+RfNADD:VedBybxKjcqJTA6NID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745646379, "uuid": "5778b1b7-80cf-4c0c-a865-b4eddb4ec773", "value": 2037760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745646379, "uuid": "9fd8abfd-4aa8-4afa-a39f-4a98b3587663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59057093-2265-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745647912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647912, "uuid": "611fc5b7-f857-410c-9e8a-7fe5c6c9c797", "comment": "Malware payload", "value": "3b83b6209b4a43a63c11f27cc41710ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647912, "uuid": "fdd0c6ed-c647-49fd-8714-57171f42b7cf", "comment": "Malware payload", "value": "10f02ed5ce084881608fda64a12b4e3b7b34e0bcaf99789bb957e2d33f0acbd5", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745647912, "uuid": "d95d9c2d-c3c4-4566-9ad6-18d5fad8999d", "value": "T10E483321E55EC12AD56205B0593F9E7B911F6A390B60A0CBB2CCBD3F67704CB1636E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745647912, "uuid": "6a4bfc53-f8e6-4e6e-8fc0-c39bcbef24ae", "value": "36aca8edddb161c588fcf5afdc1ad9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745647912, "uuid": "30425600-716f-4a2b-9559-c407f764e3ab", "value": "3145728:THtewcwaQEXgUsH6/XCqxccf9qJdnUleGnNX1wLf:XRlETyqxccfs3nUllM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745647912, "uuid": "0686aa9f-8b27-4650-a3da-a15918392f88", "value": 118195712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745647912, "uuid": "02a15395-e74b-4229-8f79-713b8ec20e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c89ad6-2265-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745647914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647914, "uuid": "b0a741f3-e089-4ab0-ac22-36895bb11314", "comment": "Malware payload", "value": "3d38d42ca8b7707f25aa2d1a5dddd66d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#21f8dc", "exportable": true, "hide_tag": false }, { "name": "shadowharvest", "colour": "#6760a9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#55c590", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#3b1ba6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647914, "uuid": "a328b9f2-0921-4aa0-8232-bb8dfb0cbfa2", "comment": "Malware payload", "value": "f85a155d3f75cab12843688f02cec2774cb952c8e020cf764be181c81973e59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#21f8dc", "exportable": true, "hide_tag": false }, { "name": "shadowharvest", "colour": "#6760a9", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#55c590", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#3b1ba6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745647914, "uuid": "20476bfb-6b1c-4d63-85e2-3ae164920a76", "value": "T1695833E1355EC92ED52205F0192C9AB6910CBEE90B61A0C7B3DC7D6E27750CE1736E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745647914, "uuid": "f8ec4f5e-2788-4844-be8a-8ffba1686918", "value": "36aca8edddb161c588fcf5afdc1ad9fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745647914, "uuid": "28647caf-1228-4959-8b2f-422b5bc2e54a", "value": "3145728:ONuz6AlNrYJdWsA8M+af0X/b0IfcUnc0F:rlrgNt/YI0UnBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745647914, "uuid": "8d20cce1-24e2-4d9c-ae21-5c61a5194753", "value": 127094792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745647914, "uuid": "1b561f77-9851-4254-8237-a581fc7204f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d82b631-2266-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745648269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648269, "uuid": "60ba6157-63d9-42f2-ae1a-9d680788a080", "comment": "Malware payload", "value": "149d7de1452346a320a31b3c3b5c091f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648269, "uuid": "bb2ed6b9-d802-42b8-8dd3-f3c83b15eee1", "comment": "Malware payload", "value": "1606a17554ca2ea0e2513ac0a3cc8944f02ae47b98d6f99813c498268fa5c351", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648269, "uuid": "f32da27d-a9bb-4975-840d-d92b780aa712", "value": "T1F2159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648269, "uuid": "e17e974d-1adc-4ae7-9e51-c11809121f67", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648269, "uuid": "4ba92c25-d7df-4985-9429-c7164d8f627e", "value": "24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8ae+V:wTvC/MTQYxsWR7ae+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745648269, "uuid": "73b4d73c-4444-4160-b169-be33967c6042", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648269, "uuid": "eef20665-26a9-4f62-b221-2d8298cf934c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fae62d3-2266-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745648273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648273, "uuid": "508f1681-87f3-4dff-97ee-fbf514f11b26", "comment": "Malware payload (Healer)", "value": "51288493b788325befccd79229f89904", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648273, "uuid": "0d619fcf-2412-4d11-87cf-87ea781a09b4", "comment": "Malware payload (Healer)", "value": "a8bb063e0a288bd3923ee26d0442681f581517d2a08b2613dc12e44453748bd2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648273, "uuid": "dae30ab3-b5a9-4b57-873c-17fce267e1c1", "value": "T1148533007EF4299DCEC3C4FC44A5E4DD66681D22416E5AA7B94063BA311BAE3237B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648273, "uuid": "eac4a4f9-aee6-4312-9c4a-46f26f5cb599", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648273, "uuid": "c92330f4-13a6-4db3-835b-605a1c1f5ef6", "value": "49152:xDhA7FuFX+HH5U1YRBwfi12xlJ46KALUtXT3nbjW86I:VhA7UCHayvP2r2eUtDXwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745648273, "uuid": "f5438d27-599a-4e3c-8ecf-9f40eae85da8", "value": 1774592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648273, "uuid": "8a33e744-7d12-4e9b-ba32-20f87eded011", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7ed2de-2266-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745648321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648321, "uuid": "a5e99f81-da28-480b-ae70-1039955762a7", "comment": "Malware payload (CredentialFlusher)", "value": "ab61a4dfc661ae082b0ea7d26bd07acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648321, "uuid": "7ad5ed92-0e39-4c7c-a85c-4dcefc85c2fe", "comment": "Malware payload (CredentialFlusher)", "value": "a9d77b6cf4c68e124fbaf57d8ddc0c06767999d8d8e82265c349264f8d476326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648321, "uuid": "05fab501-d186-4722-becf-5b614e74790e", "value": "T1DE25AE0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648321, "uuid": "574a3709-8366-48d5-8475-3854ec9d6745", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648321, "uuid": "1483f0cb-8729-499f-a350-901ff14458e9", "value": "24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aS9Xcn:UTvC/MTQYxsWR7aSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745648321, "uuid": "2dadfa18-843a-46f4-8072-994e38db11c9", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648321, "uuid": "9a8b831d-9886-4cca-ba9d-f6c989407fac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91237bf9-2266-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745648436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648436, "uuid": "4ccfd75c-7783-402b-9fe0-ad4a886af50d", "comment": "Malware payload (Amadey)", "value": "bbbb64cf51f4aecf0550845104002f00", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648436, "uuid": "6730b7fc-70a8-4ea4-a704-486981ead621", "comment": "Malware payload (Amadey)", "value": "0ef378cba430c966602168b3e5256f8917f5f6e3a81aea8a92bbb11cd08d4956", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648436, "uuid": "5427eafd-fdb9-41a1-bba5-4c3393c5e037", "value": "T1A0A53307E6FC8132DC35673588FB05E31626BE215536634B5A8AACAD34B26F0F9363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648436, "uuid": "ac3c44ff-9323-42de-8b97-ac74fef6288c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648436, "uuid": "9a776ec9-e723-4ce4-be50-edea00d588c3", "value": "49152:3X75CERCR1rh3kc0TzWh1jvhnliC7eOVpwcEE8z61s75uI/0n:sDrhhLliC7eOV2n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745648436, "uuid": "42f41d5c-b5e3-4696-9135-f1c8a01f8dd3", "value": 2200064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648436, "uuid": "8b8df234-3231-40d9-860a-42de7970aeca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8eacc3b-2266-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745648583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648583, "uuid": "9de6ac01-4f21-4ae0-aa78-68c7dfc913e1", "comment": "Malware payload", "value": "1a03551dd7690429c90de17599c2a76b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648583, "uuid": "3b94b293-4c39-43fc-b0e7-52128ddbb9bc", "comment": "Malware payload", "value": "acb1658fa3e0dc43f072c0e619f09614c24c3c5de6da8643d88eec083e92005f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648583, "uuid": "6d94810f-ccc2-404d-a2be-565080f2246a", "value": "T11895335F962583B7E9DCBFB28682E2C3717F354F4CA203A81C2525351D69309E6F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648583, "uuid": "d21ca645-2b8b-488b-9ff6-03471182ce3e", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648583, "uuid": "a0f4a5dd-5ed2-419d-8880-c59463ecce18", "value": "49152:wNJCRJ80ObnGm1z13ss/lsDyLgyjxKEr6ofN:rP8fzX3ss/lsDbb86o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745648583, "uuid": "ac0bc73c-37bc-4c2b-8625-ed84f219c611", "value": 1892864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745648583, "uuid": "4a99616c-ca57-4e4e-83d2-632f715cad53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "189a2a43-b7bb-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745649486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649486, "uuid": "0e0d6291-a299-4d01-8deb-dba3b74659d0", "comment": "Malware payload", "value": "e89f75f918dbdcee28604d4e09dd71d7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#4f70a0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#bf35ee", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649486, "uuid": "3102daaa-3b31-4ab3-a6af-40311f1c51af", "comment": "Malware payload", "value": "6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#4f70a0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#bf35ee", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745649486, "uuid": "b884d406-968e-4019-bc33-9cdf909808aa", "value": "T1EEB092DDBC61E48018E535511EA3B60D146A22EBB9018B4018C00836A96035F8D0AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745649486, "uuid": "02891860-d9f5-4a83-a1b2-969a647672ab", "value": "3:PouVIZx/XMn30EEBuvFfD0OkADYyT0NV9kBbZWM:hax/XW3/p5mmYyT0NVuB9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745649486, "uuid": "c5390bff-6373-4861-9749-35b81f7a8bb9", "value": 114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745649486, "uuid": "17b3ec1b-4e14-4f72-a3b9-87a529823d61", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfed889e-2269-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745649830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649830, "uuid": "cdf69bc7-f37a-479a-99c3-13859327a8d3", "comment": "Malware payload", "value": "24c216e160853e662cbc3b4cda9a7291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649830, "uuid": "89fc5352-2c7b-49f5-8da3-f36fc0947df4", "comment": "Malware payload", "value": "e799c496cc4a1f3b97fa0c2b10191e00843787bade3ac54e555815626fb53968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745649830, "uuid": "ee510de7-5d11-4363-add5-0753fce2af07", "value": "T1C9A522B62CBE5170E25190BDFC1319131E86181C70E5032A356AE73AFEAB5946CEF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745649830, "uuid": "4a18e54b-2f08-49ac-a254-3ecde82a07c2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745649830, "uuid": "75e7f89e-a93f-45e3-9f4a-d44fd6b69e19", "value": "49152:zgBbWY0SqTnoW+Da9Bc8C5jKiPXfYdGSbOu:zgpNqOa9W8C8u0GS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745649830, "uuid": "c7397b88-422b-4bd5-8b2e-a2779e35cc57", "value": 2101248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745649830, "uuid": "34e246f3-5ed5-499f-b19b-3acc7f8b661b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec75b6d-226a-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745650338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650338, "uuid": "1cdf93e7-5886-4d32-86c1-79ee371b0280", "comment": "Malware payload", "value": "e98f6cbe3afc9a480eb4cffdb012f3d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650338, "uuid": "a8895fac-70c6-4dc0-a0de-362589abe248", "comment": "Malware payload", "value": "59d84373768d640dfe9d343e85755d292494ef7e6855aaf2d97c503a65e788fe", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745650338, "uuid": "5345f3ab-add6-4b62-95f3-2c686e7dc17c", "value": "T1A7C57D5A72A801F8E0BBD078CA87A907D775340507315AEB13E04A562FABBF45E7FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745650338, "uuid": "4374fa23-6e4f-4927-8726-b03d5a0d62f8", "value": "bb6c765d7aa701a2cac93c746a6d2098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745650338, "uuid": "3eafb41d-f03b-4236-8aa3-f8af1cd200cf", "value": "49152:i8LEewSltl1Gd+h86gye7gkCxxoeRm92aJ44bnaH9CgDhR:iYISlvkd+i6AZcaJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745650338, "uuid": "660fd5a0-eba5-4d35-bfea-c6f348b7729d", "value": 2729472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745650338, "uuid": "57224289-b968-464a-949b-fa6ffd5976f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33920ed4-226c-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745650856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650856, "uuid": "39f9bf06-3f70-4805-8fc0-a73bbd979649", "comment": "Malware payload", "value": "2604dd144bf2d612349e803210007648", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "This_exe_triggers_specifically_to_cobaltstrike_c2", "colour": "#e63640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650856, "uuid": "69e475c1-ae06-4b1f-801e-0e9515c7f4ce", "comment": "Malware payload", "value": "23fd3e199e07643ea7fa2e30def0c1777f59baff0fbae244a35884799a74e38d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "This_exe_triggers_specifically_to_cobaltstrike_c2", "colour": "#e63640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745650856, "uuid": "a7ad3d95-54ac-4ca3-b0a3-5307bed8abe5", "value": "T1F234E04C847DCACC2A1BCE9C3E8E4F9A43915910EFFC5692E47576FA41CDA8F820D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745650856, "uuid": "b3230267-c195-41db-aaee-430007bec205", "value": "6144:j6moF8FHs9vp9reURdPjFToEgqVcT5siShv1yTGfvU2Zdm:jfoF8FM9vp9tPjFToEgqVCaiShMT6vUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745650856, "uuid": "8c23042b-bb06-46d8-9e64-8a34ec4abfce", "value": 247883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745650856, "uuid": "7c3f794f-5dfa-4c11-bece-e69fb839df30", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e5f975-226e-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745651724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745651724, "uuid": "e23d9786-191f-488b-8d3f-15e947977748", "comment": "Malware payload", "value": "f559e1c4da2521a615246405fea5ad80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745651724, "uuid": "64c2f40c-ec45-44cf-ac5a-0c31a828665e", "comment": "Malware payload", "value": "74d5e0b4dd4a4a24adc94dde042836d659e7fbb095934add58dbcf46d116707a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745651724, "uuid": "afcf8af2-f54e-45f5-8d55-abf364eed609", "value": "T1DE9533E02E288DB6E49EA5743B6D41B217DA1F48FCB9D47E4EBEB2C31454991B8C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745651724, "uuid": "54dd3144-b156-4b55-bf00-fbbf20b2bc3e", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745651724, "uuid": "fa488f43-fe3c-4e02-9e08-a6dc62a61822", "value": "24576:B6t4bv3vobMyRxqPF1OnyUl7qj1FQMKUXeP4uPOipRufgHjbxz0iKuoiexkywpo4:4OTQbfyF11DfKUX+Rxbxz0nnw7Lg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745651724, "uuid": "39da99ae-cec1-4e32-9f2e-8b281f3a014f", "value": 2059264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745651724, "uuid": "8e858d1b-a756-413d-8899-45d8833c28a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6fd8b9-226e-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745652000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652000, "uuid": "b197d913-a41d-45c0-9f91-09fddcadef14", "comment": "Malware payload", "value": "fbbc23dd866d1d4d35ae013587ab345f", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "shellcode", "colour": "#a76d1c", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652000, "uuid": "d491c536-3053-480a-a3d4-07b76389a5f6", "comment": "Malware payload", "value": "3914806a93bd8225922cdcb886ec3037af7adce8550cbd4f344ef10e50c08107", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "shellcode", "colour": "#a76d1c", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652000, "uuid": "c946860a-1d68-45b9-8215-278512dd58a9", "value": "T1DD24DF9FA2B7F2735E7BACD1CE69FA50252D8BB967CC22C40C10602364142593DE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652000, "uuid": "44ca9704-69c8-462d-a463-efd08ce0ae10", "value": "6144:SaOoesUhu/IAL36LolJBOdBpIdPzgZ7y+wozc:9Oo/Uhy36LHUzgZha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745652000, "uuid": "193f6a43-de2c-4e21-ba4f-82622d8f8925", "value": 213572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652000, "uuid": "bd326d43-662b-494f-a0a4-d0938e99ccdd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b0c7a3-226f-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745652198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652198, "uuid": "fa7a9173-68f1-444d-8028-d5e512734b69", "comment": "Malware payload", "value": "018a3029bb089a638bae278fc2142b86", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "dropped_file", "colour": "#b7efc8", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#ef1c92", "exportable": true, "hide_tag": false }, { "name": "shellcode", "colour": "#a76d1c", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652198, "uuid": "c59fd44d-29a5-4214-a8b0-6741ae5cfd6d", "comment": "Malware payload", "value": "97d60ec386e41fc38100b8f67b07f5acb891e73c88a831c1dcd486b66fc2ea1b", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "dropped_file", "colour": "#b7efc8", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#ef1c92", "exportable": true, "hide_tag": false }, { "name": "shellcode", "colour": "#a76d1c", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652198, "uuid": "912c2b73-c898-44fa-a03e-4eb21a363ee0", "value": "T15023AF91B37281D4EBB1C026FC14AB5BEFF2314E8554998BB7548EC25B23920BB1D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652198, "uuid": "88d34f7a-d4c4-4db1-b42d-807ba0299916", "value": "768:lJGI8cEfYQwkKHQIR+/i7IxfsE3rcS7iKGztVuanh8w2OfJ7ejaP6yEqzeGO0gf:zGIZEfYQ5UBk/i8xfsIcS7i9u6yeNejB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745652198, "uuid": "9e7a82ca-4967-4ede-a908-9706fb6318e6", "value": 48085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652198, "uuid": "9b3a9007-33f2-4ce9-a002-fe721bfdd261", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e77221-2270-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745652815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652815, "uuid": "5d69329f-2d8c-4dc5-9fcf-1d0b11b0b1c6", "comment": "Malware payload (Healer)", "value": "9768816bd6adf7c12b0b10e3ef18ccac", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652815, "uuid": "5cc4e93b-3334-408c-b1f0-a5615624627e", "comment": "Malware payload (Healer)", "value": "5d73822cd46dc65877d705346b76c13902560f74386760cbc3294546135ce54f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652815, "uuid": "e1fe1257-99f8-4581-b4e4-b6b9739e3137", "value": "T1918533009A13745CC927AE73F9FA13C5963C6443EDFE1AC47E4E942C54231F2AA9A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652815, "uuid": "2d77e7a9-f3cc-4ec5-a7db-5fb5f19ecf1b", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652815, "uuid": "ecd6a406-5e09-4af2-94ad-ada5eb452553", "value": "49152:wzFZwtiDskBwXzDNF6C/PvN/UndZB32uWT:ttQs/zj6COdZBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745652815, "uuid": "d35a19e3-52b7-45a2-9965-4824ad52f451", "value": 1750016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652815, "uuid": "8cfaecf5-10e7-4a94-8475-9a61afe6c649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74f6374-2270-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745652876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652876, "uuid": "16cf0778-8e9a-4dcb-b46a-4d1a0be82f6c", "comment": "Malware payload (CredentialFlusher)", "value": "137743f3190fcf05d4ade84e00aa5011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652876, "uuid": "adb46a52-8fc1-48ab-9316-7b6c0f727331", "comment": "Malware payload (CredentialFlusher)", "value": "d4dc03f8d276bb7c4b928b8176771ea60dddc391208bd8b568a29b70bebc2259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652876, "uuid": "651aafee-0385-4bce-9dce-29896e68a311", "value": "T16A25AE0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652876, "uuid": "8efb64b2-7e81-4157-aa8c-e4cbf7b91820", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652876, "uuid": "690ed17f-4f78-4365-90e9-1ca0728a8eaa", "value": "24576:oqDEvCTbMWu7rQYlBQcBiT6rprG8aqY4:oTvC/MTQYxsWR7aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745652876, "uuid": "43c4f4ed-ca5a-4e0c-949e-3042fae80fca", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652876, "uuid": "67132699-f368-4462-a24f-83a9149924ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacedeac-2270-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745652881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652881, "uuid": "772c9d1b-05b4-47b5-b260-f6c02ddb4bdd", "comment": "Malware payload", "value": "e43fd16866e8f3a651b09f425f10e7f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652881, "uuid": "6902a63e-7f18-4e76-8f22-d926a57ff65a", "comment": "Malware payload", "value": "9dfaf79d24191cef66e43117a704bc57f6ce175104645a1bd49aa0c3073564fa", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652881, "uuid": "de43ee48-f3a0-410d-a042-d1a623738432", "value": "T184A633D06E5665B6F5E8A934177D72A60ADCADC707EB1811D72CE2CE4C31E03CF862", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652881, "uuid": "3f4db4fd-cc29-466b-87ab-da6824d3c80f", "value": "69585df030b601e329329e11206f7dbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652881, "uuid": "056445a7-959e-4216-a2f8-bd2dfc0ae6ba", "value": "196608:jkmFdhv48uFPcr9S9YZIcEMLfx5Gk32yVlolqAuI5vyUf1:gG34VcrKIZ5GMFlo9Dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745652881, "uuid": "1c2b39c7-2227-4a09-9721-f42e2c31d7b9", "value": 10235608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652881, "uuid": "c849c820-669c-4050-aa4f-a5cfc32936bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098d7b41-2271-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745652933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652933, "uuid": "c80caa0b-e537-456c-a19e-aeb05ce3141d", "comment": "Malware payload (Amadey)", "value": "58749d7a1409f849532804962c9b1793", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652933, "uuid": "db143cce-c0b3-4945-90f7-7f189de09683", "comment": "Malware payload (Amadey)", "value": "ec6099559f447bcb3b4f4bb0fc51351e33ea70e5952f691ad2093b89a00ac907", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652933, "uuid": "17990854-6ea6-4b9d-9b38-2acecb41e31d", "value": "T1E0159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652933, "uuid": "af136b02-f1a2-4ec4-9ecd-41bf379d5981", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652933, "uuid": "d163ceb1-b0d8-4488-b714-ae36de368491", "value": "24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8aeGV:aTvC/MTQYxsWR7aeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745652933, "uuid": "7017cadd-45df-4405-8101-dcbece9000f4", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745652933, "uuid": "184237b8-03f5-4bb4-8ed5-f680216d6ca4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853700f6-2271-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745653141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745653141, "uuid": "0f6e377b-766d-49b8-99c2-c73911d472be", "comment": "Malware payload", "value": "684bb88c78adb3a48b63ea661c0f9735", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745653141, "uuid": "b5225dac-9793-42e3-9447-c2291734ab9d", "comment": "Malware payload", "value": "4ce44ddf40e5a53b1523b8c92d2acd926f571a524e871ca68c5202c5c5a50934", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745653141, "uuid": "00df1a96-443d-49f9-8c96-4c49d84645c3", "value": "T14095339116AD762FC218C3735AEB56FCAF31EA204F5912EB1E9F46309653263F67B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745653141, "uuid": "e3834620-961a-4d2d-823a-b33c7b2569b1", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745653141, "uuid": "c46a9155-c37d-46e7-b4f0-a92d67bbc0a6", "value": "49152:emkVV865mlIcsEr+m212bqdZYHVHTju8fBztw0r4kii+:emYV8amlIcjpBqcHVHTju4pLii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745653141, "uuid": "279e0a51-bf8f-45a1-ba25-3206b8ee11a3", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745653141, "uuid": "65674509-dc78-406e-8841-a5f4174be505", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79c3b31-2272-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745653762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745653762, "uuid": "c9f4f73f-c0eb-452c-abc5-b94c9415a32f", "comment": "Malware payload (Amadey)", "value": "c2f93e7d843076d671220b182bec28e3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745653762, "uuid": "740507ab-9936-4c62-81b0-6f946e6c5597", "comment": "Malware payload (Amadey)", "value": "9e0272f80b7fabddfd8b9b9e8198e8df254cfc0139f9ec4abd112f92119b12ba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745653762, "uuid": "1c25114d-4af1-4a0b-851f-bf12104b63a9", "value": "T135A53347F6EA4126F8E507341DEA02C7063ABD6147F0125E328ADD191BB1B91F9713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745653762, "uuid": "ca36ea08-94d4-4ee4-80e7-7a1cc4a3a6f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745653762, "uuid": "00f4dc68-ef8e-4ef3-849b-f33fc24c6258", "value": "24576:oy+bTD5D2wZJ9umhJTIu44go5XwCMvfzSbGZQtF/b0WYeNGv8ZrAZinMTAZML4ZN:v+75CwZJnxE+b3HbbjrG0UySiFWELZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745653762, "uuid": "4ea52814-4ef4-473f-972f-3d84d5c74b98", "value": 2183680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745653762, "uuid": "f32683ba-62ee-45f9-b390-def4fa7d730f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57ac67b-2273-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745654161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654161, "uuid": "f691914d-f223-472f-9656-5dba95980059", "comment": "Malware payload", "value": "20a34763d85eedd1aedc41d80835350e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654161, "uuid": "b9331af7-76c7-4ca7-aa03-61b27ed5fff1", "comment": "Malware payload", "value": "520f9ad18c0b2220c60f0b128705a4417e6deb027d89c7fac210ef7910ff6c25", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654161, "uuid": "a74acf87-ec13-41f4-bc38-c3a503082887", "value": "T10524E0EC74120D1B091F44B742BF27C95C52EF2FB8EF0D226DA15A6B165C2886BCCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654161, "uuid": "1e9535a1-9f50-49bd-9865-e1bccadf8683", "value": "3072:FvxzAnUXAKZktHeIufw16J+06aFyqfuNIf5XAclS6HrKgxDCEEWPXBHYOOWgxJlP:nzJbG0fXJvHf4YAoxGEEBOOWuj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745654161, "uuid": "f8353b3a-1500-4c99-bbdd-303d89a65a1d", "value": 213596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654161, "uuid": "60b0c0be-30ee-4d1d-91a8-e11b540535e3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62dda37c-7fdd-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745654345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654345, "uuid": "0ca9d786-f06a-4853-a117-f155de96d6c1", "comment": "Malware payload", "value": "fbe51695e97a45dc61967dc3241a37dc", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": " ELF", "colour": "#b74ee1", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "curl", "colour": "#c2a286", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "wget", "colour": "#5D3E49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654345, "uuid": "a703401c-a195-4ddc-bf60-6130e4d01785", "comment": "Malware payload", "value": "2e4506802aedea2e6d53910dfb296323be6620ac08c4b799a879eace5923a7b6", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": " ELF", "colour": "#b74ee1", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "curl", "colour": "#c2a286", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "wget", "colour": "#5D3E49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654345, "uuid": "e70f3162-b701-41d0-86d7-df974982cc5c", "value": "6FD312ABC8FA89CEFE6A4FF5265B1D4B0EF6E1D5E5C43DA4412B008017F8256A514B4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654345, "uuid": "ca68b956-b931-40e1-86d1-62480b3c182d", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6cot:7O/QJHZweEL/NOjCHm7FZZncI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745654345, "uuid": "95e5250e-4b1b-4baf-abfe-38cdeab05954", "value": 132876, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aca98f2-21ff-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745654471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654471, "uuid": "5096875f-8dd4-4c2b-ba11-5a90f5484cdc", "comment": "Malware payload", "value": "4d8c8426ea711b0bb1e49476ec9e4d8d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654471, "uuid": "af62938b-caf5-4714-bd4b-fd7917023b64", "comment": "Malware payload", "value": "2df04e5d2abadab3a9201225f61d5bf0a03d81aef3d780cb41db731cdd2ef840", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654471, "uuid": "48d7bad9-5811-41a7-8674-c9af494eec6e", "value": "T199F533EF8D5FA6F199580A2D31B45DDB471039F306CA9C9A7F6BC8088A336D5CBA31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654471, "uuid": "586a9a79-00a3-438d-902d-2f44a3ee7ad0", "value": "98304:zAx8LTGyBnsqPaPob99Udv/Z0PJdci8MX20m+NSudi:za8LLFiPob9K50PDcw5mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745654471, "uuid": "106d9bb9-d663-41f3-b44c-5c33c40a02e2", "value": 3627864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654471, "uuid": "80c8c8cb-e298-4625-a6e4-b9cd57714e91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "465b9c5c-21ff-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745654471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654471, "uuid": "5e4e3904-113a-4a90-acd1-047b05a66e6e", "comment": "Malware payload", "value": "5d1ca537c4bedebf2f4d276d4199ea95", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654471, "uuid": "ff7b3fad-691d-4b53-983a-74baf2866bc8", "comment": "Malware payload", "value": "bae21a944b639ed2c7b70964288131274916a1d52ac906725b39a3e15d243cf0", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654471, "uuid": "0a194fbe-1261-4e05-bcb6-987a76456fb4", "value": "T116F53399C8332AF2795E972EB73A07A43FA5BCFE5BDE78D007668DA54832DD141123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654471, "uuid": "a6ae44bd-af0e-4431-952b-945d5f1e0884", "value": "98304:vdSFDyvEL91S9I9JeXudd6b9oyRq2dIrzJDvS4UDb4SjVqSA:vdSFhL9Vrk9oyM2SXJDFOxjkSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745654471, "uuid": "6cc5e86b-12a6-4dd7-84bf-fd9913c0e9d4", "value": 3631236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654471, "uuid": "3773dca7-5fc9-4c3a-83d6-cd85715e5095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6c5cbd-3d98-11ef-b2b7-82aee05be84a", "comment": "Malware payload", "timestamp": 1745654473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654473, "uuid": "e2d7276a-09ea-4e5c-bd90-0cee20a25fd9", "comment": "Malware payload", "value": "1a6dca8ef99e58ed2ba95ad46c4e0591", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "jjagg", "colour": "#f01f72", "exportable": true, "hide_tag": false }, { "name": "P2Pinfect", "colour": "#D18D7D", "exportable": true, "hide_tag": false }, { "name": "peer2peer", "colour": "#955712", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654473, "uuid": "3013151c-9192-4cb0-92c3-ac09414745b3", "comment": "Malware payload", "value": "e266522260258ca88b5659042f103dff04b65e1c5aeb8423545df1e1cde0718f", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "jjagg", "colour": "#f01f72", "exportable": true, "hide_tag": false }, { "name": "P2Pinfect", "colour": "#D18D7D", "exportable": true, "hide_tag": false }, { "name": "peer2peer", "colour": "#955712", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654473, "uuid": "a336651b-d8b0-4423-98d0-674392ad1bc0", "value": "T1A1B533C84EB848CA39D68D7B333A55C92154F816F6ED2D92EE7D9EB2207CCC36E421", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654473, "uuid": "80a15f8f-079c-46a7-a46d-de796beaaa43", "value": "49152:gSTThuIhuiywLRV7G6w8HMl7X0oTP0XX7zgm4GIePfyVxSV1IqjzdWs13N76DB:ZJzuMLz7G6u0oTPULE+p6yjzYsBmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745654473, "uuid": "7e62b038-0a6b-4f06-8190-8d058b742a5c", "value": 2382100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654473, "uuid": "46dc0703-bb1d-4359-893d-0452e307c7a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "telfhash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745654473, "uuid": "bdf17239-3a4f-4c9e-b330-bcf1f57b2f8a", "value": "tnull", "object_relation": "telfhash" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3b8450-2277-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745655676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655676, "uuid": "6312c2c1-b697-4fe7-ae27-bc9f9e13c083", "comment": "Malware payload", "value": "35c04a3f347249a96dcf9144e8cd6261", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655676, "uuid": "2767fe86-c895-4e24-816a-31d6eb336a6a", "comment": "Malware payload", "value": "9f61775208ed08ad93bcac2a43e564efdb825a2f0c1cb8b01403d5418f6be9ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655676, "uuid": "56ed900a-ccd0-4834-8232-c8d0b3a71839", "value": "T103A522671A3F369EEE60C7399D71C90B973162CC02DCB56DE200AB66CF361A5CDA47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655676, "uuid": "cde1eea7-1090-41e9-a930-8849e30cc9de", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655676, "uuid": "4447c5cb-5567-46cb-99b1-ec764b88a65b", "value": "49152:wKv3cUT+2WzM3CM4YwxQUj0hIa7FYAT2aAR5am:wKv33ozGpKj+vrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745655676, "uuid": "ea68efda-4388-4d98-afbb-007ec04c443a", "value": 2103296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655676, "uuid": "13a7ce19-78cb-403e-b5e4-987caf34a0b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3288a4a-2277-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745655795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655795, "uuid": "34c69803-27be-4d93-a13e-f6f8825933cb", "comment": "Malware payload (Amadey)", "value": "a51028cde72f5359b8a94f4a81932cc4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655795, "uuid": "ce37376a-92e7-4d1d-81c0-a2674447699a", "comment": "Malware payload (Amadey)", "value": "5c362ba616f39aaa4996d69671e6709fbca66181aa97f8cb8e0f67f378313a2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655795, "uuid": "4431de75-8852-4a01-9ca6-6fccd4ecfaba", "value": "T174159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655795, "uuid": "b6ee92cb-b400-47bb-9805-668fec8f6eee", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655795, "uuid": "80537912-5a50-48f9-b0bc-41477d41d751", "value": "24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8aeSV:1TvC/MTQYxsWR7aeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745655795, "uuid": "a453830f-3ed1-41e5-9242-39a7b71444df", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655795, "uuid": "74a774e1-0489-4291-87d9-877bf3aece28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e48cf4b2-2277-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745655877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655877, "uuid": "82f35146-c18e-4380-8551-ec9b8b33eaa4", "comment": "Malware payload", "value": "14596a259f597b754f6486cc601e7b39", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655877, "uuid": "a7b1d77a-bf2e-40b5-b673-98b618e32809", "comment": "Malware payload", "value": "bd74a3219a3bb3db98ca1368b52691018cf17d4dd25bd005f916916076c7983a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655877, "uuid": "27807508-d00e-4806-a836-812ae2edbb82", "value": "T1FB8533C73D7ACAAFD1D685FF0245A0C92DD809658E13DF607A0880F48ACBCFB93566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655877, "uuid": "39781f08-3445-4ca5-8a30-9f62c546f7d0", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655877, "uuid": "c383f8d7-0209-40f2-8f24-69744f821b76", "value": "49152:hRO4hJ3ZmNbmS42aSx573R5FLPEs9U3w:XOimDtz5LRbPEs9U3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745655877, "uuid": "0f94fb01-e780-4af1-8bf8-be03c4659174", "value": 1863168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745655877, "uuid": "80d642be-7ab0-4340-ae2b-796a15328161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f48313de-2278-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745656334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656334, "uuid": "6e84c3dc-6324-4533-8d8a-dcf5fbf366fd", "comment": "Malware payload (Amadey)", "value": "733e494c895481917f7f890a90b59925", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656334, "uuid": "84dd60f7-8430-40ee-a5e9-1da5a7aba8f5", "comment": "Malware payload (Amadey)", "value": "cc1b4f750c1343492ebfecadadb1b3b54d966602f8416bc207038aaa0567733e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656334, "uuid": "3389aa03-53f6-4aa9-ba62-d6b23b7cce1f", "value": "T1A4A5330793EEC027CA640B321EFB03C71A6EB9A20E77A467265B55CD917326063367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656334, "uuid": "7f9588c1-c39e-41a5-ac47-acf267cf6458", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656334, "uuid": "aab6ac47-c0a7-4079-907a-bc8624961984", "value": "49152:jB75Co3rgrK79CanRpFWAd1ux2lfA3dUf1P8wZTgoA:xrgu7ZnnwwfrNUwlgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745656334, "uuid": "68672d7f-d21d-4098-bb66-3b06ae182462", "value": 2169344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656334, "uuid": "8446e44a-5c7d-493b-b9ef-1898ca53ceb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f74e95d-2279-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745656406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656406, "uuid": "1ff0fbc6-d64f-454d-8518-9e5e5e726960", "comment": "Malware payload (CredentialFlusher)", "value": "bedb1321ca5bf8aa0f05b133ad6e4951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656406, "uuid": "c4e92036-f360-45d2-a359-6b18314211a9", "comment": "Malware payload (CredentialFlusher)", "value": "8b682c77b93930ae4bce70a28eab06a0cdec58ec442e23b89488d38148d5bb93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656406, "uuid": "a01e1c7c-eff1-4fbb-857c-0876dab831e4", "value": "T119259E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656406, "uuid": "00e58270-c855-4f58-b283-83b804fbe6b6", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656406, "uuid": "61a52593-1d74-4276-943a-7d244196fbdf", "value": "24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8a0te/F:7TvC/MTQYxsWR7a0tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745656406, "uuid": "f1eb29e8-c516-4200-b8f1-29c21e855c4d", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656406, "uuid": "be768ac7-7121-4698-97f5-c5962c4ec9b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc807a52-2279-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745656777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656777, "uuid": "cbff8681-94b3-4914-a1a1-40e726142eb5", "comment": "Malware payload (Healer)", "value": "33573d241305e31c8bca24939f28172b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656777, "uuid": "1ec1758b-fd82-47b1-918f-69ebb3e08305", "comment": "Malware payload (Healer)", "value": "5c0a46cc04d1fa0dc024c241b009cbde9cb256378f7c67a5372f2497cf4c9ee7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656777, "uuid": "400ac575-45bd-4265-939e-b620fd2c4317", "value": "T12B8533052F161BD2CBC616BAAE85C6849C725C83A56DF07A0F72577B3927B044BECD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656777, "uuid": "0d227b9d-2b88-49b8-93e8-c19de34dedd7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656777, "uuid": "c2e8b858-9423-44de-8605-5910dd6d2ca1", "value": "24576:a2o4UY2chNjPTJtIGL2leYmOKD2GcnzjqjR6VwSuhitW81fwHUp8NJOoAD:anzc/PTJtIePc3q9rphO16Up0Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745656777, "uuid": "b545298a-59c6-406e-af8f-39b28c655f66", "value": 1721344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745656777, "uuid": "581aa503-170f-4410-8668-91cb5bb8fd2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a9ca89-227b-11f0-82df-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1745657242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657242, "uuid": "11f5905c-0170-4468-b603-b66e8d1114f5", "comment": "Malware payload (ConnectWise)", "value": "a4f225dbd8331a9434e2f3fe8d752a48", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657242, "uuid": "6bfaeee2-4c10-4b3b-b8eb-0abf399608c2", "comment": "Malware payload (ConnectWise)", "value": "7a9f5be820b34fde426c631c572d86b12d944477b0e70022739051985272971c", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745657242, "uuid": "a0c69169-eb6e-42b4-af35-71c9ad97f4d0", "value": "T1AD835B43B5D18875E9720E3118B1D9B4593FBE110EA48EAB3398427E0F351D19E3AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745657242, "uuid": "25ab2197-9988-4f42-82cb-f448bd0487ec", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745657242, "uuid": "cb98bd0a-d2ad-4958-a3df-4a725f5bd86a", "value": "1536:BoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaxPBJYYV7mxD4:7enkyfPAwiMq0RqRfbaxZJYYV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745657242, "uuid": "6fc1de3d-1a3a-46e6-8242-502d0b13ad45", "value": 83224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745657242, "uuid": "23c20e73-6fcc-4537-9dc1-eb8afb77d4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c306c69-227b-11f0-82df-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1745657286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657286, "uuid": "141ce6e1-3c60-43ff-ae0d-dbe29bbc5987", "comment": "Malware payload (ConnectWise)", "value": "b8d0d06cd88335d6d185426818fd68f0", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657286, "uuid": "d23d199f-0fe5-453f-bf40-3cb83df8acc3", "comment": "Malware payload (ConnectWise)", "value": "ebcc884e6adeeb795c5b21beac7abd12c0055d0bced466fba0d2f3bf455904dc", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745657286, "uuid": "ec2247b5-dba4-47b7-ab50-6d159c0909b6", "value": "T144836C13B5D18475E8B30E3118B5D9B4993F7D120E648EAB2398427E0F351D1AE3AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745657286, "uuid": "314b5d3c-7237-44f7-8c1e-98899b00f3e7", "value": "7631a79a9071099fa4803e1c4c5df207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745657286, "uuid": "bc7e1dd6-8877-4427-b579-0199755822c9", "value": "1536:0azWlKzJVcNp++yQNS6xNNCT2l8NE8llbpTaCJRpsWr6cdaQTJSvYYS7QYx5:AFNpo6rIKlUE8fbkqRfbaQlaYYSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745657286, "uuid": "7cb3594c-6dd9-4c7f-b766-006378c80839", "value": 86304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745657286, "uuid": "3107e6ca-43b9-4c1e-8e93-bd422d9684fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff90a483-227c-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745658070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658070, "uuid": "ca265149-1521-4a5f-add7-d827aaa3dc19", "comment": "Malware payload", "value": "dc0eb4ce25d3ca2036d7e8d60a306a57", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658070, "uuid": "fc0fda8f-8202-49e1-a527-eed3540912da", "comment": "Malware payload", "value": "46a96582255be813d24ec1fb218d8bd125bb8c5c3308fd74c99a548993437c9c", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658070, "uuid": "3e690735-0e50-42e3-bc58-9d21ce570529", "value": "T193F5335B5A3F4AE27014DD9163AC79EB42C8BE396ED92CD17F59D28308BA4D453203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658070, "uuid": "2f6e0fee-3e93-4374-81bf-94e627667c17", "value": "98304:vLynBE8czqWPE0C7fM3/HPqAC8phDqm8gRj7va91:WnBTYAQPPqAbvlj2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745658070, "uuid": "293c9da1-4a40-4b62-a5fb-b64b8a2fba32", "value": 3624504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658070, "uuid": "db4282c5-ff08-4df0-973c-01574b5ed1fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e20a70-227e-11f0-82df-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1745658643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658643, "uuid": "37cb0b30-ef90-4eea-9fb5-f868292d57f7", "comment": "Malware payload (ConnectWise)", "value": "e445fd869871faa33155feed9df58fd0", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658643, "uuid": "17687bfc-7ab0-4002-8976-bd2b2a3f4841", "comment": "Malware payload (ConnectWise)", "value": "e2d4dd15585897750b68cb396a882a9685084ce3b09ea60a563a30144ab14750", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658643, "uuid": "0858800e-86d4-4585-a7f4-0a94ba928ccf", "value": "T1D6835B43B5D18875E9720E3118B1E9B4593FBD110EA48EAB3398427E0F351D19E3AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658643, "uuid": "09550324-00b8-4c82-a148-c26d546df92c", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658643, "uuid": "53ca8238-dfc3-4d76-9d70-1ff314891a23", "value": "1536:ZoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaxPBJYYJ7yxD:jenkyfPAwiMq0RqRfbaxZJYYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745658643, "uuid": "ff4b1794-a9c6-4ba5-a2cc-225e0aceaded", "value": 83232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658643, "uuid": "52cfb379-999d-4297-8c4d-efd2b7c1033e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16c3318-227e-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745658771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658771, "uuid": "5fe5fe5e-3d57-4da0-ba88-9e121ed988b5", "comment": "Malware payload", "value": "55dbf06e330ca609ffa007eea59e25a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658771, "uuid": "4ad00233-0321-443b-b213-6c9c61fe335b", "comment": "Malware payload", "value": "cad91700a23d92a5a9e437f7520b8152ddbf5bd7bc01c103dacf05e1ed55f924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658771, "uuid": "458814b6-9982-4629-ba1e-dee6bf112f12", "value": "T10C9533591F4F486BC46E0A3A3E5D438875F837918E23767E5D0A3311A8767303ABDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658771, "uuid": "80eaecdc-e1ec-4d78-89f0-ea8d94a5d644", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658771, "uuid": "48eb30b0-8f9d-4451-bca5-9abb983b1ad3", "value": "49152:yvHX4as6f7VC1xZAi2rHMapoYWVnnO/4vYZR5arME8dA:y/BfJC/ZAi2zixnn9g35ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745658771, "uuid": "b6863789-d5d8-4009-ad28-e6cbc0d227ed", "value": 2051072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745658771, "uuid": "86b18651-22cd-440e-afc6-e827e07ff5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa68a251-2280-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745659645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659645, "uuid": "485d98ff-f590-4662-9b93-b1f6e2c9c4f6", "comment": "Malware payload (CredentialFlusher)", "value": "b0564c49f3e98ec7a55c0f16946d33bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659645, "uuid": "f132d6c9-5d6e-471c-9b79-aad3f627dd2b", "comment": "Malware payload (CredentialFlusher)", "value": "a2e927d86d5113618e65d7b60c15efd67b35a91b231acf9663839e8f021200ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659645, "uuid": "8e4fc7be-eb34-415b-a95d-7d4aa57368c9", "value": "T156259E0273D1C062FFAB92334F5AF6515ABC69260123E61F13981D7ABE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659645, "uuid": "19cc433e-21dd-4f4c-8bfe-1a5f997e0199", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659645, "uuid": "804e78f2-d70d-4185-b7f3-a72505ef678b", "value": "24576:PqDEvCTbMWu7rQYlBQcBiT6rprG8a9IVI:PTvC/MTQYxsWR7a9IV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745659645, "uuid": "24728200-43e9-4b4c-8728-acbdd8fd82b7", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659645, "uuid": "b72f7307-d3ab-47bb-8d1f-223dd965f30d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d15e5d-2280-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745659717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659717, "uuid": "9e5e5864-42af-4e60-8e93-0680b5276c7b", "comment": "Malware payload", "value": "2dd5fff5fcf1e883d5a0818b42b9fc34", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659717, "uuid": "083a04b9-0a09-4fb9-8ff9-b6d479b25a4a", "comment": "Malware payload", "value": "87b3337b7ba8634eff8379698b959a03bfa95e0c8fe1a15776f756b0f3913d44", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659717, "uuid": "12a5904f-c813-474a-96c1-d228b18cdb0f", "value": "T1F88533742CF76799EA3903701E37C51576717B2280A71B26ACBCF079982FC5C5A588", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659717, "uuid": "5c170063-8848-4a06-aa69-ac78b45edde4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659717, "uuid": "d219c8ad-e6df-43b5-bd4b-0e4dc3e9f9a3", "value": "24576:Ls2qV/t5D4SRsjFHFoY3jW3vREhqIpXaxDBjyIF7FMzKzOaHgNrtpt/QReSjrR5I:L0JD4SRCx+Ch10LRFNOaCr5ieSjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745659717, "uuid": "3781bda0-e9b0-4494-8285-d64f49fc3c98", "value": 1857536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659717, "uuid": "3168d8ca-f01a-495a-a649-c07a5bc03921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a23873e-2281-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745659806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659806, "uuid": "d028a688-28af-4aab-9753-96ede14a7552", "comment": "Malware payload", "value": "11b6e96c98661df24104b1d369f19558", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659806, "uuid": "2836c333-81f6-47db-9a67-3266eddfd246", "comment": "Malware payload", "value": "fa94f024fca1b68d28ebf35c58473f6e477dc4a7d87aa5e49ed5b9afcfdcfc1f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659806, "uuid": "e97a30e5-080f-498c-89f1-ca2c74187c06", "value": "T1CD159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659806, "uuid": "4aa8d40b-99df-4a1a-9459-9e43133b9e5c", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659806, "uuid": "7292012c-053c-44fe-9983-7b7e2616bdfa", "value": "24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aeAV:UTvC/MTQYxsWR7aeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745659806, "uuid": "c3be01ee-7487-45be-8bd5-3699f6fe3a51", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745659806, "uuid": "55288970-976b-4b3b-a771-f0792d01fd04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf57e8e-2281-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745660106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660106, "uuid": "7709f02c-4bd0-49e2-9657-391c941f1a59", "comment": "Malware payload (Amadey)", "value": "4d44db5ed70dc78b9606897e5cf85de7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660106, "uuid": "91cb4af0-540c-44d0-89cb-1915fb1d3e39", "comment": "Malware payload (Amadey)", "value": "93a20bc4304d63bc5ead482baf4e9708ff88821bce4d93cc679182bccdc64cdc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660106, "uuid": "b2180dc6-fb20-4c00-a53d-714308ed6cbc", "value": "T1D5A52306D2D86136E96953348CF543D31A73BC52CB7806AE778F985D28B2BB4E6313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660106, "uuid": "3d8a5bb9-0952-40d2-a140-e356817d58d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660106, "uuid": "abd3d0f0-fcee-45e8-a9a2-27ee471c589a", "value": "49152:+n75Cy7jFT3qWWg/q69TQkVsMlOnKMeT9ZfBZnHzY1b:gxLWuHWqOniTHfBxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745660106, "uuid": "b5bcf4c8-380a-4569-bd5d-86492932624d", "value": 2164736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660106, "uuid": "2d12fb74-e420-483d-a486-2a97dd1e0d9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7fb435c-2282-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745660527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660527, "uuid": "1d7194f3-0cd1-4651-95f6-8f239a580108", "comment": "Malware payload (Healer)", "value": "8451da28fdd0d5a3fe4e5b878feae931", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660527, "uuid": "fde9b275-4662-4098-b93b-0623f6907f1e", "comment": "Malware payload (Healer)", "value": "4a8a92510cd5b92e9b1ab3feaddaaa0237e3f4df0e0e5fee544036f26432364e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660527, "uuid": "f8b8b97b-c3f5-435c-ad3e-f26ac92da6ef", "value": "T1EB853361DEEF34C5E5FBA4B8E3F81932F628912706C05277E149A7202E3B552317F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660527, "uuid": "7d03ee59-3ecd-4b69-82a8-9b13787ba1d3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660527, "uuid": "e143191b-fd5d-45da-9282-19a6d0af1f0e", "value": "24576:pVpI6DfvfTGQUC3eMQoP6wHMLlyAMaDwlcIFmpRYHMqFWlaVhzq48zD1qNV97PZX:fpZPhUC3e9xYCDvGpsi2zDkNVLnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745660527, "uuid": "c0dd7721-36cb-432b-a288-24029c2700de", "value": 1777152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660527, "uuid": "2d9b87ed-54c9-40a9-8b68-ad7c57ddc875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16700dde-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745660532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660532, "uuid": "6014b66b-72ee-4176-b8d5-ed35bf39ff11", "comment": "Malware payload", "value": "e7acf29a52dd9c0f04cf2cb5f463bdf5", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660532, "uuid": "ec0b516f-7cf2-40e7-90b9-fe55494e41c4", "comment": "Malware payload", "value": "4952024944397f022d24740ddaa55e415c88ff8c67edf990df9d0583b4809a6c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660532, "uuid": "b34b157c-8b5d-409c-9d9c-50df35055950", "value": "0D23029223A53F72D52148F8D7BCEF8A614A7E54EFE6181FBC113A94B47135C28C981E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660532, "uuid": "aac9a8eb-0f7a-4b18-b386-72339f216709", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEsDm1XZ:yYI0ARqw1qAEW67UIWi7M8gmfmJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745660532, "uuid": "2bca445a-ceb0-43e3-a1ef-2044ddb2618f", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1604920f-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745660646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660646, "uuid": "8f91dc1b-94c0-43d3-9f2f-e9d1815ce426", "comment": "Malware payload", "value": "74759d3867186a9e30f73af7d46745af", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660646, "uuid": "0f0d8ba0-5150-447c-89a1-71f87832ecd2", "comment": "Malware payload", "value": "50c1803e35fe6eafa4d766aebad06c334590e316af56e06a79b35b450dda790e", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660646, "uuid": "afd35d38-9e42-48bf-a730-7b93aaa11afa", "value": "CD92E18726983743F4B195F5F77DBF88B2066EADEB3B542350946123A07311BA208C7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660646, "uuid": "3b215d16-4f65-4779-add1-f84ee9d999af", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBOo3g1qsn:YTYIDfYG6ZmewZ59+Nw1qsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745660646, "uuid": "e974fc4b-3e1f-49f4-92d1-703d7d7d9d1c", "value": 20272, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e7d3ca-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745660706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660706, "uuid": "acc29155-b010-4e03-b7ea-bcecc7343fc4", "comment": "Malware payload", "value": "28e7fc8f2ed7f445e4c1afcf63c0da20", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660706, "uuid": "f4904655-617a-4439-b6ed-035266bd396f", "comment": "Malware payload", "value": "8fb63ac77379ecdcb5e40f0f280bfa9779e0315de8dd4e78b48f34b85e634ccb", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660706, "uuid": "7b95a250-db42-4056-aeb5-6aa2ed7eac69", "value": "0E03024633953F33E56248F4D3FCAF86615ABD54EFDE142BA4013A65B07225D28CD81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660706, "uuid": "2b52406a-23d6-43fe-a3b1-b46cc7087344", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04Y:yYI0ARqw1qAEW67UIWi7M8gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745660706, "uuid": "090a5141-fa8f-4430-a68f-2dd59c2f402f", "value": 39096, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d9d46e-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745660815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660815, "uuid": "abc65fc7-f078-468b-91a4-c4a85100ef2f", "comment": "Malware payload", "value": "195e35ce0fad619aef8c8c638f981467", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660815, "uuid": "3931d6da-80ac-4273-ac5d-e217c8729b3c", "comment": "Malware payload", "value": "d5aadfcde4a266619be66a0b06d156f644e151283856630e6cd849adcb51e032", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660815, "uuid": "d8da6357-cf52-41f1-942f-92ec748b61f8", "value": "A313028336953F73D1218CF4D7FCEFCAA14A7D94AFD9141BA8113A99B07135C28C982A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745660815, "uuid": "ad5ec421-e9e5-4e42-9bb5-4951f541631c", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEK:yYI0ARqw1qAEW67UIWi7M8gmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745660815, "uuid": "ba885cda-7714-47c9-ad6c-47f988874521", "value": 43440, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19258105-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745661154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661154, "uuid": "4321a6ad-7b94-4d8e-aa18-6f899183a60f", "comment": "Malware payload", "value": "f860c4318ab1cfd43fafd24f99c176cb", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661154, "uuid": "b0a653ba-2047-4b03-aa89-02675460a006", "comment": "Malware payload", "value": "d8430372204682e98e75cdf589ab45e2f09960cd0aff5af741341671481b3656", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745661154, "uuid": "65fe12f7-3ca9-4ef1-96ba-50e2a42b7622", "value": "5972E18A2EAC3B07F4B296F2F33C7E58F3052E9D76679817D199712350A301AA114C6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745661154, "uuid": "59c524cd-bfe8-477b-81fc-c12f3dc31e34", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcn:YTYIDfYG6ZmewZ59+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745661154, "uuid": "1e5b4c4b-9271-49ca-b6a0-e4ea0463ad12", "value": 17376, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5b6fe4-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745661303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661303, "uuid": "15f4eb5f-e77b-4f46-a23c-f9b9bb39f1cc", "comment": "Malware payload", "value": "316b10940653b65ccadb5c0dca88b921", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661303, "uuid": "1de16c37-013f-4128-8030-633fa6daf71e", "comment": "Malware payload", "value": "6b09183fdd3eb3af13a88f61d0534bfb15a3fd30c2129ad51f51a7359ea7b1d1", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745661303, "uuid": "78001c2a-99b0-4e7e-9d0f-496fce8e84c8", "value": "1C831229135524E5D62280F1D7FD1F84AE591F698EE2EC15BC12BC99EE333AD2CC2618", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745661303, "uuid": "3de69d38-ec2c-43f6-a2af-cd4086f97838", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1V+uB:yYI0ARqw1qAEv7UIFM8oJorFquyjkRk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745661303, "uuid": "c85ee499-9f26-4b26-ad02-7fa4fa20d815", "value": 82536, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1699c40c-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745662332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662332, "uuid": "e93b5647-a384-483e-80d5-cd9117c59392", "comment": "Malware payload", "value": "21ab19d00f6577ebcb2e719b8a52344c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662332, "uuid": "6e4968dc-03e0-4c2d-9a82-f9ec6626e354", "comment": "Malware payload", "value": "898e00110e699b1381509252bd0614c8ffe8e04c7692678bf3eeaecf131f8af0", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662332, "uuid": "17ffdb7d-a092-4b5d-bc6a-87cb265a96b3", "value": "D953020233AA29B196714AF1E7FDBB88E6493D588FF26C256C113D6CF97239D1CC4908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662332, "uuid": "a7e5b646-272a-4294-9936-4e06ee820be5", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8Px2:yYI0ARqw1qAEv7UIFM8oJorFquyjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745662332, "uuid": "a39962d9-8046-4b9a-a490-79f698296711", "value": 65160, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c6e3f5-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745662349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662349, "uuid": "32f9c23a-954a-45f0-af31-16cbe38d2152", "comment": "Malware payload", "value": "3b973286b5d06e8920aa3578a4941be1", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662349, "uuid": "a2916412-f54f-4011-86c5-f3ce836f5197", "comment": "Malware payload", "value": "d4b125064e284d4586ccbe058f214c34ae4a973a3f276f7db1a1b1da0e9f97b6", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662349, "uuid": "3857e0f3-82ae-4f7e-9345-676df9b7f276", "value": "9A33024523A62EB6C57548F1A3F8FF89B14A3EA49FF55C0A7C207658A43236C28C4C18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662349, "uuid": "706c86e1-f12a-49fe-96e8-67caa278c7c5", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6EO:yYI0ARqw1qAEv7UIFM8oJorFquj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745662349, "uuid": "707dd491-d9cd-4aca-954f-0816189dd16d", "value": 53576, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16aad771-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745662427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662427, "uuid": "64177b76-1973-4fe5-ac72-00851d8edd1f", "comment": "Malware payload", "value": "e739dc29e48462e4bee88c21474e51a7", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662427, "uuid": "682059b6-7bdd-4152-b276-1bc378a05a3c", "comment": "Malware payload", "value": "56ed019e39933567056a99aa4822422af73d09886158c6aca16082388494d2f9", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662427, "uuid": "10becba8-a8d3-444f-8bc1-8fb41c160783", "value": "D9F2024633943B73E16255F4E3BDAFCA601E7D64DFEE202BA4413A2270B311D688D81A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662427, "uuid": "a8368164-e57b-4a7f-b4fb-d94ab96368a2", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8g:yYI0ARqw1qAEW67UIWi7M8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745662427, "uuid": "26436a42-14d0-40e0-b5d6-ba11768a67a2", "value": 34752, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffbf8b7-2288-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745662822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662822, "uuid": "4a19d974-0f36-43b0-920c-150f4b45943f", "comment": "Malware payload", "value": "ec31d5184a4df54deea207d01817558d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662822, "uuid": "ac013021-7adc-4f69-9b24-f44c5e1192ab", "comment": "Malware payload", "value": "40a1fdb6b9a56a5fab78c367a44a099f61bd682400bdde9f05c7a932ea8015d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662822, "uuid": "d784fd47-414b-46e3-8c5d-2ab6e0dbaa84", "value": "T14EA523428C11728ECD7917F203DE5FA06A585F3C788C6BFB02B6135156EDF68E6A40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662822, "uuid": "8cf96ede-4e56-4f97-86c9-390ed846c51d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662822, "uuid": "9d9797c5-b43b-4a66-b9e6-b02669132a1d", "value": "49152:BlnlqkLb8gBZPXtKiKB+KBRu/J+9z3QX9v9L/oNS4nL:rnHX8gzFKi1KHuxPlh4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745662822, "uuid": "b34d1589-75e4-47ce-8c1d-70dd8fa0c254", "value": 2084864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662822, "uuid": "1372dd97-8b44-4aef-a878-8222bea2d8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439553da-2288-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745662909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662909, "uuid": "eb1fc3ad-02e6-4303-a5fb-27b2b2dce196", "comment": "Malware payload", "value": "fc661a259a4d991ad1e895738f8a8a3c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662909, "uuid": "f937fb23-ce05-4888-aa95-a728eb8ab78b", "comment": "Malware payload", "value": "9372a9a5eca445f310d5b76df6581fe1bbb7b90ca7503f3b1fa568a7511de17e", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662909, "uuid": "c326836d-68de-4067-b4db-c57d39a5d5fe", "value": "T102063337E192DD4AE27821FEF89F41145B22E930AB8118C43248E46D712B996FD9FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662909, "uuid": "6fdf648f-51f8-4beb-943e-8415fb627d8a", "value": "98304:xuUHUS1zdDokMjKCycseuoAdahaEa8KXEIBMAOq69:xiSVngKH/eNlOE/AOq69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745662909, "uuid": "0cd2f5d6-ac27-4189-892a-ce178b5f1265", "value": 3919464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745662909, "uuid": "30bfb1f0-b3f5-4e1d-9bc3-d4abc4cd45bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde8331b-2288-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745663168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663168, "uuid": "e9f991d6-7dcf-4e2f-9718-348274b6ad3c", "comment": "Malware payload (CredentialFlusher)", "value": "4889f025d0cdfc85fc25c9ba9ccf1b1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663168, "uuid": "b7975de0-29a7-4100-88f3-f81f2e20da2f", "comment": "Malware payload (CredentialFlusher)", "value": "ce66219653a4375015b44533a77b01fad04170fb032afcde750f749d91aaba5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663168, "uuid": "ad8d586a-37f4-410c-b18a-15187794421f", "value": "T16825AE0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663168, "uuid": "8e519eac-712c-4a3f-a27d-266b737f8974", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663168, "uuid": "da9253fe-ac04-48c5-83eb-4bbdb38af619", "value": "24576:0qDEvCTbMWu7rQYlBQcBiT6rprG8aAjDm/:0TvC/MTQYxsWR7aA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745663168, "uuid": "4a4734f2-bcac-4419-8292-14b2ff62e63c", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663168, "uuid": "55a9ecf9-453a-4803-92dd-d3d1bce3de21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448cd536-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745663356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663356, "uuid": "a7e89b30-9069-408d-8ba9-c419425c2314", "comment": "Malware payload", "value": "a942530b3fc2213ad0de0731fe417f2e", "object_relation": "md5", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663356, "uuid": "13d1d82e-7cd7-4fd2-80bb-2c7b117cdef8", "comment": "Malware payload", "value": "a6ffc5f875944f63ee69dcf49460d2b7392ce9214c3c5f7a3b34a80ed1ac6680", "object_relation": "sha256", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663356, "uuid": "ebc70390-c3c0-4f59-bf19-94fb2896be71", "value": "0B73121613A925A152314AF1E7FE6F88F54D2A6C8FF1AC24BC217C68ED3336D1CD5518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663356, "uuid": "de21cd42-4d21-47f8-a20e-5445acff72c1", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/Jl:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745663356, "uuid": "e89acd62-17fc-4c11-9dd8-b1724d872ea7", "value": 76744, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50dd2979-2289-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745663361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663361, "uuid": "e7cfb694-47a6-4f16-925b-b11e878d25ac", "comment": "Malware payload", "value": "ead92c27f03076798fde52b51e8343aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663361, "uuid": "4bbc7c63-c93c-41b3-abea-6f209821c3b9", "comment": "Malware payload", "value": "e5ef5b61b01998a327316d46a2737058f510bd6a18eae42b54ded046752cd804", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663361, "uuid": "1f81dd32-9850-4140-be9e-aa5a311fbeeb", "value": "T15C9533412C8DE1A5D90B827B46C7F51EF873A659F2C08A6B98C84597CD89F3A5207C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663361, "uuid": "ee26fccc-b806-40d6-9228-4697c2784607", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663361, "uuid": "6c249499-8e6d-42ec-97bb-d66a78f7807d", "value": "24576:25nzVSgtb/RPkPvVAyJdxbCijMyfUkbQZxzpjY7RdCWR6w01DfaWdV9KSHEAqSMn:2h8oMD7CGAvZdpE6lJi5A1X180pXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745663361, "uuid": "5caa5127-2eb6-4091-945c-92a6dec7f83f", "value": 1885184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663361, "uuid": "8751f2da-ba28-4ade-b4b9-562e1584f519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168b15e8-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745663377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663377, "uuid": "328950e5-ca25-4d11-af21-1409db02e00d", "comment": "Malware payload", "value": "c73634570e4a70d7040fabcad0ea2773", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663377, "uuid": "9c58b988-4aca-4c80-9969-73278a91a077", "comment": "Malware payload", "value": "a7576c44f6f25dc87fcc803b0e463e385c13a048169536a7c7a5de804b0891ef", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663377, "uuid": "71824e35-4eb7-4b34-9a81-27b99edbe3de", "value": "FA43124623662AB6857149F0A3FCFF8EE24A3E58CFF55C197C107A28A93136D2CC481C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663377, "uuid": "5e5f3f11-8721-4af4-9560-d7a582b9d050", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyqe:yYI0ARqw1qAEv7UIFM8oJorFquyje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745663377, "uuid": "6c10b055-ef1c-4a25-ba2a-caecf4d3f1d4", "value": 57920, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea19a9b0-2289-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745663618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663618, "uuid": "737fa95b-5778-4a1d-85c6-c65d94ed7144", "comment": "Malware payload (Amadey)", "value": "d2fe84afe08f22a18d65e53ebae11fd8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663618, "uuid": "ce4d2f3a-206d-4bb3-baf9-c5023ce79ca1", "comment": "Malware payload (Amadey)", "value": "9e63efdc734efe295d28b8222e8fda76a8655e6c817476eced7e2daf3c04e89b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663618, "uuid": "e872aa5b-4bda-454d-8a4c-4c6ae5a3ad0f", "value": "T1DBA52313DAEEC021D85503321AB615C30775FD61477806BB6A5F6A7A2D30AE4F9323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663618, "uuid": "67a344d8-80d6-47eb-901c-71b832f7fece", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663618, "uuid": "ee2e4443-399f-45d7-a374-867a53133280", "value": "49152:DW75CYV2gWv65H94Hi+WssO4iKuhVujidi5A3wR:GVTWi996i+WsR4huAy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745663618, "uuid": "f697f8e4-82cd-4b2a-aeb9-a192bf53f7cb", "value": 2191872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745663618, "uuid": "bc4056ee-b22e-41ae-93c0-56949d057423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16289159-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745664028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664028, "uuid": "d0af2b9e-01de-475e-af9a-c1d0cb7155b9", "comment": "Malware payload", "value": "aa5fde36cb0e26ac7973b0d983884490", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664028, "uuid": "af7a64f7-4d3b-413f-9949-11199fee3c32", "comment": "Malware payload", "value": "69ac6c1019c3f7133eb97a21b174ba9e40dea7c36a52170a5a8353d28bdffab0", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664028, "uuid": "ab747be0-539b-4d3d-ba3d-ded2be42253e", "value": "E703028632953F73D51148F4E7FCAFCA714ABD54EFAA142FA8113A15B07235D24C982A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664028, "uuid": "6922f409-d28a-45ee-bfcf-aba4682b20f3", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTo:yYI0ARqw1qAEW67UIWi7M8gmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745664028, "uuid": "b0572d9f-7602-495e-bc46-48cb4cddeb36", "value": 40544, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176e0184-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745664164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664164, "uuid": "1cc499f0-383f-4e43-a183-04e3d41b7186", "comment": "Malware payload", "value": "356bf51b47509625d44a85cb30400349", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664164, "uuid": "33659055-fa7c-436e-a5da-027c1cef6aae", "comment": "Malware payload", "value": "83f1cc08c430107e70a2976aef153eb5e8f25fecc561f4a55d226158c080ace9", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664164, "uuid": "b7d84414-f187-4b7e-8cdd-05357bb0bc76", "value": "CA33024623A63AB6957188F1A7F8FF49F14A3DA89FF51C157C217A58A83236C28C4D1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664164, "uuid": "0fa40867-522d-446c-8d70-7dc32e65cfdf", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6EfA:yYI0ARqw1qAEv7UIFM8oJorFquyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745664164, "uuid": "77f07aaf-eff2-4d04-a61f-5b657e234fe3", "value": 55024, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679d8840-228b-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745664258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664258, "uuid": "01b2bcfe-e4ac-45b8-a080-1a7c6fa85f1e", "comment": "Malware payload (Healer)", "value": "61a926033f6105d733b51a0b438d6e17", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664258, "uuid": "6892344d-7550-4612-ac63-34fde87aa1f9", "comment": "Malware payload (Healer)", "value": "667b8ebfb4c404e17b65904e4dc2598cc69e5f34940d5b7aa3087249d66df2c6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664258, "uuid": "4f914f2e-2743-4e6f-b07a-e3e27973732b", "value": "T1AE8533FDDEA1BA65C6DC4DF4397386F71AF0D839859F30AE670823B0D8A1050CAA45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664258, "uuid": "c9b9e544-6e07-4339-8b2a-a9c5b4389bd3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664258, "uuid": "6874ee9b-dadb-4ede-ba5d-f01b0ebc7c34", "value": "24576:UZDfl8fSxMTCVB0V+RDr+ibu0C3BMVFnTkDMbeQCLcyqPUaROxXsp+CEXUQLAE2w:a7KlQma/00FT+MyXqPXOpspFLQ8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745664258, "uuid": "a00ba59c-e1f5-4154-acd1-3c718fe91f03", "value": 1722368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664258, "uuid": "312673d0-e081-4e8c-9a71-54799312a6ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16287d1a-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745664455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664455, "uuid": "755d1226-3990-40e6-9e51-900a6d56738f", "comment": "Malware payload", "value": "ee9986b9d1c62cda420b671c6def4efe", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664455, "uuid": "24e37b3f-b705-4996-ad08-84cfd0b687c3", "comment": "Malware payload", "value": "20c9c9e9153564ee44ab7fa7bdb571956245c08859844048df1e8b8771505eeb", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664455, "uuid": "3562ff2c-5e56-48c7-8f49-01619b603e36", "value": "E123018623663FB3D13158F5E7FCEF85A14A7D94AFE6180A7C227698A07135C28C8D1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664455, "uuid": "d079ce73-d436-48c9-a919-a72e9c2e3d5e", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgsK:yYI0ARqw1qAEv7UIFM8oJorFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745664455, "uuid": "3a09e13e-14cf-4b4d-b584-674899e7e7e1", "value": 49232, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1574fd8f-228c-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745664549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664549, "uuid": "bd37811c-5f9c-46be-9e0a-1df91daaf678", "comment": "Malware payload", "value": "dba3ede6720738e0565bbee8cc69a508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664549, "uuid": "9536160e-f9c6-4a7a-9f3c-9ba51304139c", "comment": "Malware payload", "value": "74e8be378650246e889ba43ad3907720077b11acd268b2cf4d39eeaf5834dbc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664549, "uuid": "dfc5bba2-c59c-4f24-a66d-734b52f7d723", "value": "T112A53367F91116B5CF710C3B963B27A56F84F3A10CA289F9DC81712B062B6171DB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664549, "uuid": "fcd4d15e-4bee-4e8d-bf4f-6f8d0695502f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664549, "uuid": "ce72bf96-652a-4ce7-b1c5-d4325d422078", "value": "49152:kKgzE/Tw997dIG3UC4uFB1ZAZX5SxcUZgU+Xr:HgzSTsP1IslAZ0ktr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745664549, "uuid": "91554c81-a0ec-4849-91ed-f910b97baf39", "value": 2069504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664549, "uuid": "1d4fc7f6-2771-40fa-a6d5-d687712cee76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5242aa-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745664669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664669, "uuid": "3a5076e4-6efb-4963-a12d-b63481392420", "comment": "Malware payload", "value": "70e3f6b8302027cfd1a757e02252400a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664669, "uuid": "ef29016d-8318-4f60-8475-41d88ba4b865", "comment": "Malware payload", "value": "edd1e9268ff4961c7d0d2364d7215925d38852fa8646636d8edb3e97900e53ac", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664669, "uuid": "fa7a9807-b8f0-407c-8dc9-f11656a5e1af", "value": "4C731229139924A5D63141F1E3FE1B88BE591FA9CEE1EC14BC117C98ED333AD2CD6518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664669, "uuid": "101adf06-4988-42f3-a421-8bbde5505f8a", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J1d:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745664669, "uuid": "62c45975-c054-4726-9710-9cffd7ced15f", "value": 79640, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89a3634-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745664737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664737, "uuid": "02e80e55-43f1-4fa9-b4fb-458b4807cf22", "comment": "Malware payload", "value": "70af65a13a14e5deb73c31c8829dd998", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664737, "uuid": "0a395296-32e4-4dc9-ac54-5414150c0cac", "comment": "Malware payload", "value": "feacba94918d32a51ff751ae4b98e9ec5823aedd525ad283ed99653b3f23545a", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664737, "uuid": "03219973-76b9-46d8-8830-be00c39a506f", "value": "5923028623A63F72D52148F5D7FCEF85A14A7E94AFE5180E7C113698B07035C28C8C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664737, "uuid": "50f694dc-b62f-454c-aee8-4144f04358ea", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEsDm1Xo0Wh:yYI0ARqw1qAEW67UIWi7M8gmfmJo0Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745664737, "uuid": "b5c90232-37a5-4348-92a3-e70160708e3f", "value": 47784, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184f6ada-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745664753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664753, "uuid": "e08ef53e-8333-45e1-9ec1-07e6e460d136", "comment": "Malware payload", "value": "123dfe79846e600a8336cd14fe647d5c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664753, "uuid": "1998c6ec-b8d5-4772-9365-3e00fde87143", "comment": "Malware payload", "value": "e967cff2e9a75e8f80fb4938ede971f9accee357cf9a761e9b34cdf5e9285e81", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664753, "uuid": "0564a8db-7377-4dc8-b8b7-9246b0a7c22b", "value": "9A73121613AD296152714AF1E7FE7F88E50D2A688FF1AC247C227C68ED333AE1CD4519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745664753, "uuid": "86ce0f0a-f204-4761-800f-0114170658cd", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2K3/J5:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745664753, "uuid": "37648f24-0132-41ca-b418-b46d357e5e86", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1934a4c0-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745665047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665047, "uuid": "3a1e634c-9b9d-44fc-861c-3daef0bb1cd7", "comment": "Malware payload", "value": "1ff5a92a793b1503e1399bf2434ac5c8", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665047, "uuid": "e71a6849-98fb-4dbe-892c-9aaa9833bf9e", "comment": "Malware payload", "value": "22eb75dfc037517fc0f62570c77379a708a8769fe654bb7c58177ecb17f3c2ee", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745665047, "uuid": "498c04bf-9460-48cc-8a77-88e151f81a89", "value": "2213028237A53F72D52188F4D7BCEFCA614A7D94AFA9181BAC123698747135C28C981F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745665047, "uuid": "a01edea0-7013-4c1d-9a53-829ce25e71ea", "value": "768:YTYIDfYG6ZmewZ59+Nw1qsREH20j7UNqVwi7M8ghFM04ZTzEsD9:yYI0ARqw1qAEW67UIWi7M8gmf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745665047, "uuid": "17d32a2b-f4a1-4ca1-8c9d-87606e155b1d", "value": 44888, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e96816-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745665144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665144, "uuid": "bc6b03d1-ec69-46de-a038-84718f4d90e3", "comment": "Malware payload", "value": "99554a8313b0f99ebdaed9126d32bcff", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665144, "uuid": "e235e803-2ec6-4135-99a0-9fc9ddd4c47f", "comment": "Malware payload", "value": "2791990fec00623e0c62081b8145b3aa2d9b00e145a8880ff66fc4a025cc8e4f", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745665144, "uuid": "fe88e4be-b9d0-4aea-a173-4e0fa2bd24d3", "value": "E953120223AA297196B14AF1E7FDBB88E6493D588FF66C15AC113D6CF97235D1CC8908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745665144, "uuid": "d0ecf32f-dba5-4693-b274-73c330ec45ad", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8Px6:yYI0ARqw1qAEv7UIFM8oJorFquyj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745665144, "uuid": "35471d1e-b0ea-4331-a235-9c71cd9a2779", "value": 63712, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930215b2-228d-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745665190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665190, "uuid": "0c96cd3a-64f8-46e1-964b-c5fb9752ecdd", "comment": "Malware payload", "value": "9119efbe96ba869ed31c985a9dd8a2a0", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665190, "uuid": "e1645827-a5e2-4d96-991a-7dc43fb31294", "comment": "Malware payload", "value": "9063fdb02997cd95a51f6a3be6a5465e9e784d071fb6238fe7fdb6d880264c74", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745665190, "uuid": "adaf1564-70b2-43b0-9e8b-faf370b8c5c4", "value": "T13534E07606107DDDA4800D836D92081F6BD2D6446A3B2FA50C1EEDF86379B57478AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745665190, "uuid": "442ddd5b-84f7-47cb-8e93-9c6e24e307ca", "value": "6144:dhDPFJo5zgVjSaB/5+c+HZ6cPk4DWWNLWBEJttzwaR1/Uh:dhT1kkh+q4ZLWBytcs1Mh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745665190, "uuid": "a179f97f-29bf-4cac-b325-36197107dc94", "value": 247883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745665190, "uuid": "e75eb8a1-e217-4b40-869d-5a2831fd6cb9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f62fe72-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745665905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665905, "uuid": "f3edb1de-73f5-492a-8d53-ebf0ac2455ce", "comment": "Malware payload", "value": "94ffd7f31a2fe12c922d481b1dafbdd0", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665905, "uuid": "f53fd437-8de4-444e-af24-b4fb009c571a", "comment": "Malware payload", "value": "9a0bd9cabd958815d3e48a9cc41fa37834f9a886d8ec90a6e0fd61e8d709b187", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745665905, "uuid": "e7cc8f44-b670-47dc-aefd-1348c64e764d", "value": "BA63124623A92971567245F1E7FEAB8CE10D3A5C8FF16C247C227CACB93236E5CC8519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745665905, "uuid": "a8851de3-8414-4129-80d4-fbcddabb8ae9", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxlRkp2L:yYI0ARqw1qAEv7UIFM8oJorFquyjkRkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745665905, "uuid": "702de84e-da1b-4307-a114-ad37873a8c39", "value": 72400, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f30c48-2290-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745666246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745666246, "uuid": "8d73df67-ce74-401f-a16a-c7f2746eff80", "comment": "Malware payload", "value": "15c827710befb9c856b203581fb8c1c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745666246, "uuid": "2934ffb4-81b8-41df-a8a2-0640df90f07d", "comment": "Malware payload", "value": "9be05b0bd782b7dabae8605435f2d13f3a2f7392f6caff6ab05f3f69b85ea0b2", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745666246, "uuid": "86b1e52f-69dc-4801-9696-a48d5a59d94d", "value": "T11306332B51D2DD4AE37521FEA89B41145B22EB309B8508C43648E86D701F987FDAFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745666246, "uuid": "862a6c9b-f283-480a-8514-fa4b6724f80e", "value": "98304:3uUHUS1zdDokMjKEycseuoAdah1uaqKXEIBMAOq60:3iSVngK5/eNSkE/AOq60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745666246, "uuid": "b4269b36-b279-4e65-9ee8-22989508b95f", "value": 3919702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745666246, "uuid": "91116cec-555c-4995-90ff-3ad20c38cadb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9f6137-2294-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745668083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668083, "uuid": "8652a25b-d3ce-4fc7-a591-3c695f915099", "comment": "Malware payload (CredentialFlusher)", "value": "d2e5b80c13b2bee13d80108b2b475199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668083, "uuid": "697b9acd-0d89-4f02-b136-7f079446a988", "comment": "Malware payload (CredentialFlusher)", "value": "75251de86c1b8870e975106bfadc3e12c2e93e30c6fbd5fed5674b308597b7f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668083, "uuid": "81bbd727-c53e-4416-b037-1845997e803d", "value": "T14D259E0273D1D062FFAB92334B5AF6115BBC69260123E62F13981D79BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668083, "uuid": "b4f251e6-779f-491a-84a5-9bae984c1ff7", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668083, "uuid": "df3f5579-73ad-42ea-b1a6-915eb98ccb8c", "value": "24576:TqDEvCTbMWu7rQYlBQcBiT6rprG8aKsZ:TTvC/MTQYxsWR7aKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745668083, "uuid": "6973181c-c7d6-44e6-92ae-8e8466dadc96", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668083, "uuid": "5b5b32d2-7c38-42c1-b4f7-c6958784bbb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef7c789-2294-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745668136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668136, "uuid": "d2bf3cf6-d499-4470-8f1e-4b28c0ab9bbe", "comment": "Malware payload (Amadey)", "value": "3a86e92864b837b01c8279a14d786d77", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668136, "uuid": "3f7818cf-3fc3-43ec-b5b8-f1fe52481492", "comment": "Malware payload (Amadey)", "value": "94bf5885a0643430a3499658015909e3a9579f80a0626f4a8892ba7212ad81cc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668136, "uuid": "04eb726b-1b8a-4389-ab42-2b780ef2f04e", "value": "T1B9159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668136, "uuid": "3dc8b058-84a4-48c9-ba15-8713ed556069", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668136, "uuid": "d02ab35f-3166-4d28-8a31-97b0d9b17a81", "value": "24576:8qDEvCTbMWu7rQYlBQcBiT6rprG8ae2V:8TvC/MTQYxsWR7ae2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745668136, "uuid": "28da4353-404a-49cf-9d2b-1b15b1db07bc", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668136, "uuid": "b2f84d0a-a5a5-4b29-a9fc-e1d830f0463c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1628f3a7-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745668879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668879, "uuid": "4f5033f0-cf06-45dd-b20f-707a62f35dfa", "comment": "Malware payload", "value": "7ec75296751fbfd93554e7d5c5d4966f", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668879, "uuid": "578601b4-f129-4848-be1b-134d948645a5", "comment": "Malware payload", "value": "6e28b336496325c9659df5011066e1d1e57ffe035fe02db96c61b91a0b4fd77b", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668879, "uuid": "03383600-f58d-40fa-a6f5-aec5884b3be8", "value": "F943024623662AB6817149F1A3FCFF8AE14A3E69CFF65C197C107A28A93135D1CC491C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668879, "uuid": "4d2c0cd8-f191-4012-a8e0-f7c7358d5b5a", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq0:yYI0ARqw1qAEv7UIFM8oJorFquyj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745668879, "uuid": "f9fa3b83-f3ce-4397-8785-c3cfb519cd76", "value": 57600, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f41eaa-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745668959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668959, "uuid": "44410b71-75ad-4894-a30f-601b385ccb39", "comment": "Malware payload", "value": "b7c1fb454c8c20aa7fe7aeb6180d412f", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668959, "uuid": "8f2d383a-0377-4100-b4bf-8815c7adbcde", "comment": "Malware payload", "value": "810a146b624a47b1e9e977f147bb304f268dd35c104027a7e4f98288a11432b1", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668959, "uuid": "163b9c0d-1f8b-4d33-84f7-e80bebb2e36f", "value": "B9B2E18622993703A4635AF4F27D7F8A72067D68AFBE943B45503123707321E6758C7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745668959, "uuid": "c5a11d4c-7475-4599-804e-494b1cc64cce", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBOo3g1qs9LrEQSXh:YTYIDfYG6ZmewZ59+Nw1qsREHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745668959, "uuid": "c061cd2d-1f51-42ae-bda8-714acff22549", "value": 24616, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858aed79-2296-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745669032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669032, "uuid": "916b2d22-2d70-42cf-8235-3548d2689554", "comment": "Malware payload (Mirai)", "value": "5480e4b5d82c2299e14606249ae864d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669032, "uuid": "a5498210-5764-4cd0-b04b-1c4037f6aa3e", "comment": "Malware payload (Mirai)", "value": "82d5cd9219adbb264e608db1336a0053e2ea41e1edc7ac4d6e6569e9c74efbce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669032, "uuid": "e043a5c2-48a2-4917-a87d-816fc0ed182e", "value": "T1EEB2CF6C824521A4EDCAD27C4BEE17D02D6607A6FA03EC177A85E8D7CD161EC3D43A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669032, "uuid": "5a1e53ec-d54c-40cd-b60b-05852d298016", "value": "384:5X4op+sdLaW4+xYwp50DOTb/Au9+Qyc87JgGlzDpH7uNj1JfSV:5Xzz09OTb4I+QL87JgGlzDpbuR1JqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669032, "uuid": "2f058a1d-afdc-4899-9506-1d4b7b4a90f8", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669032, "uuid": "debe9b41-f7b3-4dce-9f3b-501ac1a9d34d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92aa1e3f-2296-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745669054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669054, "uuid": "f7a5bf9b-3ac1-4d36-8e55-61ccd797a799", "comment": "Malware payload", "value": "d0a7b05782bf5496aa5316c11d4c52df", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669054, "uuid": "b94dbfd9-2dbf-44a5-9614-64bf58254aae", "comment": "Malware payload", "value": "4bb7536a1e152a08b520fa4a47e3150c31caf6cbf0449d2cc86fc0e4ff88eecb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669054, "uuid": "50eae6ae-bc17-4474-a7d9-626ebbd890e0", "value": "T127973317F147EA3EF129D63E1BA25424A8FB62B76C13AE2796FC7059CF600506C392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669054, "uuid": "6d7d32d7-a9ff-4b39-8845-58d26a52a099", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669054, "uuid": "6efae551-ba35-49f1-a0e5-79c266442950", "value": "786432:DkvoRERC2QD38QLW4TIktX5RD3jXEu9rXrv9CjtIkJPSZjTfhjhpE+cqvIrlOTBL:Av6WDQq4EkRHzQar7vYjjSZjTpE+cqwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669054, "uuid": "a3c49159-8fb7-49bc-ad5a-db995f22fc6a", "value": 43075294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669054, "uuid": "436c7f16-739b-4da7-bc5a-d5aa4406dd17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b172e08f-2296-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745669106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669106, "uuid": "decdd8c9-149b-4f1c-b540-3f52943a867b", "comment": "Malware payload (Mirai)", "value": "82c8b86ad9d1d9df0ece6f4ec149cbeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669106, "uuid": "cc1b0ebb-8dc3-47ee-ba3a-70a4dbeb464e", "comment": "Malware payload (Mirai)", "value": "044d68f19e7e689592142d7e47fc0952eda9846810f43077419283118de31038", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669106, "uuid": "8e4fa268-bf87-4b82-8fb9-ce25f5fe240b", "value": "T15BB38CDBF2870260C8624AF007CB4BED3E2723815F27C5E76D2A657969791CF8905F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669106, "uuid": "3660bc8a-3c11-48fc-bde7-d7a823798730", "value": "768:ta8bqa51RONDFqgIZnTOwqmjKSpf88NpjckZUpGBVSdYW5bEpvxcxmWQqNgiwyps:0RaGBoZuSpF2cBUaWJqhWfNgbr/LW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669106, "uuid": "288d825d-03ce-4bd1-aa8f-51c1baf99405", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669106, "uuid": "075617b8-40fe-48cd-8d27-41bb81d2aa72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9aa1773-2296-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745669120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669120, "uuid": "69506710-8af8-491f-9f7a-ea1fb7055ab0", "comment": "Malware payload (Mirai)", "value": "6e2e96072826a34ada8d56580490c91f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669120, "uuid": "f495902f-6337-484d-a9e9-bbc904abcd0b", "comment": "Malware payload (Mirai)", "value": "b3dd88070d1e57d3f46667e71074028334c54e832195b2da65b92bdc30c2068c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669120, "uuid": "e68bf705-0fcf-4ea2-bb56-fe004c4b9414", "value": "T1C2A2D070534E2D61DBB18DF1AD588A841538069D93FD22B63C445E3C58CAB4BAEF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669120, "uuid": "c3334f55-2ebb-4450-8804-b1a1e87ebcc1", "value": "384:OzVx6giexGFmth40/zPV8WLKygdDQUaNCQWhymdGUop5hoh:OB9DEF27pKTjaNCxs3UozGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669120, "uuid": "bff12868-81c5-46df-b654-0b45ce2073bb", "value": 22304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669120, "uuid": "6ec695d2-1718-4ff7-84a1-fe5d52b1f6fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da63b020-2296-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745669175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669175, "uuid": "f59dab82-6675-4c35-a8c4-1ea53d83e466", "comment": "Malware payload (Mirai)", "value": "7001be2ae1c0de85358bb3d333df6ec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669175, "uuid": "323b05f3-5fb0-4584-af15-d13b99c3ad15", "comment": "Malware payload (Mirai)", "value": "7a99a1782a12c4d4d5330e231a557e09441a0a4fceb16bbd64dc55acd99b2838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669175, "uuid": "b0b9ebb4-4405-4479-a456-f3cf4bc2f305", "value": "T1E5C2D0145A1AF951C430C839B58047C31E503B7AC7BE642E92E105E99EE7E876DF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669175, "uuid": "aa87c258-b369-46c2-9624-c59173a042c4", "value": "768:/hZa4CZgdDoWEUOgvM/L1txYyh9q3UELha:ra4ogRcntzULE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669175, "uuid": "ce897e62-e5fc-4980-828e-53426bf38b6a", "value": 27376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669175, "uuid": "4cc98dbb-532b-44fe-9cd1-b6c150c7ea0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f586970c-2296-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745669220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669220, "uuid": "4bc594bb-6eb1-42ed-bdda-759a4b3e0ede", "comment": "Malware payload", "value": "5b995d6b14542d418f64bd5bc33355b9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669220, "uuid": "e8e92a10-2afc-41aa-95d0-e7946649250c", "comment": "Malware payload", "value": "8b5ee8c978e0dd01977ca27eef34f77ecf0599e3342e2e61286dc8256ea85b2d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669220, "uuid": "7b748a1c-4744-4247-aeee-0e58978b652b", "value": "T1169533756F0548BDCB4BD4369CD7CFEA3F2472C2248F2BE096162F19778AA8110B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669220, "uuid": "8a45c6f5-8435-48a5-83d8-2c1df79c4147", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669220, "uuid": "720dc4a8-da8e-46f3-8b46-80d95fcb5bed", "value": "49152:VhLT38WyLgOUIDSCCOOmk87xLs2KlWG1s+2l/lk:VhMaOUIDvJk8lLsRlWSAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669220, "uuid": "445dc20c-0376-4b50-af7f-3b494c02741f", "value": 1888256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669220, "uuid": "c079d398-717e-4a3d-a85a-69ebd1b1fe90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d3950a-7fdc-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745669409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669409, "uuid": "81a5a26c-e1f0-45d7-89b5-ee33b3caa3ce", "comment": "Malware payload", "value": "4e9b89a618e755926424054b4d1a6953", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669409, "uuid": "093c9525-718b-4324-bcbf-05c72cb0682f", "comment": "Malware payload", "value": "eaa08f7cedc2ed4a97fdff1e549b54726ae32832f1bcf0294b767f983213a157", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669409, "uuid": "5ced34ae-7057-42b9-894b-33accb83d7a0", "value": "9433018623A62EB2D1319DF5A7FCFF89A04A7D949FE91C0A7C213659B47235C28C4C1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669409, "uuid": "f2ee733f-79f3-4acf-8651-e7187ff1a055", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgsX:yYI0ARqw1qAEv7UIFM8oJorFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669409, "uuid": "be926be8-ce19-48dc-9a1b-bd6a303c77f0", "value": 50680, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7571c453-2297-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745669435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669435, "uuid": "ec3f6d24-8cdc-4b1c-ae72-0ef11c930576", "comment": "Malware payload (Mirai)", "value": "0006ae8d9955fa15e63a8feb3881d013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669435, "uuid": "5a9c2f0e-0d4d-450d-a257-6e872a51593c", "comment": "Malware payload (Mirai)", "value": "f6c51754a923f8930755acd3e215e8f74a24a2373f799f00bb5a56cad9137304", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669435, "uuid": "62642ace-eb76-48e9-ba71-98d4eac5308c", "value": "T17CA2D06BE2495EABFBAF9E396D9141E8FF601F450BFACFB120014E08255543FD845C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669435, "uuid": "2180944c-6f73-47ec-aa2b-5d7caf6f0853", "value": "384:YIvmn4BTGOz7jKdV/FU7EcEILjOKYkcW02jDvA4B4xZRnzwM4uVcqgw05VxJP:xi4VbLMdAEcEIvWW1jk4Spz4uVcqgw0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669435, "uuid": "95259cac-d0f8-4294-918c-10c58409feb2", "value": 22004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669435, "uuid": "0c860ae5-0f0c-47f4-a2ec-f84b8fad6c41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c6f809-2297-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745669571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669571, "uuid": "de0f0501-d3f4-4496-95cf-cdb225b87e43", "comment": "Malware payload (Mirai)", "value": "28a5189e0ef0f4d2145eac0f37104e40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669571, "uuid": "bd80926a-504c-49b0-9f41-fad5f0faba3c", "comment": "Malware payload (Mirai)", "value": "7c1952bdcba657e599c7722c03380866ab0a95a0e016b38ba8d2b4564ffb843f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669571, "uuid": "6f0f7cf4-03d7-44db-ad3d-5c0ab09c48bf", "value": "T18FB2D0DCF0B9309AD99D2C79917E17751C222690332F8FCD6B618C88A758C4F799C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669571, "uuid": "40675ec5-1b1a-430a-9547-e59fd0fccabf", "value": "768:cO8kA3TRJC8J8q+wNA4mou+62AYSHUUaWu:cOzAj9OqlNks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669571, "uuid": "c67e25b0-8459-4daa-99ef-08c396fbae9e", "value": 25064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669571, "uuid": "f45231e0-5084-4b35-9fcd-3cc0297426de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46655b86-2296-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745669591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669591, "uuid": "33930641-c7a9-4b2a-8720-9035c28c8e1c", "comment": "Malware payload (Healer)", "value": "a4505a40ab0a37738cc19f8ce64a665e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669591, "uuid": "09e80c4d-61af-407b-ace3-cdf11877bb9b", "comment": "Malware payload (Healer)", "value": "243ebd6a01cab1d3ad9b8449e4692a6af7df8049bb62d3eb6658fd1e93952270", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669591, "uuid": "c667558b-6ce9-4890-b841-7c2b2d889a3f", "value": "T12185339393FA94D9DD9936F457FFC382C6EA3428C092C1AD1F050208ACAB85D7B56F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669591, "uuid": "f600c2c2-2edd-456a-9587-41db7266196d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669591, "uuid": "04ee8c19-e5b5-42a3-8a81-20ef71faac27", "value": "24576:SjdApblMFTegI2EMY2eIrR/2MpzL+j1PjbnCBBjYVa8EE4ShS:5MqgI2EMDkX1PjbnCBQoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669591, "uuid": "ab7b728c-8708-4b9a-8a89-78866ccffca4", "value": 1714688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669591, "uuid": "545a99ba-0092-4349-9a77-3dad2074bce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded2782e-2297-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745669612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669612, "uuid": "14b0f656-668a-464a-a08c-bac0e9b7fe7a", "comment": "Malware payload (Mirai)", "value": "b13a59ddc7331224b4b1e16c5cafec20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669612, "uuid": "f66dad60-d776-456f-94a3-9053bce4ce3c", "comment": "Malware payload (Mirai)", "value": "1c7e86796d9d4261be8bd70196809313b14f2ec380e1d24e75e1e20047d60cbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669612, "uuid": "0f25a17d-68e6-4203-855c-1ee57a45b424", "value": "T1A623F172D513C2B0E27295FE193929CC224D3FF687EF38058A485DDC576006DA8E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669612, "uuid": "2a2496e8-4db4-4a2e-96bc-e2ccac6fad4c", "value": "768:zJGj9Y+dzFQF154zSNkb5J9q3UELb0ArdDjp7xiUHPC29q98AS0IK:zJGp215RNQ58LvjHoHS0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669612, "uuid": "c4ada786-3ab1-4241-bb11-3e6ae3870399", "value": 46736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669612, "uuid": "0cd75dc2-b7db-469e-9c22-8f86374a6ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039b894a-2298-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745669673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669673, "uuid": "98a4abc7-4395-4a4c-ae4d-dc11c530222b", "comment": "Malware payload", "value": "8eeb8e13897e643322e1c814780fd7ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669673, "uuid": "93e7b801-2307-4b42-bc15-1bd35f6f2793", "comment": "Malware payload", "value": "17122252d50df5197f72030887ae467fa47bb0be78e764fe823ef3aafda5e581", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669673, "uuid": "131b2a73-6eba-4d22-b313-2330d5a92b38", "value": "T1C5A51250FB31B660CBF0EF3EADD2C2A46E116DF6212C51FA0654541A95222F0BBF7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669673, "uuid": "594915b7-de9c-4731-b353-625024828ba7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669673, "uuid": "5a5f2c46-e916-4db2-b5b5-bec69f9ae564", "value": "49152:gIUHB9CG1rzLyf1k802sEUUd+QRSnPGwrsFdzErjKERmbpX3:8CyGYa0QMnpwdzNAmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669673, "uuid": "7aa5ea79-1060-44f4-b3ff-959e321bb61f", "value": 2066944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669673, "uuid": "91f1ac2b-a9db-4f83-a40a-158382145276", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ee5ace-2298-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745669835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669835, "uuid": "03476c12-9d35-4f90-8713-21c0259da236", "comment": "Malware payload (Mirai)", "value": "daf2bd3022bd78dc3d67ca3c831e7467", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669835, "uuid": "e08c0d14-a45c-4a55-b61f-7b95d33ec993", "comment": "Malware payload (Mirai)", "value": "ff8e098ef955dd3f04ec1c669e92a4dec6fd6275346e9539c29583f704820776", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669835, "uuid": "01d961cf-38a4-4947-b762-9c987057faa0", "value": "T1C5433A21B9391F27D0D1A4BD11FB8B59B2B15ADE22A4C64E7D720E8FFF116406843D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669835, "uuid": "949da20b-e73d-474f-9082-25894601ab60", "value": "768:C/oNjA33AA2LqsgNYX2ASvkOhcfDudFUpg7DgHXusb5X/O+UOfwj:C/EjA3332LqzNi2ASvkOhcfDudFP4zMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745669835, "uuid": "76a61bf9-c1fc-4462-a2f0-46c7a039aa5b", "value": 57016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745669835, "uuid": "b7a21a46-a4a2-4d5b-ab70-21d9f06a75e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "755f3cd0-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745670294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670294, "uuid": "50a6f55a-5297-4aba-9266-f0552b6d13d0", "comment": "Malware payload (Mirai)", "value": "34d46ece337202dcdb2d0e93afac1aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670294, "uuid": "26f6dff3-801f-473b-a48a-54eb2d4c2c7c", "comment": "Malware payload (Mirai)", "value": "16028879d2e97ac7abf4d4b710a7dc7cdf10bbb8846a59258fac29a85d02fbf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670294, "uuid": "26b33e73-44d6-4611-b7f1-92e01746f359", "value": "T1ED331A9AB8029D3CF90FE6BE54164E09BA2177C152830B2767BBFD937C721945E02E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670294, "uuid": "c9eec930-12c4-4f7f-9c59-0ffe4c6fb2f6", "value": "768:qCnPvh1i6I2Cn9Sc/qnLNJFT78E6MkuQzAQIXOF0OV+TGkX:h2nZ/QhJl78E6MgAQIXI0OlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670294, "uuid": "d93cff66-c53d-4078-83ec-c740cee01c49", "value": 54876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670294, "uuid": "797040ee-9589-4d63-a712-741e5a0713ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8477d5-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745670388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670388, "uuid": "336e2f5f-3380-415f-b8b0-be1f70dead46", "comment": "Malware payload (Mirai)", "value": "cf787ac828cd6c6a3123c6c608a8e7ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670388, "uuid": "5ac3f22e-71e1-436e-bfbe-f9189ca3896e", "comment": "Malware payload (Mirai)", "value": "0860375b3f9c91b26f2cdf49d21af69e1d50e2d9f9c6b29709417b97de5a6c16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670388, "uuid": "2aa08b16-646f-41b2-9efa-6c8dd38e16e2", "value": "T1EEA2D078B11705EEDE7E43BB212CA7482788D551479F994FB25CC3CA48C36294A3AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670388, "uuid": "e0b36fd0-3dcf-47ea-8d62-e1e459f73bfc", "value": "384:MADiW19aU7gR6gRIyFupqu7YbmvuEMhEjJgYt5XlI5oXRQoE6F2uZNx6u2+v1R/:jTvsRnCqu7oUupEjKYrXlIQRQotFZZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670388, "uuid": "d0da7d6b-aab1-4500-815c-469befefceff", "value": 21756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670388, "uuid": "26e30890-66f5-4421-b205-312532de4d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31a5e5b-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745670424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670424, "uuid": "fbaafb9a-6dcd-48bf-9e6c-c166ec697aea", "comment": "Malware payload (Mirai)", "value": "464fdbc42f43dd2f1061fcdc869d6a9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670424, "uuid": "7b6af809-0c3b-488b-bf43-3e3866ff7194", "comment": "Malware payload (Mirai)", "value": "d19e8f8e7e2476a1db17799e76b10d1ce7473481279aa6ef51563466377484c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670424, "uuid": "9258e423-d728-4980-a01a-46dad5092b47", "value": "T159336C35F02DDE90C55601B4A4AC8F750F13F0C893536EBB1AE586F568839A8FA09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670424, "uuid": "de3fadbc-d20d-4f32-869d-1735b8ccc1fe", "value": "768:5aejeXQeqGMeXtNLrORaUhfuat77Kbc9y2FthZwCfoc1uQndCnbw:5aAummVyDhfrhjHhWLc0GdCnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670424, "uuid": "53223127-ac69-4068-8fff-cdc895bdcaa8", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670424, "uuid": "1dfcea63-ca3d-4708-9dd5-adb0f5351b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c563479f-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745670428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "591ecb96-402d-4790-b4ad-5674a8819bc7", "comment": "Malware payload (Amadey)", "value": "2a2a154e8cfb9c8393b610632f49c5cb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "49313a12-a178-4084-9d9e-5c6fbdae5be9", "comment": "Malware payload (Amadey)", "value": "58b9a714f452315a599d2514074da44e700850f79add468742a77acca0cd080c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "bc18abc3-4c58-410e-9ec1-67c47030b1bf", "value": "T140C34B213496C031D65D567E18A8ABF487BD6910DFB00DE77B840E7B8E642C2EE34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "a74c4342-7d70-43f1-b437-4681a48cef6e", "value": "fdb088ba51afbf555d7a0f495212d8f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "6381e862-39f6-495e-8825-813daf35d462", "value": "3072:34Z27UeZm+wr7CImXEGP/Y4Z3SNq/ofYYOpf:oo7JfuCIAEG/Z38Ynpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670428, "uuid": "760906e7-d43e-48f9-a959-d6d55b31e2cf", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "e68d5885-652f-4e8a-9fb0-8a26e7bbbff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56366da-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (DCRat)", "timestamp": 1745670428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "c9d95c8e-1970-4b9b-8b79-23838308c40e", "comment": "Malware payload (DCRat)", "value": "61d5db12ed0611000c59d5fd7fe884c2", "object_relation": "md5", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "d2acc3b6-e991-4e30-9353-f432f2a2be6e", "comment": "Malware payload (DCRat)", "value": "5c43a6d132376244c80efb953ff1d5563cd7b06a531b3e8e5f4678ec765c70a6", "object_relation": "sha256", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "0a80d4d6-e8fd-4c9f-91f9-091ca517158b", "value": "T1DC01CB403682F69C7BEB5FFA662BE504E4681A179B249000F4E899F36F3D174C7E2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "3ea9747f-4ada-4bab-a776-23593d1b8a62", "value": "12:AUFCS5/+daZ7IaYS51gKI7M3WVbgd3pjqI5J0gdJQg+QrgxnIAg:fFCS5/vZkax51w7M3Wx2xj5J02Jx+8gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670428, "uuid": "783e3270-7495-4663-921f-490a9e70e9bd", "value": 712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "b6376ce1-f882-474f-b52c-a4d6e73d75d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56425f3-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745670428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "c67bde9e-d307-4e1c-8cc1-9438ef783ca4", "comment": "Malware payload (Amadey)", "value": "e5c8cfb872996ad51af92a5c30246025", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "66b9ee64-9ec9-4f01-862c-aab8e546d6ce", "comment": "Malware payload (Amadey)", "value": "012df1ec7071e430236bf30a908819c3579799749594a826636654b571c4d629", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "3f2adef5-84a6-4be7-9b1b-a835b15c6a33", "value": "T174C33A213496C031D65D56BE18A8ABF487BD6900DFB00DE77B840D7B9E642C2EE34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "19765b5c-edf0-48c5-afe6-84511a26be42", "value": "fdb088ba51afbf555d7a0f495212d8f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "28fb1e1b-e1e4-4326-aa49-2a98f2300663", "value": "3072:oYZ27UeZm+wr7CImzEyv/Y4Z3SNq2fYYOpf:lo7JfuCIsEyfZ3SYnpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670428, "uuid": "71226494-712e-4e92-b612-15cfaea1982e", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "d987358f-c77a-4747-9da3-47487b3ece9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c78973-1f88-11f0-82df-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745670428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "cd362f5c-0872-4f74-bc1c-8f52076f435d", "comment": "Malware payload (LummaStealer)", "value": "72acc275e2659c2afa995fa855f03cab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "6d7aa853-3e1a-4888-a5dc-6af8b76349d7", "comment": "Malware payload (LummaStealer)", "value": "30810c2fa79e24d7835cb4faac6470885530491cbb2410e938e5a073b3c9baef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "59c99869-f6cd-49b0-a2f3-9ce234c644e1", "value": "T1AE66220493978BF1DEE706F48806266439792F338D148EDEE4B4B9F96EB1A523035F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "5d8127a6-983b-4b32-b80c-b158aa4f5310", "value": "087853508c88e6dfc47a24f9097729c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "dbfa75c2-1331-4265-b4c7-f9db71a96c16", "value": "98304:olF38+8erUn2lgCIb6RE13Xmqs0a371DVU4TqvVcDJZiri4EgKKeMtY89bT+VR:olRqeuCIOE2kas4TqveDJGrC893+VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670428, "uuid": "a9fed07b-5468-492c-8d1d-a61b9a872877", "value": 6958592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670428, "uuid": "446f3821-8bc7-4e01-9c85-9cba9e4fb2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f36147-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745670429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "50db59f5-eee7-453a-bdaa-190922c631a7", "comment": "Malware payload (Amadey)", "value": "c0333847dd277e47f3a803790032e69d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "b9dbe4ce-302a-40e9-8fa2-e09898dc0be1", "comment": "Malware payload (Amadey)", "value": "152fa680401ee2403bea01e5fec23201f2b3ad5745a17c08ddfcda5c001c4ac3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "428e6e15-33c1-4c38-a01c-c73261ee112c", "value": "T1C1357E06FA52D0B1D8D420B112B6BBF2597C6539A72445DBABC01FB69D201F33E36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "db805ca3-2756-4b3f-8aa1-714cf1b89210", "value": "aca6f08ee5befa37be16bac4bc315573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "ff246ee0-9f50-4875-9711-6c49eb6c1537", "value": "24576:pf5xDRatdGrWrz4x8/cvmGwDM1H2BPdEnunN1ljhzgPnvzJnRVIbs:pf5xVaU24WGmhkXzFUbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670429, "uuid": "5cf193ad-b316-41c8-9065-fc73fd4353b3", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "61eaf17f-4e0c-4ab2-a97a-ba4e161fc849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f52bed-2299-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745670429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "1da7d266-ae3f-4290-b9e4-b0571f8284f0", "comment": "Malware payload", "value": "5e064fc01e895ce732c9ce357ef96910", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "0b72158d-3458-4147-8a1a-f772465b920f", "comment": "Malware payload", "value": "4681949984a7c75a843b9b4e4ae733941880e58ec264f7f68519949644936889", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "77c531d9-72ed-43ac-99dc-1db2a73f1010", "value": "T1AF446C1677A40CF8EDA7923DCC560A4AE7B2BC160771EB4F03A046975F232A19D3E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "5ce6d1d1-8a70-461d-9eea-25d6e2c33a2e", "value": "bdcc417182aff23aa735853592246a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "5c694770-be55-4a04-8aa5-06fa2dbd56c6", "value": "3072:1QIUA2/r2Zl9Yrb4fAj/6tXn/atD0cm53jVnw31fzXom6oxsHFM8CLX5kDsxfmbU:1NBoj/6tX/atQJ53jVn2pj0M8CLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670429, "uuid": "bae01d26-7a85-4174-b003-4fc4ba59bcbc", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "cdfd6bac-c2cd-4d7b-bae3-e39386a94e45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f5463e-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (DCRat)", "timestamp": 1745670429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "95769c09-84e6-4dce-a922-cdc7d08a26be", "comment": "Malware payload (DCRat)", "value": "69f49a50e927c947f4cb26a03dc67285", "object_relation": "md5", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "acfd4532-03f3-4e87-90ec-a2f06a3badaa", "comment": "Malware payload (DCRat)", "value": "1ae48f847c4102031c47453078508d1006b888890cae7421ab7262b88b52b91f", "object_relation": "sha256", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "36f9e951-79b4-461d-ba64-4d050e8d18ee", "value": "T1A8B49F70F75A9ED6D48D8E31D6BE76B8F62978695A448303B38C72124DA120DDCCC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "fac9d768-9ed0-4d4b-b1c1-fbc967cdcf2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "d617d15b-e419-4f89-8aec-3fdda855988f", "value": "6144:egtRLlSJjug5umPlQxyQ69XBRrai8SBM69yIxG/y9V7Jl:eSLla5vecAYM6MIx62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670429, "uuid": "67248f52-7af0-4937-a591-725ddc508ad9", "value": 501664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "8108e33e-2639-4cf1-9531-23b5d7b1027d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c618eeba-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745670429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "d204df87-c073-4724-9e55-14f4c431d605", "comment": "Malware payload (Amadey)", "value": "6ad4e567657671704f787806f66f1a74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "5110be02-b337-4cc6-a2ea-31195bbf6a51", "comment": "Malware payload (Amadey)", "value": "4e864b2060e5214e7196d334afec43414910168cd6db1c89d09a58c135d51f2f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "f403e4c7-79af-43f8-bde7-8cafeade4826", "value": "T140557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "73449d63-e503-4cda-898b-26c4f29f286c", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "db74bf50-1653-4951-b076-c231814832cc", "value": "24576:erR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRnyOnW:ekHmiyCkhh2Bamituw+UFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670429, "uuid": "77a9428f-aa63-4f14-b63b-97db7f55ee70", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "3f9da9a7-82c1-47e5-8746-33b46c806d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61bdabc-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745670429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "17631ca9-6a7b-4d01-8f23-536b1773a583", "comment": "Malware payload (Amadey)", "value": "d07cf2437774da1a750a65f28b4ab5a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "0c8299a9-aaf0-4bb5-bba9-6236cff32d79", "comment": "Malware payload (Amadey)", "value": "216a9dc8424e6983de8457d174a6c8cf80afb911dc3817091523d16e626dad8a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "a3c4d5e4-1328-4637-b880-0be76164deb1", "value": "T12D557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "8fdc9c75-2434-45bd-9eb7-a39a0bd46b01", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "8013d9fc-4afc-43b6-9ec8-09b8324b4a58", "value": "24576:frR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRRhOnW:fkHmiyCkhh2Bamituw+Un/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670429, "uuid": "0e133afa-b5c0-4bee-ba1a-62a48f7a5e41", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "29a21aa3-a5fd-44ae-9b0e-87b6a132fbba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6281e5f-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745670429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "dccc9f98-1517-4545-a91d-57995ec34e32", "comment": "Malware payload (Amadey)", "value": "69aba41ff3745b625a9e73b0f167b0e2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "b493d6e1-91bf-47c5-8fdd-115c039cc107", "comment": "Malware payload (Amadey)", "value": "d89ad3798e970296fa0129be179c3ffe5d280da96774cbef7647e57918ea7f1b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "a9a22f37-1cc6-488d-8f58-ffab6f57de77", "value": "T102357E06FA52D0B1D8D420B112B6BBF2597C6539A72445DBABC01FB69D201F33E36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "0bc41bb9-a36a-4428-b81c-faa539f2ef7c", "value": "aca6f08ee5befa37be16bac4bc315573", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "e732d303-f1eb-4b47-9319-ec72aa190b65", "value": "24576:of5xDRatdGrWrz4x8/cvmGwDM1H2BPdEnunN1ljhzgPnvzJnRVI5g:of5xVaU24WGmhkXzFU5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670429, "uuid": "1a866c69-7230-47ef-b8e8-215ad8392127", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "b410cf5c-020e-4b2c-906f-845e2fd89256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63a4bfa-2299-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745670429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "b8d0f95d-ad08-4d46-9542-df91ea9f05d1", "comment": "Malware payload", "value": "f24ef2da5361cae4d3ac6eb1528c70c6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "7a9ceca1-e6c6-4e25-8eb2-362954764ab4", "comment": "Malware payload", "value": "507f60bd57f48d93609f9b42bbf429f39f68c54ca97e0c2bc685e57839c72f29", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "b6d7495e-a4e8-46e0-a0eb-b1afd78cf5d3", "value": "T17D8533FC9CE3EE50E8A10A77844F555A7FA04AC7D0C5E4482606ADE7C463AF2ABF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "b4042053-4ee7-4505-9649-338b616904a8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "ae813ad0-6f35-4a41-9320-20084d6a73b0", "value": "24576:FzpYfk9XITgd2fGMcoMCYmxuqa02LJkMaP7dP21Zcd/Byaqc3I3WaRImAUxcYc7E:zYMms+Gutp21Gjdn073WrmAVrlQ+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670429, "uuid": "4c8b2968-2f1c-4c46-b27a-36c92406afec", "value": 1869312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670429, "uuid": "e066392b-dd27-49da-981e-d539414a46f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6491ea2-2299-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745670430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670430, "uuid": "952eb8ae-e750-41e0-bcbc-5a67a07e66a5", "comment": "Malware payload", "value": "4a53c13ec089f37a5bb0e1d48f5b8b0a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670430, "uuid": "5212a64c-1326-4c87-b6a3-53fa6d0e3230", "comment": "Malware payload", "value": "e49c60dab6139e2b907661b19c612068dbb143f90817fc1bb0694620d5dba26f", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670430, "uuid": "5e4f874f-bf89-44c8-a459-03f95fed4753", "value": "T1E6C53358E78A4DF0F93AB93A088683611FFCBCE1293C423553176652E1B5DFCA721A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670430, "uuid": "16f97563-c614-4f7c-9c86-0bacc96039a0", "value": "d696398a32392fc995e2c1afe123ea9f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670430, "uuid": "adf94859-0c7f-46db-835d-044ea1653068", "value": "49152:0FlnadsLteSgulTpc8iYMKC4f0xw4K/k/iYYBBM1YGtLIoTNxTDl2:CnaWeSguTFMKpMy57YYTM1vLzTbT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670430, "uuid": "7fdb85bc-119d-4d12-bad2-96c22d7ca856", "value": 2680197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670430, "uuid": "6898de66-e047-4252-9c6a-48d23c9e6524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c659fdb0-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (DCRat)", "timestamp": 1745670430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670430, "uuid": "c8ec5731-acd3-4650-aaf2-4fb486e4a446", "comment": "Malware payload (DCRat)", "value": "1dce3688462e3f544ecde911071a04cf", "object_relation": "md5", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670430, "uuid": "d5dc73d0-bf7c-49dc-be06-2f340399cd1e", "comment": "Malware payload (DCRat)", "value": "90ee900399ebb007dec44bcafc732ba0f98a9d194c7023a942873863aa37e789", "object_relation": "sha256", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670430, "uuid": "6d11df90-215d-46b8-b53c-015f4913dd88", "value": "T10975222813D85B41E6FE5FB53864905147B4B702EC17CB8DF2C0618D8A73B8AD732A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670430, "uuid": "286beee1-076f-467c-ba67-7cde2ffac204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670430, "uuid": "a405c822-a326-4384-a914-1e7344d1bb18", "value": "24576:S+JEfJhZ8j53sY1jCeqm6qv80MaooQajSMpHYWOkEfW5EQJZrUVvsgMYHQgdUU2G:S+a5csqCeq08moPajSQY5HYryHACWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670430, "uuid": "5de7e392-2907-4279-974b-e52828e897e0", "value": 1561088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670430, "uuid": "7d56102d-d50f-4bb6-94a7-7fcb3c1d629f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c99c713a-2299-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745670435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670435, "uuid": "0f1bce3e-add3-4699-9423-1c6e4cdb7a92", "comment": "Malware payload", "value": "7baf1f5a60bbe295db0322db86b4b84a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670435, "uuid": "52540892-c531-4205-ad6c-c5f8ceb34c8c", "comment": "Malware payload", "value": "fdb8df3185c99076b31072fc27318e120a57298b0fbd7ae2733a5b2c4ebd3cdb", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670435, "uuid": "1b304576-716b-496f-9dd6-253998996682", "value": "T117A601BBF744B56EC4F3533745B69E2215077C268B4396836954B23C58BBAEC0E09B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670435, "uuid": "3203cfc1-002b-4c16-9d82-c7d84e8cdd5e", "value": "196608:r9rqXAj0vK0/nhSM81GfqLcbPP0ye08ekebqV6jcE/L0bySN+2k9t:r9MPC0/noTVcD99bU6j39S1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670435, "uuid": "4a97147a-e34c-4d41-9546-7a94f309e2c5", "value": 9637972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670435, "uuid": "0e3d79bb-731f-47a5-8d1c-74e42e1e2549", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e755e2b0-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (DCRat)", "timestamp": 1745670485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670485, "uuid": "2b7868ea-73df-451a-b091-69a1866817fd", "comment": "Malware payload (DCRat)", "value": "a96761c1e3bed0f2c2f8e2d616f60d40", "object_relation": "md5", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670485, "uuid": "bcafbdd9-c062-4f38-ac55-53e327048387", "comment": "Malware payload (DCRat)", "value": "520e0f5ca64d3c0b697d74da92af56766f13c04b0fa9f19c5bb23561160644c9", "object_relation": "sha256", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670485, "uuid": "9edbe01f-120c-46e8-b96e-9dfa38476e1a", "value": "T11B211E4136C299889BF35FF71B2FD808E45A591BAA249410F0E54BD12F34334C6F5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670485, "uuid": "6ef4c4ec-a150-4584-9592-40c92cbfec4f", "value": "24:DFCJlXNvzkgVdy9irykV9Qd6HrYORNO37Jx2xmfS02dguLCASxyFP37ZtSNjW+Io:DFCPNvAJiNLQd6H8gE7J88sd9L1F3lt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670485, "uuid": "21975bbd-722c-4dc7-bc83-4ddda6e75ad0", "value": 1355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670485, "uuid": "e298a9d8-3d2e-49e2-877e-936483a05ba8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76d1e02-2299-11f0-82df-82aee05be84a", "comment": "Malware payload (DCRat)", "timestamp": 1745670485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670485, "uuid": "dc9daf47-5913-48da-8a2c-853d2db2c1e9", "comment": "Malware payload (DCRat)", "value": "e4ea2ac8d2a17b90650633ce30c5d7cd", "object_relation": "md5", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670485, "uuid": "7de6e0dd-6a75-4bba-a007-93f01f43eff0", "comment": "Malware payload (DCRat)", "value": "23595aa0726cb2922cb947269fb1f3f29e26250a61ff6db6986105247b9f3d9d", "object_relation": "sha256", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670485, "uuid": "178e4404-2f4c-4b9d-a069-7736c009f8be", "value": "T1F8211E8037C391888BF39FF61B2F980CE45A491BAA249410F0E54BC56F74334CAB5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670485, "uuid": "c7afba91-0970-4108-86e9-7aa9bc97b83a", "value": "24:DFCJlXNLyzkgVdy9LqrykV9Qd6HrYORNO37Jx2xmfS02dguLCASxyFP37ZtSNjWC:DFCPNLyAJLqNLQd6H8gE7J88sd9L1F36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670485, "uuid": "c23adcdb-af71-47df-a575-1d7a7e2faa1b", "value": 1355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670485, "uuid": "c9b4e558-d9c9-4e53-91db-3df4926b1c7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86d401d-229a-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745670916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670916, "uuid": "da034f56-92fe-4f54-89a0-b3e7c51ad132", "comment": "Malware payload", "value": "2aee0dff70cf66126d2caade42e453bf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "strrat", "colour": "#235bed", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670916, "uuid": "559d7ea4-7845-4dea-86c0-bae43e4f624e", "comment": "Malware payload", "value": "e285aedfb91d93dcb1fec1fe86652d2d50d54abcfb814617ba41c796765b879a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "strrat", "colour": "#235bed", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670916, "uuid": "d88ea7f3-e182-4453-891c-e50d520385f9", "value": "T174E533452133E1F7CCAFD03605E94793692596318348A82BEEC20F59A3DEE21BF575", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670916, "uuid": "b5322583-3891-4985-a3f5-89b6a1a21d9f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670916, "uuid": "034b06c4-3bbf-44e9-8bc1-bfab893ac7ef", "value": "98304:ZNZ5cqI/mznA2YFPCJrriudD0VXm3lqC6f+U:v7LIQA2bdpdoxilb6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745670916, "uuid": "f4ae211e-978e-456e-a14a-700669ced9a2", "value": 3277824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745670916, "uuid": "51021214-9be6-4225-b7f2-985d7a6d819f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb9b732-229b-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745671088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745671088, "uuid": "6aa52abe-e516-42bf-a7db-de7b8bcef875", "comment": "Malware payload (Amadey)", "value": "973fb94762f2f8625ce1523283e4f4d1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745671088, "uuid": "d8e18b35-3e02-4ccd-97fb-7c07884741b9", "comment": "Malware payload (Amadey)", "value": "2fe9e1ce306a2d6ebd0827a9783ed9c688aa26bc778f15489c1c97d07c534e12", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745671088, "uuid": "a1d8e52e-e6f1-4cd6-a762-d205edb85d14", "value": "T1F7159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745671088, "uuid": "5fcaf967-fb7c-4c45-ba00-90150ae47c67", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745671088, "uuid": "85aa45fc-b182-449f-b031-5d5cb2855742", "value": "24576:IqDEvCTbMWu7rQYlBQcBiT6rprG8aeDV:ITvC/MTQYxsWR7aeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745671088, "uuid": "2efb282c-913f-4387-a099-a3f15452a2c9", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745671088, "uuid": "00e41f3c-51a1-47b1-9b1c-1217bf276f09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7803a5-229e-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745672346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672346, "uuid": "4bcb31fa-b355-4e42-8b97-d9fe0bda7f93", "comment": "Malware payload (Mirai)", "value": "192735f5f47bcd0f7d478905aaf5c726", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672346, "uuid": "3006c7be-5ef7-4957-bd38-cd19ba0b5441", "comment": "Malware payload (Mirai)", "value": "66469a190ed66ae86677bf009e8f6cab9c7db75b2c2649f42daa761bf33e8236", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745672346, "uuid": "1779feb0-0c59-4afd-ab40-8b3bc1946fab", "value": "T1D1632BD7B8018D6CFC5BE6B984160B0EF93222111FA30F27A557FCB75C621A55E2AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745672346, "uuid": "087c2b70-7adc-4ce0-97e8-5ddfe68db763", "value": "1536:fgExtNdLebC9QcBylqt88ExUqrlzLLjkt:fNxtDLee9bBy0WzrtLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745672346, "uuid": "f7d2003a-b6f0-424e-8769-719c9e840a88", "value": 70084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745672346, "uuid": "c2487a23-7269-419d-941b-2ad7a3a0a529", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8291e052-229e-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745672463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672463, "uuid": "e0c2a3f4-da61-4d95-a9bd-5889bca70d16", "comment": "Malware payload", "value": "88911776f3bf72c59f99aa8343ac899e", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672463, "uuid": "1c06e8da-559f-475b-aac1-b8d9ff036bbc", "comment": "Malware payload", "value": "a00385d1e4618586712709fc8d3ea8002b8e01dc3cdf9de1145d2d7faacd7eb7", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745672463, "uuid": "6925383a-40e2-4be9-a859-a8aa0276c241", "value": "T11911C6CF215696610E4E4E58F22A5BA8EA46EFD230504F68944C44F37AA8D14B629F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745672463, "uuid": "9805c3a1-e402-4309-bcb8-66fd0dc4f907", "value": "24:NRgtD7tFNI75tNKgtBtBlt7UtRDt4tbwgttltbtqA:NRgtD7tw5tNLtJlt7UtFt4t0gttltbtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745672463, "uuid": "2b1d4820-559f-475e-9a7f-48ea8dcbad48", "value": 891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745672463, "uuid": "b260474d-0ada-456a-b21e-2108c763074c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5a69dc-229f-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745673020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673020, "uuid": "af7587cd-5fd6-497a-9f61-ba120392fa6b", "comment": "Malware payload", "value": "289477a523af9d6a580718226ac11eae", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673020, "uuid": "0a3a0d47-ec14-4191-80cf-77b20d9f5729", "comment": "Malware payload", "value": "8d6dfacd2b0342b6ba7abe30ccd4e1a59777a44d34f4d4f3bff6f52fd6506403", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673020, "uuid": "07376c2c-679e-4c0d-bd7c-61b651b07f73", "value": "T1FC34010A473C58A91C4D1FD7B1E3F031299621B29FDFF6FA1713814EA5DE9E360262", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673020, "uuid": "b97fafd9-dc7d-4e59-97e4-8f2746352895", "value": "6144:nKl7HTzB+/JrEjiYvfod3Ogmojk7HAI0nYPOXOP5y:nkjg/Jry5zojOWD+PY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673020, "uuid": "cfab05e6-6fc7-4f4b-bec5-6e8b047cd74d", "value": 247885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673020, "uuid": "31964689-d053-4baf-b8b4-93eff158d3ee", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf24cc3-22a0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673286, "uuid": "3aab6b80-3215-45a9-a7c6-b00788748fd3", "comment": "Malware payload (Mirai)", "value": "3b9677c6db87b6e33aa14d6cb8811921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673286, "uuid": "31237437-5457-45b0-ac4a-351f1c55c802", "comment": "Malware payload (Mirai)", "value": "c44edb32779e3520451c8323d55bb8f529dd7cd5af084c9ee6e1a87664ce848c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673286, "uuid": "6f6661b9-2b1c-4e6c-8df0-9e290ad5a9c3", "value": "T1BFB38CDBF24712A0C86246F007CB9BED3E2722816F27C5E77D2A257968791CF8905F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673286, "uuid": "0416ae40-882d-4124-b22c-3342ae527ac2", "value": "768:JAn2cVjUZcDF4UI6+eXEqQhOSpPqUmocKsfeCCBSdsp6rqEpXBhKiWidgMwVpn5y:A21eBlaMSpMlJCI+pFiJW0gNe/LWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673286, "uuid": "84bc347a-1e6f-4afc-ae20-7b4a948c14d5", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673286, "uuid": "c9c75839-833d-4146-b8bb-f8b2482fbe9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e59e48-22a0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673358, "uuid": "07513137-1d0f-4db6-bec0-5c1b8cb29e2c", "comment": "Malware payload (Mirai)", "value": "b32b0a41d1f5040f4358d8fe07048ddb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673358, "uuid": "030fd4b3-322a-44e2-8e3e-318e82f51705", "comment": "Malware payload (Mirai)", "value": "d8edf0ada3e7cb7b4f13d71bfe0076d55382f2f8234516c24279a3e2ed77275b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673358, "uuid": "d37c74f5-5dcb-4501-a89d-ec35a288883e", "value": "T14DA2D02466880C17C959833533CF5CDB375D4C80CB9B9BC82ABDC2CE269536A763D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673358, "uuid": "a9c19177-fa99-455e-b6d8-957b35126fee", "value": "384:MZP3QmLSDXn95sk36qx1ju3FwPJFsRW0emjj+v1R6Q:xm4vsk36S5g2fsAc06Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673358, "uuid": "bc3332f8-79ac-4fc0-8b64-6c2ba2f7de89", "value": 22052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673358, "uuid": "45cd6d20-2a9d-4be1-b9c3-5fafc836c585", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4a096c-22a0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673443, "uuid": "81e8cdc9-9654-4934-ac20-0270c7fcec9f", "comment": "Malware payload (Mirai)", "value": "cde237f3a669107c7ac266123bd90975", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673443, "uuid": "ba34dbcc-e7ad-421b-9154-8c20800de1d2", "comment": "Malware payload (Mirai)", "value": "11aceb0680bdfc988acd89f6d230d0052b3a53c1a2f604b69e20885e11efcaae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673443, "uuid": "b2940476-0801-4395-973c-fc8d9a6d751c", "value": "T14823F2B9971EEC5285515C3BBC498B16EB420FBCF72E6055E70384AC8C4A06E1EEC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673443, "uuid": "1aeb313c-0d8d-45d7-b27c-b3b853824282", "value": "768:2g/f7uftgA1bFaV2ZBpHJfyD3dZgiNIBN6vmvZB9q3UEL32bFXcieIK9mPgNZQK6:2ODulgoF82RJf43rgiNIr6OvuL3xiNKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673443, "uuid": "694e1baf-7cc5-4104-a6d1-bb5c6618ebb3", "value": 46848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673443, "uuid": "e5c7b825-5b6b-46cf-9192-93a74dacc66e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d514508f-22a0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673461, "uuid": "e05e58fe-8730-456d-a757-dcf36ab48875", "comment": "Malware payload (Mirai)", "value": "e189f7265a46d5c26f0a865dc2c8a5bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673461, "uuid": "f2b327fb-468c-48ab-8d4b-b976260b7cbb", "comment": "Malware payload (Mirai)", "value": "8d6bb1e29fb0d751fa36696dee353706c90caf13284cd30e96a42f2bedb7c76a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673461, "uuid": "d5d44145-ef89-4e25-98c6-ef1c396e3085", "value": "T147B2C0DFF5B8BEC8C9BE9EBF748E13444DA5BAC432CC5759A322CC80653164E35488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673461, "uuid": "aa347a13-68e1-4285-b313-a17b8159e812", "value": "768:sh8KG0oiU3jTk6ejZSsyxJYNS9IVF+tvWwX:shXU3jTk3lN6YQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673461, "uuid": "4ab95d96-7b84-44ea-88ce-fa60c6d27bdd", "value": 25192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673461, "uuid": "ca18c210-6d20-427d-bc8f-44d611afbfc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8852826-22a0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673520, "uuid": "deea2758-52e2-4a93-8d90-c6a9f4f238c4", "comment": "Malware payload (Mirai)", "value": "e5bf71162cf2ae072049728eb53c4b13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673520, "uuid": "091293ce-7a71-44b2-9e85-1a09ef538831", "comment": "Malware payload (Mirai)", "value": "1e5a0e8a2d2158ff43702c6981ea0cf3fed1fc19252cb1a92c5bfc49c53eacbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673520, "uuid": "127e69e9-7013-49f8-82a3-0448126db496", "value": "T16E336D35E02A9F94C59601B4B49C8F741F23F0C893532EB726D546F1A857AB8FA09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673520, "uuid": "cb4d3331-cb34-422d-9729-887b40a5414e", "value": "768:ea/DewBeTeXtNLrtOufuatlHIUD5qbb93JDaCfoGvxD7CH4w:ea71umVROufrnn9kJDaLG57CHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673520, "uuid": "1544bc91-13ac-4ae4-b836-a52e7d217fe0", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673520, "uuid": "314830c1-8d16-44d1-9f1a-da04bed8141d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0442efbd-22a1-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745673540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673540, "uuid": "c54ae65b-fd37-4f44-8af0-00795021573e", "comment": "Malware payload", "value": "d9cd1121320c65e649bc28656059d636", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673540, "uuid": "3383b11b-8dda-4fbd-9fd5-8fe694c101cb", "comment": "Malware payload", "value": "c9bfb9805c32bd8f4690788515bdcfbedd7d9da28e7c39f95a567db87e9ed96e", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673540, "uuid": "502496e2-370d-429a-a147-bdc0fb5112d4", "value": "T1DD34D084C1AEA6377D2DE38D8FBE0256621BD0F9E4A10592FEC74D1836291117B237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673540, "uuid": "35946c5c-e5e4-41b7-9eb3-0f51b30aeb08", "value": "3072:CW4lFh1Ka77ezoPjNMELXErOfV2hrbcb6MYe8mU61OAaZYbQ9EilyeEt0FBx:uL1CwjNnorOfoPeLU61daZsQy+zc07x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673540, "uuid": "cfee7801-d8c9-45c2-a22a-2d55310abccb", "value": 239697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673540, "uuid": "3ad41b4e-dfbb-4c5a-86e7-488ac6f4754c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264deb17-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "91a3cc4d-291f-4068-8832-5d1677868d70", "comment": "Malware payload (Mirai)", "value": "dcdffc7aed186637bfcfa2f85f528a34", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "75c7ec71-3724-4a7b-a41e-6c6f4f4fefc3", "comment": "Malware payload (Mirai)", "value": "94f74449bbff8ee640fa827d4eca9a376df175ddad43dbcda1a2a2372e588cd8", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "efd090a6-e11c-478c-979e-8c7dca1de936", "value": "T172D32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "1cfa1ba6-5864-48b0-8bac-e9da7ff09db9", "value": "1536:9roGHNTUZNWMIBUiCxfytiteQInJ7abwko7lj0JvAhhHr5+5uQfqIcv7K8:nm4UiCx5t26wN7lDhLv+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673846, "uuid": "55c7acda-49e9-41ca-a645-edc8ee93faa7", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "9bfa446e-e162-4083-9cf0-0db59be3105a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264f6cb9-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "44ea6380-2d16-48de-8f61-9e4520cacf99", "comment": "Malware payload (Mirai)", "value": "41745a858b3419c18068d0540859cffe", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "7ab96754-cba4-4414-b715-0e7e0af2a541", "comment": "Malware payload (Mirai)", "value": "f31b2a135b8ddcb9722663b8ec4520b8924a2c38b8dd3c99e6bf6d19544aa91e", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "971e60d5-3b35-4a0e-a010-e7a35b96b1bb", "value": "T1B1937CC0F683C4F6E84305B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "c7da0b0c-002c-4d0c-bc0b-058243ca0a4b", "value": "1536:W/QCZaxGdvts3i5JPhowIxPu++ALtgUIKqI4FrS4LS7:WYCZa8dvm3oJPhVIxP5htSKfUmD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673846, "uuid": "ce045f52-75cb-46a3-b133-50e68d830b8d", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "4b1934d2-46fa-4348-a944-4c0e8616c6b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27012704-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "c4990925-6b13-471e-b136-5cb6549c98fe", "comment": "Malware payload (Mirai)", "value": "d1033e127f41bd298d71d06caf17b19c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "eabb4a6d-f2d0-4ac4-8ad1-b1ce42c5f8fe", "comment": "Malware payload (Mirai)", "value": "9d89128c9ddd6b99a29bb271a8f5555dfd27dffde8a1bccff44661e9c84a4c3a", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "b81bfac2-3226-4646-ae1c-9ae50e971660", "value": "T11FB35BB3DC26AF98C655D074B0B08FB92F53A59482471FBE19B6C2B44443D8DFA05B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "129b30c2-4ad1-407b-9e55-a34f90ecf59c", "value": "1536:WTW/VCxsHZusE2Li62C8vqKTR5/PPVGAto2WszrW+TNe77:WytCxsEx62NFT7VG92Wcrbw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673846, "uuid": "25fbe91e-f4dc-40da-8ccd-d207966177cf", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "3f305355-690e-4e8e-b70e-ca056e8613f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25df108f-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "99ff36db-ca24-43ab-bb88-068b9c0b1c42", "comment": "Malware payload (Mirai)", "value": "ceff89efb6c5e774e9dfeeede6e85fb9", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "0509840c-5da8-4687-a84c-642bb203dacb", "comment": "Malware payload (Mirai)", "value": "b3ae8570a382da334ef90b15c0fa21202d5115d32e2c7031e15576d6824adf18", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "831c4804-30e8-48b8-ad12-df924629f63a", "value": "T1C1C31B45FC405B23C6C612BBFB5E428D3B2A17E8D3EE720399255F61378685B0E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "bff449db-3855-466a-bd54-191c160ad4b9", "value": "1536:p3Ka0rG5yC/cMChygt5OBdWFAcJX4VlgXTAjcFAaUGxrf851WhXVVlnKwywEReQ/:5KaprMh7fOXWFh4UXwcFAa5xovW5kK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673846, "uuid": "533e51d6-9bd1-482f-8165-66129b084a38", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "2895f774-fbfa-47c2-8402-62a3f8eb44bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264c5ddd-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "de40998a-5711-4ba8-a8b9-d388f604e156", "comment": "Malware payload (Mirai)", "value": "7b83784256fbaea8debbc84d05994338", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "c4e536e3-1de6-499d-8270-f094d1f9750d", "comment": "Malware payload (Mirai)", "value": "e742ad42f67f70b3affdc31018fdea67666ab740b48adf4d0488c08fe21db994", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "7caa7e5c-6620-4126-8bb0-b59de14ca94f", "value": "T18DE30B46F8814B12D5D111BAFE1E128E37131BB8E2DE73029D246F647B8A97F0E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "23f2a12f-2945-4fd0-94fe-f0bbf919d56c", "value": "3072:DHea4CH2UjnwJIXMb6Azz1az/AWdYV8P4KL4:zePCH2Q6IXufzhakr8P4KL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673846, "uuid": "4ee3c0e2-1a52-48a8-9dc5-42956ade12d3", "value": 144156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "548a68bf-a01a-4f7f-bc85-d67d7e1459e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47671cd3-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "80de0250-afa4-4221-bca9-2414fc954846", "comment": "Malware payload (Mirai)", "value": "b3e4d67cd597c6db3c2455fa91d69ba9", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "6cd0dad7-9fe7-48e0-95c4-4354c8425f5e", "comment": "Malware payload (Mirai)", "value": "042febd0f4564e3ee998b8e38962c58a73b41cf1caac748c3cd4f54122d6c281", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "c771f523-9ffb-4080-8362-8c83c38ca542", "value": "T10BE329C7F800DEFAF80AE33748570905B630BBE115921B372257797BED3A1991963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "3a93b917-0c8b-4141-af0c-2efaab97c898", "value": "3072:qmzTDH86Jx78fO7xtjA7s2idk6w9YwVvjbiXL+noy+WYXr:q2TDH86Jp3jA7sHda9YPLry+pXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673846, "uuid": "90c737c3-2eb0-45b5-bd5f-4e0732a47fb6", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "e804f848-87c4-4e00-b096-ddffba5aed85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aab98ba-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "4010ddc1-5f13-44b0-b253-9c33861db2d5", "comment": "Malware payload (Mirai)", "value": "bef633af4c375512f2e790da8e036bca", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "977076e7-dab3-4a7c-9cd8-29b370c1fb5d", "comment": "Malware payload (Mirai)", "value": "43eb865a957058c8def3999c593386106d5b29598233768cc051e88a1ab96508", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "5ba2f857-5a36-4026-9e03-92b951a3a94e", "value": "T16004B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "8f133d3b-664b-4a2e-8e11-0ffe8d01fdbb", "value": "3072:nKpzGleNkSfcQqmav8SqaRVlnYz65AVt:nKYleNYQqmeqavlg65A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673846, "uuid": "7934a7de-717b-4b36-98c4-2fdd36c7eb46", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673846, "uuid": "3a901d62-5943-471b-959c-3e1aab59b4ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27515528-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673905, "uuid": "5c2000a3-851d-4a0a-b596-4fe15dcb6dd1", "comment": "Malware payload (Mirai)", "value": "d90fe6fe93e10cae2c1d39eacc04baf1", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673905, "uuid": "102446ba-5e20-45f1-a88c-ee4dbe14f697", "comment": "Malware payload (Mirai)", "value": "9783c5a5f2e0a5e430ad7a84a5ef5572eec1ee2600e00c24b69f7140ca96bb6b", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673905, "uuid": "2098c694-c862-469f-9f32-9ef87322985c", "value": "T156042945EA404B13C0D627B9F6DF42453333AB9497EB73069528ABB43F8679E4F22A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673905, "uuid": "449cf34f-5deb-4ed3-861a-973272126b4b", "value": "3072:OLe6vh/1QIruCee+asuTuRebU7IVILFZQy38YhTfYo+M/Rvs1tlLn:ee6vhCIr1r+asuTuReAvLF738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673905, "uuid": "843154f2-ed05-432d-8158-c1976c987d6d", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673905, "uuid": "6fe6ffff-2448-40f3-a0e3-cead82f3d8ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2761a4fc-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673906, "uuid": "310d0595-d8da-466a-9df2-ecd4f88deef7", "comment": "Malware payload (Mirai)", "value": "a1729774026175b5eebf51885813b9f2", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673906, "uuid": "12d924c9-b650-45ee-ae55-c8a44295ca66", "comment": "Malware payload (Mirai)", "value": "0ebf90fd660237531739c37f1425f2d4e5f6ff31d1bae5b5a98c935bc21867ad", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673906, "uuid": "9c5854d2-4e0a-412a-9029-78d7c9738695", "value": "T1CF04881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673906, "uuid": "bd8d096d-1567-472d-ab08-11cbda86acea", "value": "3072:jg57RW7LHZwbq1YSBan1yvbysxr1uGSKI:jglRW7LHZ0Bqyy1BSKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673906, "uuid": "9499d4ba-7a8e-4ba0-8220-e82c5a05bf7d", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673906, "uuid": "4c854558-f49c-435f-bc9f-0af7f1c3edf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e0b48e-22a1-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745673924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673924, "uuid": "86f958ad-4740-42fe-9251-801ca11ec805", "comment": "Malware payload", "value": "a0fa0ce566903cd43493338a8ca9a1a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673924, "uuid": "b6ef162e-d952-4a57-91f7-b70649568b04", "comment": "Malware payload", "value": "ab1c9b09e1d9c6cc8c2dde6dd9028e50b9920118ccf9b21e23616b8ad04161ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673924, "uuid": "cd9c2c37-173f-4463-9c2d-0884456eecaf", "value": "T117A523693DEADEF7D08909B30BD6DC11948F695DC53019F33E8E802A7A93A2A1D7D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673924, "uuid": "4067e9a4-728f-4646-b254-65b4893118f4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673924, "uuid": "f5b29c30-e22d-43a9-a57b-39bf700e88ce", "value": "49152:q3OkbOQEj0aAMA+Axttq1sh75MiZLX63nn6ysIqkqv+Ejc8:q3TBefAwW75M+L86yH+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673924, "uuid": "b44e81da-834d-4803-8ef1-f3c89f93e36d", "value": 2072576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673924, "uuid": "9f4bf9cb-e0e3-477c-b351-6e283af97b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26639bc2-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745673965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673965, "uuid": "1f2c43d4-c609-4295-805c-74748ae3a5cf", "comment": "Malware payload (Mirai)", "value": "e969ee8a9db7d19265350278a386aef0", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673965, "uuid": "0aef93eb-7ee0-4593-8d01-3dbcf3104614", "comment": "Malware payload (Mirai)", "value": "dd0d12712ab5d8e4b26dbd5a059bd53d7e064ec8db2f2cf2a42e043c8dea2b7f", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "fbi.gov", "colour": "#2cc04b", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673965, "uuid": "141ce423-0749-48f7-a6d3-68a97b958bb4", "value": "T19ED30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673965, "uuid": "c79759ec-b0d5-4559-a92d-9fe1427eee6d", "value": "1536:wKdzElm18uZJNb4AGFa8eAZHk4VB7fzTTfHh+gYSvvqeqZfB20ly+wyw6RNP8TGl:wKp50ZU8e947LPHh+zS6thBZ6xK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745673965, "uuid": "d9e0dc3f-b2eb-48a0-9a87-2f3aaaa6b0c0", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745673965, "uuid": "c8c1505b-c7f3-40b0-b147-5c4c0f0a61de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fc675b-e91b-11ef-8aba-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674025, "uuid": "622ab99f-0b8a-4318-9ae6-1760a90ffe81", "comment": "Malware payload (Mirai)", "value": "2d253c2f7df0d1131d2089d1da2fb1bf", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674025, "uuid": "6cbf7794-b70c-4d85-9002-fe43da559644", "comment": "Malware payload (Mirai)", "value": "ee7c32f57efb86a285514da96e2598f7d81688c177ec3de92e4f828cd23b47f7", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674025, "uuid": "4d24b4d7-fd8c-49e4-8f59-451df5dd6bd9", "value": "T15ED35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674025, "uuid": "6edb4b89-3645-4964-bfca-a46ad3082819", "value": "3072:79eSuygEPjt6qkWqDdKmDnYMb0gBd/gQyVGsdqml6gaj:79eSuygEPjt6qkWqceH2laga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674025, "uuid": "ec5ae5a7-2890-4ff9-81d1-ba340f47d8cb", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674025, "uuid": "9018298c-0409-400b-843f-7f24d3218457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "462212c0-22a2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674080, "uuid": "1ddebc2a-105b-4307-971d-16480081bdd5", "comment": "Malware payload (Mirai)", "value": "9c19a316aabe2c1cd37792dec06fb90c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674080, "uuid": "14eb7009-b4d5-448c-a20e-46f6b3d2b711", "comment": "Malware payload (Mirai)", "value": "ce1b4a60e0e7d958a7f302bee88ee1633d139f147e35be329af0a332bb1cb6b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674080, "uuid": "84a08024-4719-4362-83c6-f303f758ecca", "value": "T141B2CF4C6D46009ADA99C13982EE07510E368FE93941DD47F48EFEE7895D0D5B8837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674080, "uuid": "0b4308bd-9d98-4da7-adf8-737b0635def2", "value": "384:qMJTPR87fnwyhY3lXsxX9BwJUhKO/lV5NJgGlzDpH7uNj1Jwq:qSTPeEyhY3g9Bwqh9fJgGlzDpbuR1Jwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674080, "uuid": "4b32b4df-00b9-4c2e-b760-0c454d53d19b", "value": 24220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674080, "uuid": "2659384e-1f58-4558-bf83-968c00eee242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a3d020-22a2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674124, "uuid": "f2bf8e7d-7248-4a20-9ffa-8182c6cac354", "comment": "Malware payload (Mirai)", "value": "eff179ebd14c5ea3968e08027d80fac4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674124, "uuid": "dac0e5b7-49fd-4145-8925-610b034aa2f0", "comment": "Malware payload (Mirai)", "value": "afd7f33cb89fa3d47d356aebc2cef02af43702c4ca750117d11c6ad115016e98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674124, "uuid": "3e1d8194-48e5-4a8b-ac53-0abe06abd025", "value": "T1E943198AB8029D7CF91BE6BD54164E09BD3067C151830B276BBBFDE36C731A85E02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674124, "uuid": "29b718fc-adb4-42f5-afae-227c97bbb2e8", "value": "768:6xPwquZBKUV3kqsgewLZiqH6PGeBTN856M6jizEghXOWCjsT+zGY:G4qq32geSideeJN856MVEghX3CjhqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674124, "uuid": "670ed3be-6593-4b52-9452-aa94a24435f6", "value": 55192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674124, "uuid": "8902372b-9f84-4de4-a5c2-533352059a65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c351e72d-22a2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674290, "uuid": "586aea2e-978d-41c2-954f-445451a81cf9", "comment": "Malware payload (Mirai)", "value": "771b878250fa6d00bf80c1826f4306fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674290, "uuid": "ad5faeca-d142-49c6-abb4-f02f1ce5298d", "comment": "Malware payload (Mirai)", "value": "b3f10945ec8ba2619580fe19529a6829a4adeefd1514d8124b4067dd226d5ede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674290, "uuid": "a4992cab-486b-4317-82e0-52a5698b5d39", "value": "T1E1C2E031412754A195F00932EB3F86877AA55EF8D0DA30636BEC92495DCC1053EFA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674290, "uuid": "93fd708f-12f1-4c2b-88ba-88ef40c1045e", "value": "768:dU9ZjOnQYfqaO/VyUOCRS/GPtsMVS2Our9q3UELHf:uDjOpiXGQdPtsqpmL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674290, "uuid": "9a0a88e5-8b22-46a8-ae98-f474aa4e9693", "value": 27496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674290, "uuid": "f6b409cc-6092-4326-885c-5f6611642289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977d5efb-fde7-11ef-9f33-82aee05be84a", "comment": "Malware payload (CoinMiner)", "timestamp": 1745674387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674387, "uuid": "a0957e66-bdaf-48d6-8ec0-4254e1ed11ce", "comment": "Malware payload (CoinMiner)", "value": "c6eb7e6bf6099b9717344e2138b93e43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#354D4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GandCrab", "colour": "#a35472", "exportable": true, "hide_tag": false }, { "name": "IOC", "colour": "#cbae74", "exportable": true, "hide_tag": false }, { "name": "phorpiex", "colour": "#16a28b", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#9e80d3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674387, "uuid": "627c2311-88b3-4f63-a94d-f502c6941200", "comment": "Malware payload (CoinMiner)", "value": "abcd10949a438a7c9d6096d48cfc0fb30d45dffed4b9dd616ac1b51d9783509a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "CoinMiner.XMRig", "colour": "#354D4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GandCrab", "colour": "#a35472", "exportable": true, "hide_tag": false }, { "name": "IOC", "colour": "#cbae74", "exportable": true, "hide_tag": false }, { "name": "phorpiex", "colour": "#16a28b", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#9e80d3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674387, "uuid": "e86c5829-21de-4529-9678-695373980d4e", "value": "T160732700F6D0913AF4F780FBD2FB566A582CAFB4230954E7628479AFAB245D5BD310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674387, "uuid": "5eb90ec0-9ffe-4b53-8496-5a372e18adf9", "value": "05232add98361a134fdaa26f6720c77a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674387, "uuid": "ca61fe9a-2e07-4309-9050-ffdeae7037f6", "value": "1536:vm9HCOFmav82bMaLZWfUM0cWhwpLXux5efnkzc:e5gOzxHM07ipIAfnkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674387, "uuid": "9de368c8-0ef7-4990-9b7d-cfb10e83a4b9", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674387, "uuid": "9ac070a0-a1ea-415a-bb22-817c0f92578d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3556908f-07e4-11f0-8bf2-82aee05be84a", "comment": "Malware payload (Phorphiex)", "timestamp": 1745674387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674387, "uuid": "497e9821-3cfe-43c9-8d08-e185ddaf23f3", "comment": "Malware payload (Phorphiex)", "value": "21789ebcbfca1eb0c6881e6af6216a81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GandCrab", "colour": "#a35472", "exportable": true, "hide_tag": false }, { "name": "IOC", "colour": "#cbae74", "exportable": true, "hide_tag": false }, { "name": "phorpiex", "colour": "#16a28b", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#9e80d3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674387, "uuid": "83565c48-ad9e-4d44-a2f4-ab27018208c3", "comment": "Malware payload (Phorphiex)", "value": "c0d12405d2a5cd6064e6e498d6f5f7fd48c72b2d02f171f20f898a4d2832968c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GandCrab", "colour": "#a35472", "exportable": true, "hide_tag": false }, { "name": "IOC", "colour": "#cbae74", "exportable": true, "hide_tag": false }, { "name": "phorpiex", "colour": "#16a28b", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#9e80d3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674387, "uuid": "0d65fe4a-9fd3-459d-bc9a-778a6c92b8de", "value": "T1C4220907BD8A4060D3D04CF053B6978A8BBE1873279271CBB3B3D59E0B74795C476A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674387, "uuid": "30622471-9088-4f22-8737-2145a966c32e", "value": "abcf9709e3eeba582adf1cd31d5fae48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674387, "uuid": "5ce354cb-27f2-4bf8-94de-c2f887ab2d83", "value": "192:TalzC3fI+riR+iDs2skJxTNhhthybHo4:Tal231iQos2skBhhyHo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674387, "uuid": "4d09e2d9-ef5f-4565-b6ce-860c4a7627fc", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674387, "uuid": "4e531fb4-84f6-46d6-aff1-1934d280df1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d81ac7c-06eb-11f0-97fb-82aee05be84a", "comment": "Malware payload (CoinMiner)", "timestamp": 1745674388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674388, "uuid": "a8178040-5fcb-47cd-b0b9-2a4258e6fdbe", "comment": "Malware payload (CoinMiner)", "value": "024dd77c38676e6ce0a5a2201f6145de", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674388, "uuid": "4f4543ea-7a81-4750-a47b-f75285958317", "comment": "Malware payload (CoinMiner)", "value": "b4553ff5d7ae98614d4856de134f49e503f046a15fc49033af3232fbeab9ed4c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674388, "uuid": "e7014459-0426-4fdb-b4c6-d33314107716", "value": "T149C53345519B46BBC16FE87DCD429FBA901FB977038702DBB8ABC32535B00ED18386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674388, "uuid": "93356bc9-e5de-4657-a891-94b2b5238f81", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674388, "uuid": "f9a08c37-49fa-4b52-a1a7-f58f3d2d518c", "value": "49152:lVVsElKKUleJO2fIRxEj2L4IGJ8Bxg5UFnbCZNZRMHc7G2C0:jauF96L5o+3OUFnbCZXC8vC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674388, "uuid": "f6da07cb-4b12-40de-96ca-7fe8309fd70e", "value": 2620928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674388, "uuid": "366261f0-4d07-43d3-bc87-51a2434def64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9aa33f-22a3-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674490, "uuid": "7deebebe-24b8-4e4c-b234-c6c8def41173", "comment": "Malware payload", "value": "5d6fccfdfa050d4d90caef84300276f4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674490, "uuid": "74a9cb67-5bd2-4fa3-b636-ea491e9b80ca", "comment": "Malware payload", "value": "ccb6ac4c2ea06490d1f7b51a31297ccb9a89af87350cbd5112690d80d0905dc6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674490, "uuid": "1d57763f-b712-4e58-913a-4f2760d337c0", "value": "T1608533AADD305F32D21FD73612AA79384A9E49062FB0D5A303405CBD9C13E5877BAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674490, "uuid": "d1da6bbe-608a-4563-a87d-bd25c2a5503a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674490, "uuid": "56c55c58-babc-47d4-b028-4cc97b1b5de7", "value": "49152:VwTkGlX3BhHDi4wCmUE6KX0P1fp+l4Bs:VwTkOXRhjaCFHui1f4os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674490, "uuid": "24e01b01-c458-4e90-9e95-39f7d06ab390", "value": 1860608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674490, "uuid": "5bd2ccd6-94c0-4033-b712-1ab657ecac34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831d8f7f-22a3-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745674612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674612, "uuid": "ad30030c-d8e6-4b4a-a0bf-c259e5509a85", "comment": "Malware payload (CredentialFlusher)", "value": "57da029c166ea107770adab5cd7433fb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674612, "uuid": "45319f00-28e7-43e0-a4c6-d91d21696469", "comment": "Malware payload (CredentialFlusher)", "value": "0c2be5a02b312f7166514b03f6c40b66bb23724b644d97e745014647daf4bcbd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674612, "uuid": "1aef3347-42c8-4fa7-b07f-a398009f4775", "value": "T14AA5331BE2E68812D96857B01EF702C31630BE914E785743325BAC5919B3B61E6BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674612, "uuid": "3d7ab393-77a1-49ae-ac4f-865c9d2a730b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674612, "uuid": "89c1c8e9-ad10-4af6-98b2-dafc0254e2fc", "value": "49152:q075CRV6mhb1zgRV4mxcGbsMtnY3Z5VuA6T7qRZSCoJs+oEIAB+gEe6:UV6ebSVK2sMtYMTe+Vs+o/2t6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674612, "uuid": "846d1220-1894-4ddb-93ea-d5ef3c048705", "value": 2167296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674612, "uuid": "816ae259-8d1a-4494-9412-9c36090e1e5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bd4677-22a3-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674636, "uuid": "1fae0316-db6f-4cad-9389-40598e86c643", "comment": "Malware payload (Mirai)", "value": "9c0e5b3efb445ce00357b07bcde0f28a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674636, "uuid": "9e9873ea-d5f1-407b-b9de-1d2a3ed35707", "comment": "Malware payload (Mirai)", "value": "5f7a5a1a7d7beeb46e02e5a1fe4cdb2bca27ca8277da930a4077257d062e3b16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674636, "uuid": "939b5557-875e-46d9-b4ed-2a3a9b0635fa", "value": "T130432921B63A1F17C0D4A47D21FB4B19B2A15ADE25A4C64E7D720F4FFF11A806A42D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674636, "uuid": "b5ac6ee8-8449-42c8-bdf0-d5701ad8e20d", "value": "768:f7o4lmFG4GayEc5gs+u17hUW4RZycISnI+TF6rQ8Z0tHG2SU5O+32kwL:f7pmFG4PyEcu67UW4RZycRI+TF6sZML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674636, "uuid": "c571fea2-c8b5-4496-aeb6-a85fad94efbb", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674636, "uuid": "26bd4168-674b-447b-91fd-fd326d143186", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4bd20e-22a3-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674678, "uuid": "3751e877-6528-404e-be41-4db7482bf27e", "comment": "Malware payload (Mirai)", "value": "c0cbf1e37ff6cb2721be593c63793fe2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674678, "uuid": "30cc8b3e-4288-4c8e-acc3-6bea0e965fec", "comment": "Malware payload (Mirai)", "value": "665277406e4e8201916060ecd68997fc96de08b0f681895407f4cc3a44e86a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674678, "uuid": "31c180e1-97f9-4261-a269-f6f2d153cd94", "value": "T1F3A2D0B1E4C18D93CBFD9EBA56D5C0C22B943359B363CDD36291DF628D2E451E2049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674678, "uuid": "320c277a-b6f0-47dd-a88f-fb37ea23bdc3", "value": "384:Fblgig88Av5CHgx8LtyvG6Pl9/erfjPXOAf6wOb002QAkAibhS841M4uVcqgw05i:jgqUgxq6V/kjPXO05Q+i1F4uVcqgw09O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674678, "uuid": "752a412a-8347-4bb4-9e9f-bd3b9784d486", "value": 22264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674678, "uuid": "75984d62-3631-43a6-af39-de5b7ea70823", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4fce66-21c0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "c49e075c-7ba7-45ec-adc9-c737a2ce8e32", "comment": "Malware payload (Mirai)", "value": "0952b6f53703c7421f3ce15236e2166b", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "49b94e93-3adc-4fa8-ba05-2bbc88888461", "comment": "Malware payload (Mirai)", "value": "9641f2a7d7ec8a4e03db9a6e725d87d1019fc856e6b2ec17d6412b9baa5646ff", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "fb13e5c4-0b9e-4122-b7f0-d55e2c496fc3", "value": "T10AE32945FC54573BC2E23BFBF79A82CE372A5754979733215A291EB02BC178D1E2A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "46e9fe45-b77d-4583-b06e-758ac99c7608", "value": "3072:2H967Hnp9QNSgfJ7ORfgGbJU/huDfZTR2S6AGeAaochm2OVKgvYlqijhH/uD36I:2HyzbJ3DRd2vAGeG4gvYlqijhfuD36I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674745, "uuid": "aecdab2f-8f96-487e-be62-8b5242780a71", "value": 149946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "c812fc5d-a21c-45c1-ad1f-6de716d13027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee59dc2-21bd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "14ca5fa4-2287-4eb3-b0b3-61776dba4932", "comment": "Malware payload (Mirai)", "value": "cd56abae03d0994bfb5f999ab0b25562", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "e4a57bfa-de7a-4161-8bcf-75fd67494fe3", "comment": "Malware payload (Mirai)", "value": "a213378cf2dd71813c71729ecd337e110a258cc364bad6f6cde3ab5e78b35373", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "6c969792-05eb-4b15-ac10-79641004d428", "value": "T101D33A4788A28F77C0566EB629BB5534075AF9230B4F0BD664386BF4474F9CEB10EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "e2fc4d87-8b1f-44a9-ac72-8bab3a2b176b", "value": "3072:gugADH6evqLWi1TwvBNs9ZEhP8wbP0y6oAVBWvg3nD2w+//Tp64:JnDH8LWla9490yxAVovg3nD2wo/Tp64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674745, "uuid": "50f65229-d56b-45e1-aeb9-3f81275a42fd", "value": 135098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "17e75c78-a76e-434e-a813-a06e78bd0046", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1175c782-21c0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "ebb26b93-ebc3-473b-9af2-2e0d2de06aae", "comment": "Malware payload (Mirai)", "value": "59aee8fbb0731d4f8dab5874671c0b85", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "3b7c29b1-3058-426b-b2d2-c51ecfb04b18", "comment": "Malware payload (Mirai)", "value": "c3fc5bc9b0d419a7c98a7b73138faaf4e48d7afc7769cd2b5538e8bf0eed2795", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "57fdc37c-796d-4d44-ad5b-71fdb581946b", "value": "T1D2E33945FC54973BC2E23BFBF79A43CE372A4B54979733215A296EB02BC17891E291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "2ef99899-ac43-422a-bb1c-496ed0b3e3ec", "value": "3072:589jW7np9QNSgfJ7ORCnZXtpSSfNQRpbGnAqgeGoVmhXgBu7B6AvnGr0fYpHJDRf:58AEXtTfSfbeAqge5FAvnGr0fYZJDRyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674745, "uuid": "f1fdb388-8761-49ca-8c66-5cfdaabb674e", "value": 156820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "ebd2cfca-32c7-4b64-8f8b-fcb99047f50f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef69f007-21be-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "bf32ee49-321c-40a4-acac-bf4a9dd07045", "comment": "Malware payload (Mirai)", "value": "ba429082f24621e30d07a21a8214e678", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "e8ffced5-f4d6-463f-ba18-d7702ddb96f6", "comment": "Malware payload (Mirai)", "value": "d8e7c60126b643fa4aa06267082af60aa2bd7cfa4a5f8852e95ea9b06fcf5122", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "5537dec2-827b-46e0-922f-5640e39038fd", "value": "T13DD33A13B5D2CDFFC4A296F50BDBD2659963F4390B3A225733A47D6A3F0E9881D292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "8886a908-5255-4855-9396-9bde0d58fb93", "value": "3072:gSTeSJBWCeETuzREnUJYCGa+LXMr0BDjjv1FjP3+9/NJMHI:1fDnV1M4Njjv1FjP3+JNJMHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674745, "uuid": "13b79bb6-46aa-4db3-adc6-7f127f2f188a", "value": 141844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "1dc76e21-79fb-4503-80db-5aa5caff9077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731db3b6-21be-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "11b8a636-62f7-4db0-a577-35ac79cff490", "comment": "Malware payload (Mirai)", "value": "ea421d8cea507d248e4290cde15656b0", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "b19dd6c0-902a-471e-b34b-9e6167ec572e", "comment": "Malware payload (Mirai)", "value": "e9b0faf4c3bb6ecb481c799190bad5e786d64dba71ebc2fe085d14f04df312ce", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "5bb57cf1-d07d-4563-935b-7f1bb6f49c60", "value": "T12FE32A3B27231E33C5D1287102E70331B6BAD759387A57DBB9C46C6C2F1AA84351A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "e0f3bbf9-9882-4a77-9991-aabafa847a64", "value": "3072:RGik/WtWTx06t998yY9r9xgpXxhv7wg1KGvOWfDl49/1TZGI:R8/nTxLtjKfYXxBbKGvOWfDl4J1TZGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674745, "uuid": "6235baa3-29d1-40d2-8a26-2ca7fa37fadd", "value": 154510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "0458d6b9-66ac-4d8b-9c8b-1788768f9e38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3718814-21c1-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "5e375cf4-998f-4f0e-a7ab-e1c146911ef1", "comment": "Malware payload (Mirai)", "value": "237a725090d66f8c4c55c17f37c725b7", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "c85b9156-9936-4196-b856-8fa44d9bce6c", "comment": "Malware payload (Mirai)", "value": "10ea2ca74bc3fa9ea73092bdd55805d19fb908a06e5f841492c15f99125de063", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "cd4e3547-d406-469b-9209-88c6fb3e34b5", "value": "T15404952A7E21BFBEE26886310BF35F70839921D326E18742E27CDA585F7128D185F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "11ecc5e1-04c5-4567-895d-d0a5660f37f5", "value": "3072:eq2sptDOhAdMiwp7ndg+P8DQpGuvGFHgSLER9JteI:uCtDOeu5xa+0VuvGFHgSLEXJteI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674745, "uuid": "651a585f-1ff2-4f97-84a1-9b046b1708a4", "value": 188019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "8387393e-8e40-4c3c-8b64-08e621eeacf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5a8871-21be-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "840a29c5-38e2-48b1-b99f-54e2d929a7b7", "comment": "Malware payload (Mirai)", "value": "a940d7ce0b385596d657b9b5c064d38d", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "85e0def6-78c9-46f1-8fb5-75c0f31bb4c0", "comment": "Malware payload (Mirai)", "value": "8d2d889dfde2ed0e6352204f707f3e966e6d4161215f081aea6b36487554eea8", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "cde3dd1e-5a2e-43b6-be94-61803db8b875", "value": "T130D35B9BAB0C1767C1BB19F52DB727F08BADF9A115A621C4A40DFFC40332A74251AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "62fdf885-6172-420a-999c-d919fc85cca0", "value": "3072:2PiyV+t/S6mhStm8dwn+8lBcnvvWnDf4urTpzI:2PVV+t/S1hUQ+8lenvvWnDf4urTpzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674745, "uuid": "7030f48a-4564-4dab-bcf6-0d4f0caede75", "value": 142996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674745, "uuid": "9d1962e0-0466-4088-a76a-e760ca25f8fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31c385f-22a3-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674746, "uuid": "1ae3bf7f-77e9-45ca-83ef-c071e1573a1d", "comment": "Malware payload (Mirai)", "value": "7eb29fcef96a5c5eeaeb2e85726ce396", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674746, "uuid": "60f80a9a-0380-46da-856d-99874b4ef4d5", "comment": "Malware payload (Mirai)", "value": "4fc702acba52b2d2ec76df85df28265719d078ead96a0be4b282878de3b5b5c1", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674746, "uuid": "d461e690-16ba-4acf-8481-770a2b671189", "value": "T1C5835A85A3A2C5B3C4872B3501A3E7731970F8E61B6DDA12E36CEEF46D035C5708A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674746, "uuid": "b4aa345b-c044-4d3b-ba55-64f590c4a9d3", "value": "1536:DyHvmjpJnQRfzV63ypZzwrSo1Fo0cSwly1OFw0:kmVJnz4y7FN0ly1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674746, "uuid": "11d553a1-bd85-4b3d-b451-6f2472c5802a", "value": 88747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674746, "uuid": "6c352b42-4136-4b1a-a8d9-e292c69ba1a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ab4e20-21bd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674804, "uuid": "2b9cfa14-e4bb-4e1a-b6fa-dcf6a16b1223", "comment": "Malware payload (Mirai)", "value": "7da9850bf6bc0b50ea9a8c24ffdb901f", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674804, "uuid": "a8fbe7bb-ad3b-4bf4-b4d4-d688d9ee4408", "comment": "Malware payload (Mirai)", "value": "547cf901ee006c6871d41872ee8a9dcb9de4b9374a73c435fd1fa980a0e49638", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674804, "uuid": "ce591caa-06b8-4758-a35d-dfbef3ba1a2f", "value": "T101C35CC3E780D6B3D1930AF602A79B140271E8371A5BCE94F35C7CB49A19689F7266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674804, "uuid": "8bea92a1-b525-486a-99e9-9cdfe31d9a88", "value": "3072:myjUMIz4+m4UJB1XuFEhQsZj7V9b2WgARR2v69ny6JP/KTiFi:mEa4+mPXvhQ8j7j2zv69ny6JHKTiFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674804, "uuid": "d7e18090-53c2-45cb-84dd-f02d6771ff98", "value": 120254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674804, "uuid": "68f0ce25-92a5-408f-8fcc-71796d167e26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17adeae4-21be-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674804, "uuid": "768d8dc4-7719-4719-bbd4-54025da54078", "comment": "Malware payload (Mirai)", "value": "5afe02e7a0d1a250621d8005f95233ed", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674804, "uuid": "34c96b32-5792-4174-8ab7-b22ff1768037", "comment": "Malware payload (Mirai)", "value": "3b4ddbe8ad3b643463f0ae4e3335789d1e8700156826ea3004365e7acfde8db4", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674804, "uuid": "2a980972-4f3e-463b-82ba-481a0a044f7b", "value": "T139E32B83FD00DE76F40A967605D74B29B370AB624E531A72631B3A6ADE372C4381BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674804, "uuid": "717d75bd-5578-4049-b289-73ebf10883af", "value": "3072:l66fZBBPzT9Sy9qzjvcu5CiWmgUe4ST2DvKWnDf49/1TpPI:l66fZLz8y9sjvcu3WieyDvKWnDf4J1TC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674804, "uuid": "cc2fa287-88aa-4c78-a7a1-5eaf886c3e73", "value": 147719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674804, "uuid": "e49ea819-24ed-444a-8d7d-b5e7c8271005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4258b6b5-21bf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "e61ef8e3-a474-4fab-8ac9-05cc22f971fa", "comment": "Malware payload (Mirai)", "value": "80dd0dc8ac552b41a314dbd9bd799d0b", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "cd7597e6-71bc-40af-93fb-49b6ae43b0df", "comment": "Malware payload (Mirai)", "value": "567dd99554ddb51e96c51c72f1c1ba523d2b14cd460f8b3b505719b2772d689b", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674805, "uuid": "ddf7ab82-5271-4491-9b44-01c4e32bf428", "value": "T195F33A05D9509737C1E32BFBF76A828E33271B64A78B33255A286BB41BC1B9D1E3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674805, "uuid": "e4b40a52-017c-4e49-a406-113d89cc13fe", "value": "3072:ciAWK1ji/bdZZAYieL31hla5SffZYYFlFOEPPn2PEAmP/KbCg1MruVMlsmyX98RD:c+31jaoffr9O82fmP/KXMaMmmyX98RZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674805, "uuid": "182d5429-f216-44b3-8a8c-af0e7811b587", "value": 167682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674805, "uuid": "63bb27fc-1f90-43cf-8c30-ef083d693291", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1767de55-21c1-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "89977887-1ee0-41ef-8be2-76629670a336", "comment": "Malware payload (Mirai)", "value": "382f50aa1fd2d3832b782a0a0fc9ada0", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "faf82fdb-5a21-4f78-b27e-75d265fe9097", "comment": "Malware payload (Mirai)", "value": "973fe326b4f45ff036f0e81739ba0cef5877c16f4283fc3a9da0ea5ff2d7b606", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674805, "uuid": "65d37723-b702-451b-9216-0658ae3c22f0", "value": "T115243B09DA509B67C1E33BFBF79B828A33234754A797331945285BF03BC2B9D5E261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674805, "uuid": "efcf55f0-3562-4a22-9fcd-df35e976a3cd", "value": "6144:puv3avqkWauPn0LQS8MnDe/OoDt+M/9Gmr2nBPNg2:8v3av+auPn0LdjnK/LP/omr2nBPNg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674805, "uuid": "8e26a15a-5325-41d4-a440-10560bf6efe3", "value": 211140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674805, "uuid": "9b995a5a-41e4-4c23-b327-d12ebc8df24b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f648a157-22a3-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "27f92758-1364-4c19-8d8b-96ee485f4ea8", "comment": "Malware payload", "value": "d013d026e061b50dfd64e98eda1b0a63", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "746fdefb-38d2-4291-b4d1-12da2deca937", "comment": "Malware payload", "value": "f249411dec3c14a6d9b98265f415b666648b6f73bd36d02b0ca3d00782a7fd45", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674805, "uuid": "b51e1e49-346c-4da7-82a3-f817136e538c", "value": "T19A315EDB31B509746CA1E86B32F94C007EDDD5DF18CAAF9969ED74E540CEE08A0097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674805, "uuid": "0f3a7450-c865-46f6-8008-3e4f00ce54c7", "value": "24:1tEftuvtutztBytBEtlstxUtDSwHRYtE6HattMtBUtPd8teW:1mfcUNtByQ/s/U1+C6Hac4skW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674805, "uuid": "7a531a66-c8c2-48df-b59e-26710b51b1e0", "value": 1666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674805, "uuid": "1f61a8d1-669c-4891-80de-d300b523e3fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c01cab3-81b9-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "2e20efaf-d472-4de6-ba1a-8ec6bdcc4c43", "comment": "Malware payload", "value": "c042782226565f89ce3954489075e516", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "2085fa7d-6a1a-489b-9e83-fa5d0323aeed", "comment": "Malware payload", "value": "a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "2b6b17a2-d3ca-44a8-9e19-88db7f4721bb", "value": "T184D1E64677E80676E6BE0F38A837031101B5FE459CA3CB9E59C41159AD72684CB72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "7fe39aa9-5bc9-4fb9-91f2-c82e607de05a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "f2bf2ea3-c399-4384-acce-2751c5993925", "value": "96:KR0JUnFk9YV0Y9btrzxSC6+1lcBrs4VvlrljlQ0ljhFEuxlSRjbumOLzNt:p396VLSN2GQEvlrljlQ0lj3lMHON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674869, "uuid": "540f8391-f4d2-4f34-a838-5e9b84bb55d1", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "7c2b22a2-3a4a-40ab-a461-af158ec8f664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418077fa-5bdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "a76345cd-9881-4e13-88ee-1a4689c96d2e", "comment": "Malware payload (RedLineStealer)", "value": "46aa8f5fe3d5af96f0a970a8f4df625d", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "996f12a4-2d52-4f1d-b687-ed5648b400b9", "comment": "Malware payload (RedLineStealer)", "value": "b2a54962c45f5dbd7af447a5ab4cf8cea752f8c667d4dc504e1834da94ac4514", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "2eabf8e1-fae2-445a-9fba-7e66bd8816d8", "value": "T1CCA35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC154E61FA7B866957E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "b2924c07-a673-4d00-9737-2a9fec755fa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "7c5247ac-b081-4d2a-b557-3560c3f8337b", "value": "1536:9qs8XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2ytmulgS6pY:ragzWHY3+zi0ZbYe1g0ujyzduY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674869, "uuid": "748ff319-78e2-4325-87b5-f8ee37965a60", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "28b1bd8a-f58a-457f-abe5-a73b6b269eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ec9838-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload (Smoke Loader)", "timestamp": 1745674869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "0e2aee82-0d64-4709-b636-b68b3e2c6737", "comment": "Malware payload (Smoke Loader)", "value": "789f1016740449ce3e9a7fe210383460", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#e04b0e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "dedb3918-7c5d-4768-855a-9d2831535281", "comment": "Malware payload (Smoke Loader)", "value": "71068065d8dd7daa9c49687b973d05d5602ed994467728763d2213fe4d90c0d8", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#e04b0e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "5b65b26b-5530-405e-a3df-8b1c4ee76457", "value": "T1E752BFD55B41CC1BCB7DFFB9E9788E31D169AE4D27C2C2629F07C82524910B4860BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "be4193ec-9d42-4406-bde7-a5e8cece58b0", "value": "192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4OtwO:JAnLAXNy/m3/bTKwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674869, "uuid": "c1620413-f006-4db5-a6b6-4ecbcf531bc8", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "2d1ac184-67c1-47f7-babd-2df86b06eb5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac517c15-8983-11ef-afe5-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1745674869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "81c9a5ea-3558-43ba-a825-07feef544db0", "comment": "Malware payload (AsyncRAT)", "value": "3296704171fe01c0fc4fcdd02f2695ca", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "727408f5-96ec-46bf-814d-45bb991b9c63", "comment": "Malware payload (AsyncRAT)", "value": "b8c65f4588d2d9b76823e7ad22b71a3717792a505a4048314cb2ccba9a976e26", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "a897a0a5-6578-4db0-ab47-5e3ceaed9015", "value": "T1B7536B2877A94529E1FFAFF25DF17216D73AB2271803976F34C9428A0613E89CE412", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "9215ee28-58ce-4bce-9d57-ccb4eb202d11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "4aab619e-a412-4fed-a6ff-4749c2dfeb02", "value": "1536:5Y+sUM6h2S7Uv/ecC4Q5tUWTbbIqml1gd6VOnuhQvxU5AZXep:Xh2S7qWckDTbsdmaOuhyeaOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674869, "uuid": "02a7b537-9f98-4ea2-813f-607ebc3e7a74", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674869, "uuid": "b1c53aeb-0a8d-4d5e-b5b4-393fd459a304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8eeadc-4cda-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "52a9b3c5-c89c-48eb-8c12-878f1866dcc3", "comment": "Malware payload (RedLineStealer)", "value": "b3342d61145ef64d216fd5cbc36c7e20", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "c906bba1-405a-4a65-a8f4-b4a40244b51f", "comment": "Malware payload (RedLineStealer)", "value": "c6e60d86605f4ca71680245aded21b05f6306e5c52ace4a5efec28e14f36db5f", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "d75f751f-dfd8-4c6f-a4ce-2624444e41e4", "value": "T114646D1823EC8911E3BF477998B1D2749374ED26A552E30F4ED06CAB3E72741FA11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "7cea61b5-707d-41f4-be8f-0c769beee9bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "c107aa5d-4c34-404a-8e0c-92306309c4de", "value": "3072:aq6EgY6iwrUjsgMmwPPhvnvaaOTHAaibwTA5tASKYFcZqf7D34teqiOLibBOn:ZqY6inwPhKibwTA/ACFcZqf7DIXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674870, "uuid": "aad811f0-0a8a-41d0-a39e-096077fbf5f5", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "7980e9ce-908f-44a4-9009-4c690af5648a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c965c40-81b9-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "f4f41111-649c-4b34-88ee-9ff062426825", "comment": "Malware payload (LummaStealer)", "value": "ee4d5bd9f92faca11d441676ceddcec9", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "e770e55b-566f-4a23-afde-559eeafd6b3d", "comment": "Malware payload (LummaStealer)", "value": "d6872d521e977683f9fbf54b80e2a218aec4f0ae9caaa233ca9797f16c37b4d4", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "1a94a408-1a16-4fd5-a845-da3a223467e5", "value": "T16BA43974EB80F908DC9E43F4A6E77E56674580C94321083B6B0C5EB10A6734B9EDF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "7d29152d-25a2-4bfc-be4f-4591d51a42b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "42b92d0e-424a-4545-9676-46848d5985f8", "value": "12288:vghWNZ1zz4AxWtCfoPiVrCVe80BupSNcBCpzT:vkW9zP2Q7uVebupSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674870, "uuid": "faae2bc6-a950-4d83-82b1-c86072ad6366", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "672d84bb-a6a4-4dce-a2df-df46baa3b534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c2bdbfb-81b9-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "cac9411b-62b0-4d63-bae4-2be8fdda28fc", "comment": "Malware payload (RedLineStealer)", "value": "58e8b2eb19704c5a59350d4ff92e5ab6", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "24be88c3-7a66-4ce8-ae45-d08396bc4ad0", "comment": "Malware payload (RedLineStealer)", "value": "07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "8519b57b-6ae7-4bad-bb45-e4a32c496b42", "value": "T114646D1823EC9511E37F4B7998B1E6749375EC16A852D31F4EC06CAB3E32741FA11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "754d2883-7e75-45a7-9364-6c8bdad4015e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "a9167286-f448-4a3f-a000-309cb6eadd2d", "value": "3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674870, "uuid": "d202172f-59fa-401d-8bcf-3d70ed3e7f87", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "d7e5d6fd-a80f-4b4e-88b0-92b7969c6ece", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25d91cf-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "d690045a-9d69-4361-995a-c0be33dd0a8e", "comment": "Malware payload", "value": "a896758e32aa41a6b5f04ed92fe87a6c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "361c11f1-45a2-4f6c-97a1-e92724e87f94", "comment": "Malware payload", "value": "7664288e924fecf085d750dbd40c405bd0dbc9d1ed662c5ecf79c636976e867c", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "1ec2429d-90b5-49b4-9ac0-55df11e0a5ba", "value": "T1C0843E2827D8FB51C96493B233E7935153F84CAE9271621F5E687AB07FE14F4BB064", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "3cb8ac4b-785e-452d-b59f-73302f8b29cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "0da2223f-0bba-4e2d-84ff-803803cb6ae0", "value": "6144:n4x2omkD2YDufsNn3+86ZrhlHotCv0eVarvj8ufNdPBP423UOXHWpvkpDDEbvCmX:1ID2X6o1VAjh2l4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674870, "uuid": "9a5854ad-1a88-41c8-a612-ec489602af44", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "12259714-3ce7-41c2-9143-99e359c9b457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e28a242-5649-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "46715fad-713d-42b9-b4a4-eb70bbc540fa", "comment": "Malware payload (RedLineStealer)", "value": "913bdfccaaed0a1ed80d2c52e5f5d7c3", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "c8dcc750-8238-4c02-8d05-b12b8910f42a", "comment": "Malware payload (RedLineStealer)", "value": "93e66ad3eea5b3217d9a016cb96951ab2dd0ae3f3ef6c2782667abacaaa8018f", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "2fa275aa-0b6d-4cfa-b00a-4fad000a9d8b", "value": "T157C49D81B359AD12DA6B06F6900518A01E71FF79E90BC71AAEC77FBF7EB232151118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "996326f6-aebb-4ca4-9c39-dfe8bfae18bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "4ff64fea-a4d5-4a4d-80b4-601d1d782351", "value": "6144:EYqdc0NkzDV4L3eTIlA414pcN3p0NIb88WsNMPaKFP3b2V122J0sL:E9J8+jP4cN3CNIb88WsNMP5F1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674870, "uuid": "f25be1c8-4661-408d-a00b-58186cd79518", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "57f80c62-3b4a-4368-bdfd-9731012be808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8167cee7-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1745674870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "bb77bb7e-091e-42c6-9ce9-5d74f5e168da", "comment": "Malware payload (AsyncRAT)", "value": "3bcf37b4d029d825d91a9295a1365eab", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "5da99977-3de0-4c8a-86f2-689f24d50622", "comment": "Malware payload (AsyncRAT)", "value": "a08ee121eaa50ed3597411cc1a3ed71096b3b4a344604da6d639cd2cce506d31", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "e68468ef-82fe-4358-b029-780474b865d9", "value": "T130350D2029FB601DEA33EFA55FD8B4EFDA5AF223290AA1AB105107074F12F51DD527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "9aac78cd-e9d1-4541-8c16-08669ac5e7e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "0fa111a2-8e1d-459b-b7be-b2dab40b0141", "value": "12288:EtSkCZdm7DchpXf0e1hEmwur2Gk/hlYaVLaPUNH64NmgbVh4+snSIHZwy90S2TLo:EtSo7IeKHB0pbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674870, "uuid": "46e215f5-e829-4b9e-9e98-cc1c4f676471", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "2b25a268-289b-4491-a0ee-692f5e4b84b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22ce7b1-8506-11ef-afe5-82aee05be84a", "comment": "Malware payload (ZharkBot)", "timestamp": 1745674870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "7c14bc0a-8f2c-4bf1-8076-2e1911a73063", "comment": "Malware payload (ZharkBot)", "value": "3663c34a774b45d65edb817e27dcbdae", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "d8705dea-9f44-41c8-a90f-010da779cfc5", "comment": "Malware payload (ZharkBot)", "value": "f203e00cfa3c0ff98670d56ace48c0ee7bf1a997309a8da1379d5291cbe37c3d", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "ebddb53e-dcbb-4fdf-be1e-57b74b798334", "value": "T104648E11B681D432D9A214306B3CABB59A7DEE304F5417FBB3D40D6BAE602C19B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "c17a71b1-8d5e-48dc-b904-1d38a496ae64", "value": "86066554454deea625edb22af31c51bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "8cba3f11-717c-4aad-9abc-9a27b9fc0561", "value": "6144:Uypo5x1dkBovN2s0GGDwmW9pLbLGou5YLQRjpj3xm3Z9F+MEuMBoSVGLJnt2QE92:Uypo5eBovNguMGSVGLM7uXjazj6AE+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674870, "uuid": "96f0ef5c-9592-4338-9b9c-53db27bc92da", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "2e679472-dfef-4e67-bbaf-0621a1835ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5835f10b-5bfa-11ef-ac1d-82aee05be84a", "comment": "Malware payload (NanoCore)", "timestamp": 1745674870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1e266917-2bf6-4aec-8fa9-3f062cd9bfb1", "comment": "Malware payload (NanoCore)", "value": "06a9fb51c5455ef7c06cdad4f015c96b", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#d0f361", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "4a6ac778-2929-48d4-afba-b2fc9bee4460", "comment": "Malware payload (NanoCore)", "value": "ce3ae4549b58a5304de4c262ac272aa5da715b63edd796de299c861330a4a8d6", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#d0f361", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "28883c3a-ae5f-4f83-b885-9309d67f93e8", "value": "T101C4021637A4892FE69E85F8751241128338C3D7A9C3F3EE68D455B6DB227E60B071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "f8969fad-70cf-45cd-be9d-f3073f582ede", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "ed05f6d4-75ab-4caf-86bf-96b3638d85f7", "value": "12288:WLV6BtpmkL0GKD8wMSrbwlrVdUnBRO+KcXrWelWyk+kOTo5:EApfL0GKD8wMS/GdUnXocxlPk+kn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674870, "uuid": "b6918b10-8a73-4bae-8f4b-121f3dd15766", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "86aa10b6-3eb6-4765-af21-adf8658cd9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34908f8d-52e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload (AgentTesla)", "timestamp": 1745674870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "60b48161-a3ff-420a-a51d-0f80a60bdf98", "comment": "Malware payload (AgentTesla)", "value": "ee38099063901e55eddc5d359f1b188a", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "16e5abb0-3925-428b-bc0d-cb9a693d9f80", "comment": "Malware payload (AgentTesla)", "value": "16b4a4092e2e158ee058cc4daa69f61829872de92cc1167a0094cded388a5e48", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "2c2289c9-9778-4811-83c0-8cd28addc5dc", "value": "T135C4DADC766072DFC86BD4729AA82CA8EB5174BB931F5213902719EDDA4C897CF140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "d00dc58d-4af9-47e2-a000-0d0d13dd19dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "03f145fc-c0db-4788-abd0-cb0014993b71", "value": "12288:7DcioiZ6mOvjWLRuZd7r8rqSpP/nDEFX8zijt+t8RBUamqDZPuXCnzdD/F+W7+56:3HvcmVFuXU2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674870, "uuid": "b11759e3-a12d-438d-8ffc-4face28c3116", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674870, "uuid": "88f73e01-30a6-45f7-8618-462e2cccdb6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e355f3-52cb-11ef-ac1d-82aee05be84a", "comment": "Malware payload (ZharkRAT)", "timestamp": 1745674871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "10f4e73f-6c2d-4440-a3b6-935dc8dc32d7", "comment": "Malware payload (ZharkRAT)", "value": "b859d1252109669c1a82b235aaf40932", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "982fffac-55e4-45bf-8829-8fdb0bf02b89", "comment": "Malware payload (ZharkRAT)", "value": "083d9bc8566b22e67b553f9e0b2f3bf6fe292220665dcc2fc10942cdc192125c", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "8d10dfad-1515-44f5-8093-ea81ce9c83e7", "value": "T1ADE42DDC766072DFC86BD4729AA82CA8EB5174BB931B5203902719EDDE4D897CF140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "b790497b-9c90-469e-9477-900cfc8a8dc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "c3eadf74-b67d-41c1-87ec-93387252c2d3", "value": "12288:lht5Z3o/mPatX0hz6hWIShEYZUuWygFYK1hsHyLMLH/KweErse7K4m6o/OGSew/X:lht5Z3oCadeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674871, "uuid": "5a5b410f-2c93-4f80-a697-3341eee4dc4a", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "12b4213f-a403-4409-bfd6-b72b5e6a4179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc51cfb-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "9257f2a9-c4d6-420a-8c16-15008481d4d3", "comment": "Malware payload", "value": "0940599cefe789664d6a032a27b25b73", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "dae1e050-9809-4bb7-a56c-14903259ec34", "comment": "Malware payload", "value": "ed42c5f70c10694c1376f330cfbdcee52b72aed3b7eb25debcc1b2ba613c0922", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "62c4088e-394b-4281-99ea-dc1df21e88b1", "value": "T1F4E42343F9CB565AC85A0ABCD4A7202903F2D3976773C2573D88AD560F4778ACF6AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "8a23e349-06f6-4f1f-a444-bcbf4fc63f36", "value": "12288:WvmxKmsWF3S2ZBcrFzMkjkbR6qLy1O6DZ3percyufjK8XRsvXTSgof3gfq4k7I0Y:WvCKmsWFi2ZBcr9rjkF6qmwIZ3/yv8Xa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674871, "uuid": "2420eaeb-e149-4179-8cb2-3a15c5bd2522", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "33fe48de-9cb5-46d5-84a1-a20a1c8da486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b147b8-4fba-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745674871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "86cd8168-e067-48f6-b9f1-b799672e883c", "comment": "Malware payload (Stealc)", "value": "607c413d4698582cc147d0f0d8ce5ef1", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "223a010f-d624-4589-aeb1-a5fe3a48a48a", "comment": "Malware payload (Stealc)", "value": "46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "bb6e60fb-f8ea-47e0-a4a0-246c29e86134", "value": "T17194E11175C1C472DA23253309E4D7BA6A7EF9704EB09E9BA7980F7FDF702C182216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "a052fe81-4bc6-47bc-ab80-0eef1626255d", "value": "95d4113c25a148a48f2688574ed71076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "16440807-f65c-4852-a018-f34d6440007b", "value": "6144:FmliDzugxTgexyJ4hgIR3oHu5VamKRUuCjdwZOeBSGJfaoZ0HmNKP7gnF/1p0IX:m8bxcextX5UmKRUuyQOeBtJpZ8Cd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674871, "uuid": "6ac92935-149c-4770-9c16-adf1b79b7d23", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "96adc799-589c-4eab-b61a-3d112e50490e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1f92f9-f42f-11ef-a514-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745674871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "3d3d9096-92fb-457e-a8e9-1e1eb1463473", "comment": "Malware payload (Stealc)", "value": "1e95dc10fef7079a5d3fa793732a7cce", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "a23f4e65-268a-4130-a279-aa3c49e31c65", "comment": "Malware payload (Stealc)", "value": "81ac77037e15e56a6cdc0ba7e2af38e3e5a9f7a353054276c763e57d03db5ec1", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "19b7e0eb-add0-48bc-b5f5-8d9e350f043c", "value": "T1E885339B8860B317D7E88933D8DA1FDFC3010B16046E1A2C3DC85967DACC1DA6E6F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "b68d9e42-3f98-4d61-a706-06deedd21a22", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "6622af9d-87a4-4345-8dbc-b0694f47913a", "value": "49152:QShNR7nL8ZBF9CuDe7VL4a1PzDaisxBU0Su1bJX+:HR74ZoMeJL4aZXai+BxSu1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674871, "uuid": "620ace87-ad43-4c4e-a8c9-68dde1dac41f", "value": 1833472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674871, "uuid": "39a7ce5d-6958-4514-bc4f-d61b229ee3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7f7cd7-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674872, "uuid": "8cb92ffd-7662-4b3e-9e1e-9798bbd66a5b", "comment": "Malware payload", "value": "e30340895091ee6f449576966e8448fb", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674872, "uuid": "d0afbc35-f0c9-4c7d-95ea-35c65d3947e6", "comment": "Malware payload", "value": "126d9d9886f57e39642744a8bf62681577fbee52b88fba4c4c5097b04501eade", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "5674e8ea-82d1-4a27-af1a-7536f576ecb9", "value": "T15795AF27209462D9F7E5B27BC004597AF1BEB47117728AD78620E6E71B172C24F3AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "2cea5e55-816f-44ce-8631-95cc8fbf4e07", "value": "ac680ec779f69343272e88a1921ccb81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "23e61d55-85ff-4ea3-bfb1-5e7fb84ad34e", "value": "24576:BfJVlyxXr5MtIBFtAhZtTw48F1Cu1btaPMLzYxTv+igZGtGcGGd7+:PEXr5o9e1Y+4Zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674872, "uuid": "067592b8-b405-4111-8013-1be21e1f961b", "value": 1968128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "76535064-e890-473e-abd7-cafe15d92161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d70002-4b30-11ef-ac1d-82aee05be84a", "comment": "Malware payload (PureLogStealer)", "timestamp": 1745674872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674872, "uuid": "83d5d34a-242c-42e1-8767-6933b213b04d", "comment": "Malware payload (PureLogStealer)", "value": "55398a65a9d1abb512e943a0d8901cb0", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674872, "uuid": "298af3d2-7e64-4390-b53a-d8d362756ed7", "comment": "Malware payload (PureLogStealer)", "value": "e91ebc7e19b4dec3ce6f2aaf4ee8fb9fb24cba265088781f9845d8a32d1f2948", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "a09f476c-4be4-4f17-b474-554b8f2b998d", "value": "T183C522417AC1A9B1D5732D371679AB20A93DBD101F758EEB63D46E0DDA324C0CA30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "ba83db7d-7274-4521-85cc-8f0aec0c9bfc", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "d45170aa-c645-45d8-9016-7aed40842453", "value": "24576:2TbBv5rUyXV/6WxkHKCy5SMMquMP35maoTz87YHL8IvfjYuK3aslm19MEqaH8XMf:IBJ/myP+872L1735XPu44i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674872, "uuid": "3ef71cbd-eb3d-42f2-ac91-40e0ee6f17f0", "value": 2540512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "06d88741-6a2d-456a-b998-192a13940ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb44ac41-4acc-11ef-ac1d-82aee05be84a", "comment": "Malware payload (SystemBC)", "timestamp": 1745674872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674872, "uuid": "df141673-d1bf-40c0-ace7-3b84a2b328a8", "comment": "Malware payload (SystemBC)", "value": "c02798b26bdaf8e27c1c48ef5de4b2c3", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674872, "uuid": "feabf42f-b75c-4add-b5ee-27e6d710e2db", "comment": "Malware payload (SystemBC)", "value": "af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "02244298-a7f1-4ba8-9b35-948348fc3f71", "value": "T101158E59E7E808F8E077E138E9525916F3B63C0D4370869F13A6556B2F273E09E3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "b88daaae-5219-4cce-b689-ba87d62acd82", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "bd77bcf4-c053-49e1-90b7-09c4c92723db", "value": "24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674872, "uuid": "2a048519-09ae-4cf3-92d6-05844e5027c5", "value": 920382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674872, "uuid": "a5c8ee42-8f44-4e20-9592-4b2a8cd35bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f1188e-62e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1745674873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674873, "uuid": "39e91b67-d5b6-4778-b684-353560f9608f", "comment": "Malware payload (AsyncRAT)", "value": "7f20b668a7680f502780742c8dc28e83", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674873, "uuid": "9dc0e6b5-241a-4b2e-9256-7e07075504d3", "comment": "Malware payload (AsyncRAT)", "value": "9334ce1ad264ddf49a2fe9d1a52d5dd1f16705bf076e2e589a6f85b6cd848bb2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674873, "uuid": "e814303d-3ca6-4c48-9503-bdad0bb32a84", "value": "T1445308053BE9802AF3BF8F7469F2628506F5F5AF2D12D55D1C8410CE0532BC29A52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674873, "uuid": "024930df-5b34-4f69-aed9-1f8b5fcf46d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674873, "uuid": "3679b8b4-6aa0-4f9e-8f78-efd130942de7", "value": "1536:DWqxSnrykLcFlmeA6Zdt/HCiCPEsfnhOjyXbZQG17uMJYfvISLWcx:DWYSrykLBEsfnheyXbZZNuxtXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674873, "uuid": "7efadfb8-2842-4728-bb87-0c6bbfd9c08c", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674873, "uuid": "c58c3a00-3d5f-48e1-97f9-543aad22c766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cbb873-63ca-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674873, "uuid": "33e4f1f2-0ac8-413a-bfec-778b0e3afc48", "comment": "Malware payload", "value": "fa3d03c319a7597712eeff1338dabf92", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "34e60a2403941f29f646ded5f4e79e6f", "colour": "#cff01e", "exportable": true, "hide_tag": false }, { "name": "d2cbd6ff8d1c0fac7ed5ac227a930f94", "colour": "#fb004a", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "fa3d03c319a7597712eeff1338dabf92", "colour": "#238479", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#f7044c", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#1fb927", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674873, "uuid": "613df71f-709e-4a2a-ac8a-640fb89c2b66", "comment": "Malware payload", "value": "a08db4c7b7bacc2bacd1e9a0ac7fbb91306bf83c279582f5ac3570a90e8b0f87", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "34e60a2403941f29f646ded5f4e79e6f", "colour": "#cff01e", "exportable": true, "hide_tag": false }, { "name": "d2cbd6ff8d1c0fac7ed5ac227a930f94", "colour": "#fb004a", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "fa3d03c319a7597712eeff1338dabf92", "colour": "#238479", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#f7044c", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#1fb927", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674873, "uuid": "ed51977a-9943-4c72-88cf-cf0526ecd0df", "value": "T14675720A2B3F4B99D5018CF5A23B1153A9687D1CC01879B5DEC09B467F96F60A4FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674873, "uuid": "79c12bc3-6d56-4539-88cd-c5e7daf28dbc", "value": "fe99e7ecdc5c896e52392c8a198886e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674873, "uuid": "fbac091c-6099-4dca-ae13-e4c52149de30", "value": "24576:ZMN6PENnBBQXf1UCyfGH32hEFS3qWcI6baD8U2ZuLCk4EB:ZM15BBwKjEF3M2A1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674873, "uuid": "7f3941c0-b84d-47e5-a533-aa7f6b481ac6", "value": 1694720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674873, "uuid": "f851d280-49cc-4a45-a0c8-87220126c66b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5a340c-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "e0572196-3be1-4a7d-912c-aefdde516d66", "comment": "Malware payload (Mirai)", "value": "5bb02f9f58eb75f40729ddaa2d696724", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "5e67e13e-301f-41d4-91fa-7319084f38fd", "comment": "Malware payload (Mirai)", "value": "6489805bbc4f5a025ee1c8effb2ab3d681cd585b58f6680de32e888ad9df4cc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "3e041edd-2905-4a3d-a409-8bd97d6aa930", "value": "T1E9A2C06011DA2CB1CB321830D6A5DFC753978FF4E2EE73A122658368BA51146B1BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "49946307-c814-43ef-a588-362d49477afa", "value": "384:o4KVxFah37Z8oDcm8wruANEEt+e98O/qOVFXb+HJp04z54DhymdGUop5haTi:o4Kc7Zn18wrVNRj8pOTb+pq4KDs3Uozp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674874, "uuid": "c889fab1-f26c-4df6-9ee8-b9109eb58c6e", "value": 22216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "04b181ef-67b6-49b5-8675-fa87f81e7757", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41dec78f-5bdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745674874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "c57c2828-fa72-4f31-a39f-0c41e47c4ce5", "comment": "Malware payload (CryptBot)", "value": "2dbdc645b9776239b18f772c30c1a626", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "97b259f7-191f-4754-9fb8-2a21868c9645", "comment": "Malware payload (CryptBot)", "value": "2b92d1c34b7f0278703c98e9fd755e061d0f120eea327996b223dfc65610dfcd", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "f7cdbe23-509c-4ced-a2ea-5ec405d53665", "value": "T1F1C5C73BED0356CCC453B673A9C3AA2BA8246F1C812E992FAD058C25F7556D17C7E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "3567c4d2-09ee-49cd-a609-ad04edefaa2d", "value": "196992c146062db84cbd73903ca4b0ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "c886d820-f8e9-44a4-8a00-893c55880359", "value": "49152:hhVSCIoIdMdFH/x0EtwDPbtjlEzVu0K64EiSADdUNigC:7Ivnq80bODdU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674874, "uuid": "97abd054-1e30-4c4f-8000-f451a272ade2", "value": 2661934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "abe22e27-edcc-4632-97ef-f8eebe12716e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77ed86d-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload (DarkTortilla)", "timestamp": 1745674874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "d6932f97-8d2b-4f5a-b7ea-526f962ce506", "comment": "Malware payload (DarkTortilla)", "value": "b3fd0e1003b1cd38402b6d32829f6135", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#98530E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "695abcdf-4f74-4b33-8b48-c3e88e1292d5", "comment": "Malware payload (DarkTortilla)", "value": "e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#98530E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "fc6fec2a-170f-429b-899d-718e289b97b7", "value": "T133F5CF5696BD4499C9AEC1F8C517490FE3B138011330A7EF4AE48B196F3BBE1AB793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "f1b32f3a-c26f-4d94-ad86-8cb159bef356", "value": "49152:KXSBgOQSMWnpCkICTugfaU6vTN4Z6WSk7s7jsjS4znnqyIn7TrvU:KygOQSVpC/CHMTWk8zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674874, "uuid": "fd31fb71-562a-4b14-b7d5-76d6dff63ba4", "value": 3643904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "39e43ba8-3ff1-4568-a6f7-f6f11d0948c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423dbda5-5bdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "3fe2c3b4-9688-4b97-92ae-f6f1f749c2c3", "comment": "Malware payload", "value": "77ecafee1b0ba32bd4e3b90b6d92a81f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "1b4d3574-1574-4f52-a32f-44895bc79754", "comment": "Malware payload", "value": "14d8c36fbab22c95764169e90e4985f90a171b201bb206bd6ea8883b492083e3", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "3f04ae65-f345-4fed-8cff-6ddc0c201b2e", "value": "T189F533C7A51044E2D799A8707D53BFD04A91BBFA295E921FE6CEB93B1832ED20C451", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "123930f0-0a02-4b54-beea-e7afdd7c9f43", "value": "0189345388451634260fa99de205c9c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "5cbdb426-d871-446f-a9bb-640c844b2adf", "value": "49152:ZfZDFDHgbjZ766knm3Y3ykj+B8lleKkqI5l+/pDktLE1wGZdcjnGnbPfnzR:npHgbJcmI3t08l3NKM/Sk9rcjnGnb3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674874, "uuid": "562fb35f-5ef9-400e-a16c-cb075b536a56", "value": 3450368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674874, "uuid": "3b8dd85a-0db2-42b1-b042-b298b13587e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87d69a2-21be-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745674877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674877, "uuid": "eb9f521d-9e39-4929-945f-e25727eb8049", "comment": "Malware payload (Mirai)", "value": "eb132ec7af057589c70e4a8e91ffc4f4", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674877, "uuid": "f5bbf4b7-4ffb-4779-9367-30ac5056c163", "comment": "Malware payload (Mirai)", "value": "f0a2a773c4736031d7738f56e274469cb1dafe29ac2b6ec5226b95464601c1c7", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674877, "uuid": "928d8729-3c44-4c57-86cc-38deb6128cbe", "value": "T10604C61ABB619EB7DC6FCD3302EA4602108CD54A06D92F6F72B4D658E78B94F09E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674877, "uuid": "9e2dfb44-c364-48ab-9af2-edaf92adc830", "value": "3072:dJN36smLBPSLROy06yBhPuvGFHgSLER9JteI:NRmLlyR1ZyBhPuvGFHgSLEXJteI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674877, "uuid": "3005a307-b6e9-4209-b491-c90cac4ae65c", "value": 188019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674877, "uuid": "feb9b078-497c-41d9-9e66-db767c3eff73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24b9639-8506-11ef-afe5-82aee05be84a", "comment": "Malware payload (ZharkBot)", "timestamp": 1745674879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674879, "uuid": "f92a632d-9a4e-44a7-a018-33477ae490c5", "comment": "Malware payload (ZharkBot)", "value": "bc243f8f7947522676dc0ea1046cb868", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674879, "uuid": "ed8cd646-c231-4404-8044-8dcde564d0d4", "comment": "Malware payload (ZharkBot)", "value": "55d1c945e131c2d14430f364001e6d080642736027cdc0f75010c31e01afcf3a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674879, "uuid": "cceb22f0-1f2f-4427-89c9-4e3909e1acb6", "value": "T1BA648E11B681D032D9B214345A3CABB59A3DED340F5416FBB3E4097BAE702C19B75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674879, "uuid": "87b19f68-4a64-4c0e-8bd9-8d06974f139e", "value": "86066554454deea625edb22af31c51bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674879, "uuid": "637c5efa-7cc4-47e8-8566-73e170e86a50", "value": "6144:FOwECuuEW5cgSPppM50MCJkvwvYTptAvK9V8pTjS8dE5EYan7aeoMVlw8n4poK9G:FOwEBVW5cgYnn7OMVlwfTWw0l+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674879, "uuid": "2df9343a-e218-4b59-a324-95112f39950d", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674879, "uuid": "59424c1b-3d68-4bb5-830d-0923c9acb36e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c2cc13-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674879, "uuid": "e737f5a0-267b-400f-88cc-92c68c702a97", "comment": "Malware payload (RedLineStealer)", "value": "e6a13f9bc436e5044cf60bec98de08ce", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674879, "uuid": "85fbe859-2f27-4864-88c8-e94ba72c7d02", "comment": "Malware payload (RedLineStealer)", "value": "9f226243336a6c2150017ca7faa116f9bcb7cb694acc470e3fa1e2cfedba5d8e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674879, "uuid": "1c6a1b54-0c19-4d63-89ab-ac44d3ee175c", "value": "T1C1268C8070146D75F5665632ED9934CC1367AE912DD4932BA9A2B2ECCAF332035DEC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674879, "uuid": "0e8f27ef-cf55-4333-a92f-aae9e48fd703", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674879, "uuid": "2df75355-994e-44bf-85ae-142df6d954e7", "value": "49152:Dkeyje0el3LoloP8msaSDVX9u6kX2wVtIyA9v5Ody8bbbW6AsrfkMx:DJfl8llvaqVX2VtlAD0ssLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674879, "uuid": "9fa7724e-2838-4bb7-8010-087abd580964", "value": 4456528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674879, "uuid": "93e2ea33-89e5-428c-a43b-f16367987cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bf4bb4-7f47-11ef-afe5-82aee05be84a", "comment": "Malware payload (GCleaner)", "timestamp": 1745674880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674880, "uuid": "1bbfaf59-6ffa-430c-9ef5-78cdc0eba693", "comment": "Malware payload (GCleaner)", "value": "2245fb9cf8f7d806e0ba7a89da969ec2", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674880, "uuid": "36d3678c-559b-4012-9e6c-0978e5891296", "comment": "Malware payload (GCleaner)", "value": "f15fdff76520846b2c01e246d8de9fc24cba9b0162cc0de15e2cf1c24172ee30", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674880, "uuid": "686a3ff2-bab9-4934-84c2-cf856310f2eb", "value": "T1AF64371375E17E91EAA307311F29B7D83B6FBCB65E31529E22503E1E1A762B0C9533", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674880, "uuid": "8168d465-d5af-4ae1-b3ce-2954178ad6ba", "value": "7e9e0d154ce1bd1036946ac6101b3bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674880, "uuid": "022fb7a4-53a6-4771-9da4-3ea94b2a5fd4", "value": "6144:tL0bCQfYu/6abuoaJr/bDk+TRTZe8NJfYphPYXH:to1T/6eDu/bD1TRTFNJSPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674880, "uuid": "106524ee-1810-45cb-a1b6-ceea3d0ab623", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674880, "uuid": "716c30a8-accf-4a84-abba-8522dd9c0f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0167923a-4b67-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674881, "uuid": "e47d69f2-3e96-43a5-9937-37ff01221f89", "comment": "Malware payload (RedLineStealer)", "value": "4e0235942a9cde99ee2ee0ee1a736e4f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674881, "uuid": "dfacb4ea-2ca0-46dc-9289-9db578bac21a", "comment": "Malware payload (RedLineStealer)", "value": "a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "66f106c0-a1a7-45df-bb55-05e172a33d2f", "value": "T1BF647D1827EC8910E27F4B7994B1E6749375EC16A952D30F4ED06CEB3D32741FA21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "20fa9fac-b2d5-47b6-8dd0-07d933e5e0c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "7628894c-3aef-44bb-9ae8-b3b4d22877ac", "value": "3072:aq6EgY6igrUjsgMmwPPoDqeRFSCotTAbtAYKtJcZqf7D341eqiOLibBOU:ZqY6iXwPwuaFjGTARANJcZqf7DIfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674881, "uuid": "e91bfec5-c425-4470-817e-ca8d2ed1d1e2", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "a6fbfd18-c61b-458d-9727-014c26e70736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d67be8c-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (VenomRAT)", "timestamp": 1745674881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674881, "uuid": "0db4b032-51d5-4137-ae53-b3f2c4724e3f", "comment": "Malware payload (VenomRAT)", "value": "c27417453090d3cf9a3884b503d22c49", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#31D98A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674881, "uuid": "28a39036-4566-4c05-893b-b58996a9a746", "comment": "Malware payload (VenomRAT)", "value": "d330b3cec745ce7bf9856e3cdce277a52fe7ad09874d519fa7b9b080a61a7407", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#31D98A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "109afa39-876b-450b-830e-b49523746844", "value": "T108B37C003BC88D69E66E8779BCB2420B0BB49D476415CE9D2DC438DE5EB27C55A072", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "678e0b29-e98c-4621-88a9-43c733939cf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "43c0c349-e630-438e-b81f-66814b0156fb", "value": "3072:TULcxmRdWPMV7e9VdQsH1bf8jQBDud7r6GiX8QiQ/avY:TKdWPMV7aesVbcSDudr6SEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674881, "uuid": "e703932d-d537-4100-98d0-990875194fe8", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "c25d7433-58f1-47e9-ae2b-95e8fed84173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df41951-58e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload (MetaStealer)", "timestamp": 1745674881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674881, "uuid": "d796e934-7ee2-4d11-98e3-682d333cae08", "comment": "Malware payload (MetaStealer)", "value": "47f2701f1d1f6645baccced737e8e20c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MetaStealer", "colour": "#ebffe2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674881, "uuid": "cde65df6-c43f-4b83-8261-74309153b855", "comment": "Malware payload (MetaStealer)", "value": "3d37b55464bded5c54903c5328e695d9b08b483e65cf6bdadd4ecf93954dfc9e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MetaStealer", "colour": "#ebffe2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "e160507f-967b-4108-a8e6-e8df2a40d1f4", "value": "T1D836D01494943D2BDE72023630DA3B0267B50E6153516DCFBBFE298DE7E1CCA8172B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "6ba2d4ab-c5d6-4ff6-b547-7935ffa5ab83", "value": "98304:tPtk042OYyWXqqxx2pC6BGwwsNFkeP9ISfhg:tNy5qxpC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674881, "uuid": "5b59f7dc-3e6c-4c39-a34f-defde5926703", "value": 5238888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674881, "uuid": "91857be9-4f79-484b-a853-fcb10b9f144e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848f78f9-5c18-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674882, "uuid": "bba98a54-5596-464c-9a88-81efb41afec0", "comment": "Malware payload", "value": "771b8e84ba4f0215298d9dadfe5a10bf", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674882, "uuid": "ef2cf59f-11a8-43ea-81fc-895ef4154254", "comment": "Malware payload", "value": "3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674882, "uuid": "e29515ab-fa17-432d-a75d-72c8b1c569a7", "value": "T1ABA3DC02B7419B16CF78353E42FB1A2823E5F1CB5771561F8F047EAA0DDB299BD882", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674882, "uuid": "3824f0b5-599f-4b87-a1ac-ee6b9ad12140", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674882, "uuid": "8376c0c3-a13c-4010-bf41-1de8fa6806ba", "value": "3072:pbqQQQQQQQQkQQQQQQQQQQQQQQ+QQQjQQQQQQQQQQQQQQxQQQQQQQQQjQQQQQQQ3:5qQQQQQQQQkQQQQQQQQQQQQQQ+QQQjQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674882, "uuid": "ea17c4d4-94e6-46f6-9a95-46ef92eb3daf", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674882, "uuid": "376feb0c-0cfc-41b3-b995-1a826225fe57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9308273-5cce-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745674882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674882, "uuid": "35ce36f8-677e-469c-ad82-937509351e99", "comment": "Malware payload (CryptBot)", "value": "fd2defc436fc7960d6501a01c91d893e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674882, "uuid": "6eebb28a-d3f8-48fe-b8f3-cf638d1eeaa9", "comment": "Malware payload (CryptBot)", "value": "ba13da01c41fa50ec5e340061973bc912b1f41cd1f96a7cae5d40afc00ff7945", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674882, "uuid": "a65f203b-6f7e-4442-8fa9-e8b08095ad67", "value": "T162D5D72BEA0356CCC013B6B3A8C7AA2FB8246F2C812E992F9D454C65F7556917C7D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674882, "uuid": "408c4fc2-e0eb-4cde-97f6-b72dc5ce802e", "value": "74aaf0b5a0230a863603c8c6bcd8756b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674882, "uuid": "c12362c8-ceeb-466d-9154-1548f92d5b54", "value": "49152:kpiVaJ9m+8FdK1BZKVD2CMwbbIip7q18N/jH1:ks3+11vKV7Fs89jH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674882, "uuid": "8ab7f960-aee4-45a4-b1d6-2e1bf9b5d9b4", "value": 2846145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674882, "uuid": "4e3806ff-721c-4c4c-8495-dfb3b30678f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccd0660-736f-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674884, "uuid": "225bf96a-aa66-4d9b-8d06-4ec51e4b4b58", "comment": "Malware payload (RedLineStealer)", "value": "30daa686c1f31cc4833bd3d7283d8cdc", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674884, "uuid": "0101041b-5a7f-474f-9fc6-27e40e0d3e85", "comment": "Malware payload (RedLineStealer)", "value": "504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674884, "uuid": "6b8c539b-2ec0-434d-8cbb-b09b10435a06", "value": "T149645B1863EC8911E37F4B7994B1E2749375EC56A852D30F4ED06DAB3E32740FA11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674884, "uuid": "df7c6eb7-f060-40ec-9269-5345bfae7465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674884, "uuid": "4c16bbdd-c395-4c9c-8096-cf3e7008639d", "value": "3072:Gq6EgY6iwrUjpgcDwPddU3417TAYtAliUpcZqf7D349eqiOLibBOp:dqY6inwPwo17TAkA1pcZqf7DIHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674884, "uuid": "f7db6043-19cd-4971-9e54-01a9b48bca21", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674884, "uuid": "d1e9f990-b12c-4503-9a6c-caba718f72b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcc9280-62da-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "51e3fc3f-6e94-4c88-8a75-5a88e86855ae", "comment": "Malware payload (RedLineStealer)", "value": "b5e07492b13633eacab4b4f57853b439", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "9fe6c265-39c0-4887-80c3-aa7b3054410b", "comment": "Malware payload (RedLineStealer)", "value": "d86a4ac9ab81a74a638e659821fd1d76d9b240d2a4e9fd1dc25c387d356d9828", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "05f20480-d27f-4084-9655-161a2cd858fd", "value": "T1BD646D1823DC8911E3BF477998B1D27493B4ED26A552E30F4ED06CAB3E72741FA11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "35ba8db3-815b-4008-91b2-0e3f90a373e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "93394239-206a-4571-829f-79dab15d7b9c", "value": "3072:Lq6EgY6iArUj8186wPH5v0vaaOTH7VEpuTAjtASKo5cZqf7D349eqiOLibBO9:WqY6iMwPh3EpuTAJAC5cZqf7DIHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674885, "uuid": "32924576-a9da-467f-92a1-45cc2bfda4b1", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "90329811-d273-4f23-bfdc-735abf3c476d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b423979-648a-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745674885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "b4cdd43f-87de-415d-8d2d-1cd2f3d22a3f", "comment": "Malware payload (Amadey)", "value": "bb63e746e54ae6a1ff2d5d01fc4b6c61", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "1bec41b0-147e-4b98-bf38-f793f2786c96", "comment": "Malware payload (Amadey)", "value": "18aeb7be496d51bada50f3781764bb7771f74d7050e3ceefa51725b3f86a59f6", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "aa70185c-90ba-4926-8157-db8776c7ecb4", "value": "T1C3945B213962C032C65092711E68FFF594EDE9259B7109DB77C40F7BAE211E26A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "45c7a898-8967-4492-b737-62cf54a8899c", "value": "f524bbe3419681c6783b5efcee446fb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "e003516f-39e4-4b4d-86b5-5858dfe2c853", "value": "12288:Y5fdcr5zzkoTCKPWop7tGZDH9ibUB25u2Ot:0atzzPTCKPBpoBQbzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674885, "uuid": "ba966ae3-b9bb-4270-8c06-24e2b2a4f133", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "799c11d4-ae00-4a44-8d72-0153162929fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c692cd5-81b9-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "0cb3d944-307b-4354-837c-679ad51dcf35", "comment": "Malware payload (LummaStealer)", "value": "2fe92adf3fe6c95c045d07f3d2ecd2ed", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "039ac71f-8a55-4b61-b838-3c7802c99a75", "comment": "Malware payload (LummaStealer)", "value": "13167320a0e8266a56694be70a9560c83e2c645d6eeaa147b9ae585c2960ebb2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "7281b66b-ede5-44f7-8174-3876744ed5f5", "value": "T1E3746C86EB5786B1FE49857D80D6AB3F4B3517222334DDD3D7D4EF44E8921E1A03A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "90f98865-537d-418d-b775-d52e39babc73", "value": "b41c400c8e289ebbc05d4e9c52096bdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "87a81b9a-621f-49e5-88fd-589e484f0736", "value": "6144:hgyBZvU9zGoDa09h6Dp9LCFWmx7OeCZ3Uhj3lRnx:myBQKoDTP6F9Lw9kCjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674885, "uuid": "516b511e-e895-4632-bec8-d77ed26a4197", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "00d884cb-347f-4d80-85dd-95ef3eb446da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f328913-7072-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "fdc531bf-9e4f-41a2-9a35-e707eb2595b9", "comment": "Malware payload (RedLineStealer)", "value": "389881b424cf4d7ec66de13f01c7232a", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "3ce5b6aa-bd08-448b-bdcd-198bee6f00e0", "comment": "Malware payload (RedLineStealer)", "value": "9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "fcc5e7a8-ad52-44a6-b0dc-534a29d6af9c", "value": "T17D6423195D03DB02D3FF99F5F9A24822D7A8FE0B39D95E6696CF03D396260514620F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "5e1d0ce2-e4a2-4214-a4db-d097c8db03d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "81dd58fe-7a50-422d-9206-546984a9ec3c", "value": "6144:mmAUwI0Q3r6UBqC7e8O5rvH9MMoBfOWf6dX/mY9Row3:mmANIL3OUBqC7e15M/6d/Mw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674885, "uuid": "06594e2b-b267-4be5-a120-187de3437f2b", "value": 320000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "b672bdcd-c174-44e3-ab83-d611773d7b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab490a58-7518-11ef-afe5-82aee05be84a", "comment": "Malware payload (Formbook)", "timestamp": 1745674885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "4bfb09b4-f227-4876-b562-6bb8b0fa3f0a", "comment": "Malware payload (Formbook)", "value": "31a4da11164220233871e95edce2df23", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "e2c76453-1c94-488d-835b-7995347ffef9", "comment": "Malware payload (Formbook)", "value": "ea35a69bc4904317fe315cebc036d5495210de7f1e79b8c891b6cbabade07dbd", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "fddc79bd-3762-4cb1-893c-e1c726cda980", "value": "T16A563395579C9083CCCCBB39AFAA0A0F37C125B4249F65D78A62ECC7F902F45876E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "e4d85182-11eb-4ec6-ae57-e9d625ee6f9f", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "781ac187-016d-44dd-9482-061ca7e6375e", "value": "98304:1vEG/wtPLfzXM8D1/GgySA4rewIOalPJ44nH3j+b3dmPApFFvwwN:1vEbjzXJ+gAEewI75m4yb0PA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674885, "uuid": "a4136af5-76e4-4a5a-b576-0221d841d1b6", "value": 5926912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674885, "uuid": "938b0200-66ae-4115-bb30-10f0bd70371e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c94adb6-62da-11ef-ac1d-82aee05be84a", "comment": "Malware payload (PureCrypter)", "timestamp": 1745674886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674886, "uuid": "d74bd657-4c5a-4f10-9c63-063cdc6a6ad8", "comment": "Malware payload (PureCrypter)", "value": "5e7c5bff52e54cb9843c7324a574334b", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674886, "uuid": "91cc8316-ce70-4257-bfd1-577ee5d05174", "comment": "Malware payload (PureCrypter)", "value": "32768587423824856dcd6856228544da79f0a2283f822af41b63a92b5259c826", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674886, "uuid": "5a26e339-ce4c-4d83-8ecf-34b8fa4d0b44", "value": "T16C45239953F9E642C3692EF51D210A6993786205B072F61C9F4088DDBBEF300469E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674886, "uuid": "1f5b4fd7-e7c8-4c09-ba9d-89703d51d019", "value": "24576:8QxNUoO1VTDz4ESGwyhaivv1zWqrX0y52eHM6QfVW+oonVadkcohXe4EC5Ic:8Q8oO1VXaGh7vJHXtM6g4+oQVadkdT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674886, "uuid": "1b30fa73-0c05-4deb-a04f-be5c54b220dd", "value": 1227264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674886, "uuid": "b3699275-8590-4c52-bde9-231d887c0b5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30de1dbd-561b-11ef-ac1d-82aee05be84a", "comment": "Malware payload (GuLoader)", "timestamp": 1745674887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674887, "uuid": "ec89c184-c5f6-427e-8690-553b0b7bc0f9", "comment": "Malware payload (GuLoader)", "value": "ca817109712a3e97bf8026cdc810743d", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#9937d3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674887, "uuid": "7d07d2d4-a63d-4068-a330-e0d2e938a14a", "comment": "Malware payload (GuLoader)", "value": "6badd865383f71c6d26322fcf3b6b94a5a511981fcb04c8452ff20c8528e0059", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#9937d3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674887, "uuid": "3854984f-6aba-4509-9d17-a8ce816869b9", "value": "T17A5533179D79F447CF504DBBC6B8633A5EC48AD8D8F9DB4B47C9D21278E1A27842C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674887, "uuid": "c6ad501c-e212-4f9c-a75a-8f409d8ac646", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674887, "uuid": "3bfbfa1a-d1e5-416e-9e95-6f3348676d60", "value": "24576:/cHSfhDMKnkUTgZGLvbPKqCRrLA3FcFfhk1Llhyblaf2iivi3a4c49yYPp:iSZYjUaQvbJQgFcoplMBu2/vvj4cep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674887, "uuid": "26c4fed1-70a3-4e07-8aa8-6af712a48c92", "value": 1401522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674887, "uuid": "11c946df-4aff-4b13-992b-30c83941c19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c9cee4-4b67-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Vidar)", "timestamp": 1745674888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674888, "uuid": "941748f3-7128-4f49-a8e1-b7b4659afd57", "comment": "Malware payload (Vidar)", "value": "1b0fe9739ef19752cb12647b6a4ba97b", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674888, "uuid": "95232431-b987-406b-93d0-e15ea1815b8b", "comment": "Malware payload (Vidar)", "value": "151247e9379a755e3bb260cca5c59977e4075d5404db4198f3cec82818412479", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674888, "uuid": "eb8f0d27-a984-46ed-8cb4-e41190af6951", "value": "T1B90523965EE44093E8762AF01572BA03AF3ABD3608B1814E9517ED2B35237E5D32C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674888, "uuid": "ee0f00c4-0d21-4a43-852f-9932d8fa25b3", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674888, "uuid": "6c03026e-8850-4d4c-aa4c-63935b70896f", "value": "12288:1CIFRWBr2HxOV32SGLvstHBe4BhbSJLhpnkfkywNgk30vDe31GnkNXT:1HFsUROVGS6stHBe4rQLofwgy0beTXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674888, "uuid": "2cfd2ff1-54db-4bf1-8899-3df9109eed7f", "value": 834674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674888, "uuid": "d6f3dde7-e0a0-4e31-b7cf-dfab82d0a25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fe191a-5787-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674888, "uuid": "e57ef3d3-5009-4a62-9142-350294f8d623", "comment": "Malware payload", "value": "ef8320eace6f753231666c61104bdd49", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674888, "uuid": "e537c681-e303-41a1-a4b5-d57fb73ba0f4", "comment": "Malware payload", "value": "8e2fa428fa5e7092d117dadf10529a35f415a0b8fa27cd17607e23dd913ffcdc", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674888, "uuid": "503b26a1-1388-4e91-a3ed-136633f34724", "value": "T1D1648E20F1829076DAA204315A7DAF72C57D98204F7515FBE3D44E3BAEA02D2EB31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674888, "uuid": "db46f4f4-b8a8-442c-8f3d-14263d4602a6", "value": "015966a997659caed7ef58f6ab2e8bde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674888, "uuid": "80efef27-b487-4979-8e39-1d507959cc01", "value": "6144:hh9fH2l34HigA2/BDBaBL7cpnBZVCBQrfYQSlyItcJ2+QmmaeIBqk3biuFo480AL:s9jtaeIBqmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674888, "uuid": "2794b985-2d70-4db1-b8fc-0115cc587eb2", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674888, "uuid": "137167bc-ec5a-4528-83f7-2b5428c73cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0368be7-7435-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674889, "uuid": "74fae683-e82a-4bda-a30b-d6d5a9d2013a", "comment": "Malware payload (RedLineStealer)", "value": "ff5afed0a8b802d74af1c1422c720446", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674889, "uuid": "6a5cf593-d4bd-4034-9c6f-3a426aaf8375", "comment": "Malware payload (RedLineStealer)", "value": "17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674889, "uuid": "4ad2981d-4b23-4902-9fed-1778ff73beed", "value": "T1B26423E355EFCD12E02CA8B8EA6213A5A398F100E796515671F7808B5F5F2B3C3721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674889, "uuid": "f7a4e495-4952-47ed-817d-f8133fd0b69b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674889, "uuid": "dc11c149-616c-44fe-87d9-74aa51fe25fc", "value": "6144:/6ZNaeEuexVOkKu/A9UZMOqMVr57KLMLPQ5uRXg6hUm8:/BvOkHPEUsYLeIXgDm8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674889, "uuid": "e0dc227d-b9b3-4d58-a48d-846c6f98ce3e", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674889, "uuid": "036101af-ef59-4ca8-8365-93513f218b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37116a3-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674890, "uuid": "b9985cb9-70a7-4286-9ed7-211caa2a0177", "comment": "Malware payload", "value": "9a4cc0d8e7007f7ef20ca585324e0739", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674890, "uuid": "75f80554-8ead-4281-b5f8-45eb1bad0ad0", "comment": "Malware payload", "value": "040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674890, "uuid": "fc2df5aa-096f-4ccc-9e57-ad31ca90ecfe", "value": "T17793E541E62DBDDDE41CD0311A75E4F25E24EC3176C0A11EA7F6BF0629712A3F90A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674890, "uuid": "18a831ca-18b5-4a2a-9c28-f4d3845aa1aa", "value": "5b30998b2ec74c8918984e16a74e5411", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674890, "uuid": "1b481b9f-26cb-4f35-8853-527786f063f5", "value": "1536:9M/AhIxHHWMpdPa5wiE21M8kJIGFvb1Cwn/ZDs5yf:9M4SwMpdCq/IM8uIGfV/ZDso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674890, "uuid": "204c1517-d36b-48a2-8045-468361d6cfbd", "value": 97000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674890, "uuid": "eae67ab7-acc7-4193-ac09-98c405dcd927", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23793948-93b4-11ef-afe5-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745674891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674891, "uuid": "f82548fb-c21a-4f8f-9f50-9b9cad3eeaf9", "comment": "Malware payload (Amadey)", "value": "5d97c2475c8a4d52e140ef4650d1028b", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674891, "uuid": "4ca5ed4f-331e-435b-9723-f5619c261402", "comment": "Malware payload (Amadey)", "value": "f34dd7ec6030b1879d60faa8705fa1668adc210ddd52bcb2b0c2406606c5bccf", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674891, "uuid": "133b646f-f387-4cff-bcf1-955b4acd1803", "value": "T17A452347D0E82D62D2F3867729B116304B56A56101F09ACFF700CD5DBE27782BB693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674891, "uuid": "a5e6a79d-63d1-4db2-93c1-6a23c51bbe83", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674891, "uuid": "0f065005-72c0-40d0-ad5a-d9a01e68a90a", "value": "24576:G/e3qkBTWU2YmUQEg/IcuH+PtJ1NFDk6S2JPxeRcMZYj2I:wsgUzg/TuelJHDDTeVuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674891, "uuid": "9e880bf1-ffb7-4e12-a4cc-9fce929d6ca1", "value": 1224767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674891, "uuid": "0894dabe-d996-4be8-aeed-2268d2e17529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9800cf92-62e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload (SystemBC)", "timestamp": 1745674892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674892, "uuid": "22d4b0ab-4c2f-45e7-bbe6-dcea154b1a16", "comment": "Malware payload (SystemBC)", "value": "de64bb0f39113e48a8499d3401461cf8", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674892, "uuid": "21f6d840-cd7e-4a79-92e0-f8e26597310c", "comment": "Malware payload (SystemBC)", "value": "64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674892, "uuid": "31ec7def-06d4-482b-b5ae-d944c2e4fc97", "value": "T18915230CBFFCA70FC38C2976C0E16601C3F955DB7202FB16699960A52827BDB9917B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674892, "uuid": "e98a81ac-c389-4f0d-a64f-35f9b29a74bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674892, "uuid": "3b7245a8-47fc-4d99-8b15-8ca31d47c858", "value": "24576:NAHFp2K15zXnjfQb6+jFb5RIAJTOcA4gnPdCPPd7wm:WHf15zM5JbtA4wPdCnd75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674892, "uuid": "1e808738-9612-4ff0-9f23-a20d41aca499", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674892, "uuid": "6bcfd61c-e3a3-4810-92b6-e61726ceeda1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c72907e-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (PureCrypter)", "timestamp": 1745674892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674892, "uuid": "2eb13e8b-7e6f-4bc2-a34b-6de55d706442", "comment": "Malware payload (PureCrypter)", "value": "3f99c2698fc247d19dd7f42223025252", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674892, "uuid": "97ba5001-5523-440e-aabd-b09987a5b307", "comment": "Malware payload (PureCrypter)", "value": "ba8561bf19251875a15471812042adac49f825c69c3087054889f6107297c6f3", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674892, "uuid": "63ce2151-4a38-4163-b0ed-04eb71a8053e", "value": "T11975CF03BA8789B1CE8867F7C9DA050413B7D582B793DA1A798F23D908437BADD4D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674892, "uuid": "2e6e94ac-1c47-472d-933c-87818d92ef3d", "value": "24576:3ZAYdRMHkss0gfe4GCfB375jh9WBSI5RyDv/5m0mMra4kpYrK:pAaMH00glBf9UZMgLpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674892, "uuid": "b9239c56-1662-4ee7-b539-2b12f38f3d36", "value": 1662464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674892, "uuid": "ae53b97a-397a-4892-be76-e38b51afbdd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac15942-84ec-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674893, "uuid": "e5a0d0a9-9f7c-40e1-9fa4-790e7b96b0f1", "comment": "Malware payload", "value": "414753e6caa05ca4a49546cec841ef10", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674893, "uuid": "e165e6cc-2074-42c9-a786-439d5624792c", "comment": "Malware payload", "value": "5b9ed73fd7af6b0f9625ff30b925c84905e76b694a37e41d6207626b2fc3d2f6", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674893, "uuid": "7fc6d8ea-aa68-4597-8a8f-c5ee214f6ad3", "value": "T11DC5E84369DB0DE5DED667B861C31335A778FD35CB2A1F2BAA08C23169536C4AD1EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674893, "uuid": "7febbf8b-b0cb-4a22-90b1-ba5eb1c33863", "value": "96f4768c9861fb5fe11db52fece85eb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674893, "uuid": "3944604e-233f-45d2-beba-f446f3c7e674", "value": "24576:wV9cJXtGndLzF0szq2l9RU0t+kRsKWj+dWdo+Ec0xMki8UsU3AoAMXqozj+inKM:k9cJXcndLzF0OU8VdWdqMXqozj+inKM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674893, "uuid": "382b249b-4e52-4335-82a7-762a98375a8f", "value": 2611774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674893, "uuid": "9a12884c-1842-4a43-b0c6-7aa2cf780d8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955906c2-62e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674894, "uuid": "fac93b2b-eaa5-409d-9b35-8fe48f2192bd", "comment": "Malware payload (RedLineStealer)", "value": "1f4b0637137572a1fb34aaa033149506", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674894, "uuid": "7a64f8ae-c0be-4088-89a2-f8be8532f982", "comment": "Malware payload (RedLineStealer)", "value": "60c645c0a668c13ad36d2d5b67777dedf992e392e652e7f0519f21d658254648", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674894, "uuid": "9c75dd0c-e2b3-40d2-906e-580a8c952547", "value": "T1126423D72DAF4656CE6E9FB754712004108D39226FC322E6F0AE586F3B6C55E84B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674894, "uuid": "2b02e29c-89a0-4927-9160-d1375becf153", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674894, "uuid": "42709903-5b70-43ae-b100-bc21e7f231fc", "value": "6144:Zm1G61auNh8PDtyJvsHP+iVQmoc2RZ4cm++pBESrvD6ClOC:6GaxO5rHPkmojzAr6C8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674894, "uuid": "2ad00a22-36c2-4cff-a76e-6096641b2785", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674894, "uuid": "16d8b233-144e-4e6d-aedf-4aa7a0aeccba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d2c855-5bdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674895, "uuid": "569467aa-6693-40bf-98a1-708cc39c36db", "comment": "Malware payload (LummaStealer)", "value": "31f04226973fdade2e7232918f11e5da", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674895, "uuid": "4d84608e-0113-41a0-b076-af6c6d29e788", "comment": "Malware payload (LummaStealer)", "value": "007c6dfe4466894d678c06e6b30df77225450225ddd8e904e731cab32e82c512", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674895, "uuid": "666fc115-fb95-4299-8570-eb467dce70a4", "value": "T16555126B6D58EC1AEB460D3C68F8A519EA7C94404D7B4103ABB78CDCDAF6BC83F495", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674895, "uuid": "328b9f32-56c0-456f-add3-d89456029555", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674895, "uuid": "b5b64075-ce44-42e1-9056-f6b2c05dfb44", "value": "24576:VzZDpgqx9+kamgRQ+uYU8hwjxKmAERKk1LxkGTagw276kyJsAb3WIWI:VrBxbEQ+uYJqQERKk9mE/76KAbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674895, "uuid": "94313f13-e18f-46bc-9708-dd3f5f14ba1c", "value": 1346487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674895, "uuid": "07ce1b44-b410-4ba2-9385-982c57586f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7f4311-81b9-11ef-afe5-82aee05be84a", "comment": "Malware payload (SystemBC)", "timestamp": 1745674896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674896, "uuid": "03e03073-850e-482d-82c4-0fc37271e1ac", "comment": "Malware payload (SystemBC)", "value": "23c8cb1226c61a164d7518218c837b81", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674896, "uuid": "80d82534-8907-4dff-9e4f-d29f0f79fe44", "comment": "Malware payload (SystemBC)", "value": "21aaa5319a6729df0581203a0782ead837b848387e44cd1844ca8e19882a50af", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674896, "uuid": "18fb4cf8-5a35-4dd7-ab7a-55fab781631c", "value": "T17AB58CA1B09B48E1F5079FB0C159B9E10B71B1B3AEDBD52F274D33546F6BB982404A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674896, "uuid": "d55a6316-c422-4441-ba65-9a40f52c2220", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674896, "uuid": "e1693622-5c77-4973-b6a3-e991a845f4bc", "value": "24576:wqDdns3FYYhWxL3rc/+rhm+qx6GuQ5qGPVmTy9xMNWgJ/AICqQ9pEsePeHMSPs2f:1iD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674896, "uuid": "7cca1616-c698-47ca-9f4d-2c0eb15dcf28", "value": 2290688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674896, "uuid": "0c6ed93e-f1d2-4dce-b1ab-b002f22a0e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133b26e5-9f6c-11ef-afe5-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745674896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674896, "uuid": "b13884c3-ae92-48e0-a1f7-746cfc04d9c5", "comment": "Malware payload (Stealc)", "value": "b38d20c6267b77ca35a55e11fb4124b7", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674896, "uuid": "d230796c-596c-4117-b9f9-228fae288ee4", "comment": "Malware payload (Stealc)", "value": "92281aaffbb198760aacd304df932fd58ba230d0927839d85db71dc7ae6f7d71", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674896, "uuid": "b1d316e1-aa62-484c-ae0d-34513a763061", "value": "T1E8847D3296F12852F6BFCA3D4E3F92D86A2FF5629D28B29D11141E1F09311E1D6627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674896, "uuid": "4ef3ca4c-723a-4173-b03f-d26799d48e0d", "value": "9a11732a2e741d4d1a9f61b29552bab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674896, "uuid": "0191b61a-482f-47f7-bba6-45732a056ead", "value": "3072:oG1Shl+RNkGtGdiadPMM/cn77tPOdhE59UTx7F5pTfcOOL7iF5GJpaPDrKoW58OW:UwXtGdiaeMknYI9i7F5pAN9aPdW5fW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674896, "uuid": "885ef795-f80c-4208-9fd6-53ea31db7d3f", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674896, "uuid": "46d1ccea-7ead-4e00-aca0-9ed884b27000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2179c536-77fa-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674897, "uuid": "726fb35e-ff27-4909-95c8-1ad5d585dd60", "comment": "Malware payload", "value": "96f6cb8e78692f8bff528da76bfde919", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674897, "uuid": "b90def02-7fad-47b4-b807-d0ee0f196532", "comment": "Malware payload", "value": "94b0cc15820061feae57ffc9e46f4c07f9023659b4ca2dfd105802d843b4c0d3", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674897, "uuid": "d8a05cf8-d41c-4f3a-9ffe-c281884b57de", "value": "T170942950A540FDFAE8D9CBB510D23349D1EFA0A0DB1DEA2B6940FE3C015AB6859339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674897, "uuid": "2c73feee-2ad3-4ca3-af58-05f1e9638cd0", "value": "6c12c5930132fe5d268e288ffe84a207", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674897, "uuid": "e76a019b-14b3-4a6d-9db5-725e3a7b7081", "value": "6144:omUZYwNIRcCdh4vVgCAoyXILAkAyQX+wWNsBUh5gzp00NRhMohYUia5QvjkeQW9:bUeDsyqy4c1XrGEjnCOIHQW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674897, "uuid": "af220a6c-d11e-4139-a102-af7aaae05b47", "value": 433212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674897, "uuid": "bbfb3546-1480-4fe0-8573-249a809187eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0639ab8-8c0c-11ef-afe5-82aee05be84a", "comment": "Malware payload (njrat)", "timestamp": 1745674898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "db12de0c-2820-4438-9216-026896e00430", "comment": "Malware payload (njrat)", "value": "1b99f0bf9216a89b8320e63cbd18a292", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "bfb42d82-1a04-4e47-9d35-83099cb03a57", "comment": "Malware payload (njrat)", "value": "5275e3db6276e5f0b85eff0c7b0282f56268646766b1566ba8f797e6ba2a9357", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "e3022401-ab7b-4c82-bbf3-c1e2b8329513", "value": "T13455BDCB6E5646B6C39CE635C5A7372C072BD9793BE3AE0DE54F2E941B3236D58001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "9672a298-e9c1-4558-9a6d-a5442ed2716e", "value": "24576:J64p16BppRskYGC/cJUE7P6nxhpBaTn+CC6YtGz:JzpEBrRb4MonrpATDcUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674898, "uuid": "69021128-fa8f-43cb-9c0a-969c29e2d897", "value": 1334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "9130d401-c605-490e-a8da-be689cb788b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26de367-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1745674898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "12223350-9447-433c-b073-c1db58fe1421", "comment": "Malware payload (AsyncRAT)", "value": "009e2424044cdb99eb7437eba6be15ed", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "8f6c013a-620c-4288-9645-542ccd25a351", "comment": "Malware payload (AsyncRAT)", "value": "035b9f3f186f7cd0d168f846726ea3668be8cbefe947edbf1a4e385cd9d86760", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "63424176-da89-4836-99ba-c605203ebb4c", "value": "T1C3738D6C7BF54528E0FFABB619F63653C634F6235902D60F28C6024B1727A88CE512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "88999f2b-190c-436b-a3ae-c10394c58dab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "8b15a24d-d004-4260-8016-c3f40e2358f1", "value": "1536:9UvrIIoWxYYbC3spbmjnR9taoIXWGJ2aOmaeX7vT1:ibJrCcpbyR/zGJ2aOuXf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674898, "uuid": "e51c3e36-709c-4867-ad92-1e4499190849", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "dfe56a96-f4ac-4b41-965d-42cb714cd551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fb060d-4b78-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Vidar)", "timestamp": 1745674898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "0fba9015-2cbe-4547-a8e9-957cf6016de8", "comment": "Malware payload (Vidar)", "value": "569720e2c07b1d34bac1366bf2b1c97a", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "88ae200a-07b5-45a1-b162-3ee14ec26168", "comment": "Malware payload (Vidar)", "value": "0df79273aea792b72c2218a616b36324e31aaf7da59271969a23a0c392f58451", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "06bf5240-7ef4-41a3-9e03-7348e0b2146a", "value": "T1B5052302C6B9E067F9D60D7056B5BA272F7679581E30804E0728D96F3D727C9E2AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "112fb115-5922-43ff-940e-da365ccbf8f9", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "46f71b58-bb12-4688-81d2-7cd66d9317f9", "value": "24576:TPULtGy0ccUe2jZIneELXUCULPoQg8bXT:zIfcOj4Yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674898, "uuid": "c98bf6f6-34fb-4732-83e0-1e6658372ca9", "value": 867038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "e5b7ec5f-d6f3-42aa-aaf7-9a7f6d8d4035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6baca67-5f00-11ef-ac1d-82aee05be84a", "comment": "Malware payload (MetaStealer)", "timestamp": 1745674898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "8552dc0a-5c41-4809-88b8-2247125749fc", "comment": "Malware payload (MetaStealer)", "value": "2d340fd6abb83c75fb8d07b8290a66d5", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MetaStealer", "colour": "#ebffe2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "04c08361-d5fb-4289-b35c-afa0f01d4e0a", "comment": "Malware payload (MetaStealer)", "value": "d4f93e8b826e222634c243fadc30451502e0d659de116debee5edf5a547c6704", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MetaStealer", "colour": "#ebffe2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "8af77675-f0b9-450d-a3bb-ab08b2da1d4e", "value": "T10EA423126CD134ECDEF5CFB5967A6164DEA0EF817A1947C72057E6A083C36281F02A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "bbc1fe87-60ac-419f-b4d1-35bcedc8ac16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "68ffd965-e53d-4ab7-bf20-89dee8354250", "value": "12288:kSubRGog3TYWrzJZpa3TuHlY36wjAzbl409rEO:kJkY+z7s3TuFjZrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674898, "uuid": "b5cac474-3cd7-4d40-b3cb-58cadd829b17", "value": 465960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "c27084cb-8a18-4bc2-bac6-5350f5d51bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143be176-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "1c352c62-66ee-4985-986a-e60409a2ca48", "comment": "Malware payload", "value": "03b1ed4c105e5f473357dad1df17cf98", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "0dbc82c5-7168-41bb-91ed-88a69d132518", "comment": "Malware payload", "value": "6be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "fb2d5d29-803c-4000-8751-d9d9b58d656f", "value": "T1CC651218E7810A75D2EE0F3AA9DA6B45E371C45FD74ED30C2CC804E24F6A7DA7614A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "86a26594-c08a-4280-846a-19dc20d257fe", "value": "24576:mKJgCXXVbqUMrC/kMGONZ0Px7lUaeESuHCirnlEAteFgPL/+oAJNXnqz:mKJxFuUqOMNdHC2xfL/+oAHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674898, "uuid": "db3ade84-dfb2-4d78-af4f-f2157eaf6ac7", "value": 1426944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674898, "uuid": "5a87b296-9232-41a9-8e66-eccb614eee79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee73028e-4acc-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CoinMiner)", "timestamp": 1745674899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674899, "uuid": "b2b14875-7185-454c-ad6b-617cffb002be", "comment": "Malware payload (CoinMiner)", "value": "95606667ac40795394f910864b1f8cc4", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674899, "uuid": "767b5351-53a4-4b6e-988b-73d5191ab05c", "comment": "Malware payload (CoinMiner)", "value": "6f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674899, "uuid": "83abda06-dedb-4487-b2aa-05d5e4b7a1f9", "value": "T1CCD6338693E58DF2FCBA523C56854069F2B1742003F4C98F9BBD81A61F533E15E3EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674899, "uuid": "fe68a18b-83a0-4a9a-8c5f-da35bcb674ee", "value": "456e8615ad4320c9f54e50319a19df9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674899, "uuid": "fbadb62e-d782-41d6-b6f9-b98ef0dd8b7a", "value": "393216:kzuRUAwf7vLF4NkW+eGQR6n/ikWMWfogBIv:kzuRIx1W+e5R4qPDXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674899, "uuid": "a80f1b1c-7278-4d7f-bae9-96dc06b08d80", "value": 12946352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674899, "uuid": "27dd0209-aead-4aea-b395-704ef01d02b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418168d2-5bdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload (SystemBC)", "timestamp": 1745674900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674900, "uuid": "856392a8-44ea-4a05-866a-fd9eb6a0f503", "comment": "Malware payload (SystemBC)", "value": "25ed0fce4a9df59b3ed88853db8206f3", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674900, "uuid": "579dac20-c2cf-4e80-92be-8b51719e222b", "comment": "Malware payload (SystemBC)", "value": "c5b32f1cdc2a48f1dd2b1623598c24a2635dc57fdab3b4328f1cb3b66f5079ba", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674900, "uuid": "6f6b3979-1492-45cc-ade8-f1bae00eb2c6", "value": "T1B835F17B5BA8BA1BC9CDD1F8E026420863F2C30D5117E7476846A4FCA8163C47F76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674900, "uuid": "aa65ec19-d8a5-46e4-a00d-a70289b7ee10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674900, "uuid": "09022e14-22ea-419d-af52-54ac8cb2db47", "value": "24576:o+uySzDesoxGcxOTVeXEUdlrDx2b0xWHVaTDdAuIWEcAt:tDxpU2lrAb0xWHVandAuREcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674900, "uuid": "8fcd0b85-cb67-41d3-b6ab-4d133cc12ff3", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674900, "uuid": "4ad5ed58-93d2-46ff-957a-8ea36e8a63c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41d19d3-4b30-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674900, "uuid": "e2523339-e1a7-45ad-b0ee-593dc736c0e0", "comment": "Malware payload", "value": "bf9acb6e48b25a64d9061b86260ca0b6", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#8F0CD0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674900, "uuid": "f37508a5-80c7-4a35-85b4-1f65deced0e8", "comment": "Malware payload", "value": "02a8c111fd1bb77b7483dc58225b2a2836b58cdaf9fc903f2f2c88a57066cbc0", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#8F0CD0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674900, "uuid": "30203404-6239-4871-b937-56984c53d34c", "value": "T101C57C2B457A558AE3D6C07CF52B1792AC3136484E39B37725FAC3913B30A1C6B6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674900, "uuid": "def0142f-d33a-4662-9bb6-3650cc709fab", "value": "e49b63183dc452ee4abc90a6e47f6582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674900, "uuid": "80580e7c-2259-4a86-80a7-c09f8e4c4cc5", "value": "49152:KoW7eYGTL2twElWv+qXy3wfENRxOgB03gStRTvgl6xhp8IbCcNy+OHDLjzs/DOrD:m7e6KVdx1Rquh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674900, "uuid": "702074f9-c535-4c14-91d4-e9fd532a2c6d", "value": 2711040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674900, "uuid": "55af7f8f-ac55-4499-8eed-35ebd3016fe0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818c6008-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload (ZharkBot)", "timestamp": 1745674901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674901, "uuid": "cc49d467-baa5-4c32-a28d-adb5fd0f1327", "comment": "Malware payload (ZharkBot)", "value": "933f2db7b8ded6946f35720a366e7b14", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674901, "uuid": "8f91165f-27fa-4717-bc20-3458786d4fa7", "comment": "Malware payload (ZharkBot)", "value": "ba8d4df86924743be143d569ac06b8a1b1d7e2c554720e7f31126a0db04c3daa", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674901, "uuid": "4840684f-a696-40e7-91ed-c19398801ff4", "value": "T191D49D16B0C8F1F7D4AE043463AAB6B46F3640484324BBD39BD80EE17E956DB67342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674901, "uuid": "05a1920e-48f3-4094-abde-7879423810bc", "value": "1b27045adbbf28f4d991e6f3c9541cfa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674901, "uuid": "746fb111-58e3-4ba7-bc11-b08c14d553f6", "value": "12288:2LiIDxg9D7D8zxHk4la1v2mCVsNgSB+EKn6fGPR4Q5xx:2LiIlg9D7Doxk4ECaN3QEKbPR4Q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674901, "uuid": "a0c61ef2-a44e-4a06-924a-e6f448063801", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674901, "uuid": "0bb97b6a-cfbe-4525-8205-d991ab12eaad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafcd3f6-4acc-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674901, "uuid": "ac839335-c113-421f-a01b-31605dda1bf8", "comment": "Malware payload (RedLineStealer)", "value": "d6a034f75349665f43aa35dee0230379", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674901, "uuid": "0bc92fbf-7a37-4122-ad0b-f1f321d1760b", "comment": "Malware payload (RedLineStealer)", "value": "428a020f9446f1f98d0152101b1f8cbd2697ac32d7d47e27ea7e2622f3d4de46", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674901, "uuid": "d49e1b7c-9bff-4cb8-9e13-f0a17cee66b3", "value": "T1B8646D1823EC8911E27F4B7998B1E2749375EC56A412E30F4ED06CEB3E32751FA15A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674901, "uuid": "670697cc-1964-4f23-8ac0-2367d0b84035", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674901, "uuid": "dcc8ba66-7840-45e2-a990-426747da2404", "value": "3072:Xq6EgY6iorUj6uYIwPoE5kQgnKyyDSTAVtWSi6RcZqf7D34VeqiOLibBO4:aqY6iRwPTkx7yeTAbWMRcZqf7DI/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674901, "uuid": "756242b5-26ca-4b7e-8d68-5cccd1a45fa7", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674901, "uuid": "f0a88bd3-c1c0-4dc3-abb5-2fb997082329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c9a5fe-58bc-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "ebc5fe0f-de10-4292-88a2-78ebf67f0575", "comment": "Malware payload (RedLineStealer)", "value": "1b099f749669dfe00b4177988018fc40", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLine", "colour": "#21e59a", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#55c590", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "56328852-1723-438a-9b0e-3abb01637ca6", "comment": "Malware payload (RedLineStealer)", "value": "f7b57a665ac90377683c434a04b8b6894c369d34fdb03273778a8c9f8fdbb262", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLine", "colour": "#21e59a", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#55c590", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "fe193c43-adba-4cfa-8399-86e79cbda7c4", "value": "T180645C1863EC8910E27F4B7994B1E2749375EC56A852E30F4ED06CAB3D33751FA11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "d6cefa1d-54a5-4832-bb7b-c37eb3b4e364", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "7a36e40c-d42f-4d71-ad1a-91160e7e63ff", "value": "3072:Oq6EgY6iwrUjdy68KwPMCqJRn7cTAVtAaK0FcZqf7D341eqiOLibBOU:1qY6ihwPIzn7cTAbAqFcZqf7DIfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674902, "uuid": "b8a588cb-3f67-4fe1-87d8-b47d9aee7d86", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "f710bd14-4444-4030-af00-1e9fba9ee782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0995f0d8-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "795bf80c-7d2d-4e9f-8a09-f628f5f64d96", "comment": "Malware payload (LummaStealer)", "value": "a3881dfafe2384ee33c8afb5eeda3321", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "3ea6914b-03a0-4376-9d14-45b667b2296a", "comment": "Malware payload (LummaStealer)", "value": "d76391b6dca2b5057a0adfb446cf6f80e9be5ec4241cfeddff6e1ca03b331a72", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "e9304afa-64b6-4f11-b3f1-c6851e77833d", "value": "T131C6384BE8A145E5C0ED8138CA269616BE717C884F2477D76F60FA242F77BD0AEB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "a5eca421-de14-4862-81ab-e79904718a52", "value": "c595f1660e1a3c84f4d9b0761d23cd7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "317acd5e-ea24-4afa-b0aa-864fd347d0de", "value": "98304:aZk0DmCo/QsZoE4nXskWlHPT0+l+QYCSZqyaLHEAopERPC6ALz7rvZQCRJp:5Co/QsZB48f7MQYCJykkA0EBpALPBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674902, "uuid": "5b5cba29-8f12-48be-849b-f07f7a347bd2", "value": 12119552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "ba8e528f-a09f-42bf-8d67-06dc1ac68587", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b181e170-4fbb-11ef-ac1d-82aee05be84a", "comment": "Malware payload (SystemBC)", "timestamp": 1745674902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "bd59dde3-8321-46b7-b3ec-f27f74a2348f", "comment": "Malware payload (SystemBC)", "value": "4c3049f8e220c2264692cb192b741a30", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "185.215.113.209", "colour": "#280624", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "c1e8d7b5-53da-4590-8c25-d5d2b76ce3e2", "comment": "Malware payload (SystemBC)", "value": "7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "185.215.113.209", "colour": "#280624", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "256e9ea4-e317-43b0-b896-44cb99def409", "value": "T1DD158E59E7E808F8E077E138E9525916F3BA3C0D4370869F13A6556B2F273E09D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "257f96de-b302-4cc3-9897-af525a20d875", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "a0172877-75e3-465b-aece-edba5df8ec39", "value": "24576:juDXTIGaPhEYzUzA0aVuDXTIGaPhEYzUzA0bZB:KDjlabwz9jDjlabwz9dB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674902, "uuid": "64c1a49a-db29-4725-b8b0-0029fedb14a5", "value": 920376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674902, "uuid": "dd6ec06a-77b8-43cf-b1c0-68f5f12d1a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8580add-61dd-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745674903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674903, "uuid": "83bc86e5-4e53-46fc-ba04-dae318237b78", "comment": "Malware payload (Stealc)", "value": "7a02aa17200aeac25a375f290a4b4c95", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674903, "uuid": "af2573cf-d045-457c-b84b-acd40aa8d984", "comment": "Malware payload (Stealc)", "value": "836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674903, "uuid": "09e0dff9-1d5d-4165-a772-9ca4c727ac0e", "value": "T136147D30F543403DE5A205FE6ADE5F6AE85D6D321320C0D763E26B8C26E11F5A875A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674903, "uuid": "87e9f2c2-6803-4665-9494-5cf966af5e4f", "value": "75f38a281962eafd8c14d2b02cfcdab6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674903, "uuid": "524a8b1d-fa02-4c76-b005-8f9f3b00e84a", "value": "3072:QJlVTFj5qDao8KaxfE54HnnGSail+bOX8bX60UFHJKa:QJP5j5Ka2aOanGSabY860UFpKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674903, "uuid": "320edcb5-4392-453e-a197-5e3dc12a3208", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674903, "uuid": "252e6e4a-e73c-4b3c-bcc9-5bf30a102930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49cadcc1-81b9-11ef-afe5-82aee05be84a", "comment": "Malware payload (njrat)", "timestamp": 1745674903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674903, "uuid": "839a1e3b-8d15-4a4f-9c68-338e2d23ae7b", "comment": "Malware payload (njrat)", "value": "87c051a77edc0cc77a4d791ef72367d1", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674903, "uuid": "5862c010-0cab-4a23-b3c3-64aae8faa99a", "comment": "Malware payload (njrat)", "value": "b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674903, "uuid": "ae9acb16-7d4e-4504-95eb-d4ea43437f2a", "value": "T1A80523030FEDC667D1E10EB2183381698AB2F89F05B1E66B43A08F1F3175E459A5A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674903, "uuid": "892add72-8dff-40c6-aedc-e433549724b8", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674903, "uuid": "baa8a033-48d0-4c63-a579-3d003679d74c", "value": "12288:FCxMe2dk7YgL+OsQdFGHjaRYf9bquEZ68ufU3wqB2ydPsW/w0bvf:FsMe2KYIDpSO5vZ68FwqB2aPsW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674903, "uuid": "b9bd3c8b-cffe-4af6-9d98-1aa81439ac44", "value": 830415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674903, "uuid": "82b9d601-3113-49ba-ad1c-2c740ae61e05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3825b7f1-62bd-11ef-ac1d-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1745674904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674904, "uuid": "83c0125c-9c7b-44f4-8e92-7c4c2ca62bf0", "comment": "Malware payload (AsyncRAT)", "value": "31fa485283c090077fb15a0831fd89f7", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674904, "uuid": "e145431c-c946-49ab-a060-93b7d17d78e6", "comment": "Malware payload (AsyncRAT)", "value": "32268f4d7203997102b3e92c592dc498e407f0d8786a1107d633d9495fc9f2b0", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674904, "uuid": "af23d8fb-a40e-4bee-8547-c5b182fa4b42", "value": "T153C31283775F4F42EB9D813195E13390B32646D9161EDFEEB0A894823E3734819673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674904, "uuid": "f0f5cf40-cad7-4153-b5ba-265ba73b4c98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674904, "uuid": "09d2ed90-3444-42f6-83c6-7c854d20fcd3", "value": "3072:xBuOLHvgPzYnl8YZ0vOeXws/v7ZEguR7fIZr+Crqxstpn6V13Yd:XHZeYZ0v3wsaPQCIz6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674904, "uuid": "60ba4343-f1da-4d17-aaec-fd7627bf0361", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674904, "uuid": "cd09b563-867c-4697-b1e0-0453882d4073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1518416f-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (njrat)", "timestamp": 1745674905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674905, "uuid": "18cc5cb3-4e4d-4032-abb2-ebe55fd5cc48", "comment": "Malware payload (njrat)", "value": "19574d1c471ceaa99d0d05321e7beba4", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674905, "uuid": "956c8721-24e4-44d1-9229-44d329b55219", "comment": "Malware payload (njrat)", "value": "df606ef08b80c10d12a7372505f51e2641b263ded0280edcaf9085e7419b5f3e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674905, "uuid": "842f2e77-4939-4e96-a476-3b21fab96be1", "value": "T10F661AE17606B2CFD58A16B4E813DE83D51C03F64A258A03DC6D787D9E53E9621CBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674905, "uuid": "5ef997ae-d4b3-4c02-ba6d-521dfa29205c", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674905, "uuid": "acbcef52-d16c-44d0-815b-1747b1cc31ab", "value": "98304:ytpOyr9VNf1P2tLnkJfA5Wmon5miZlE5aJ4aoAqq1k4MjNU+3:Z+jZ+5NgFbMy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674905, "uuid": "d93e298b-ea0c-4126-bc74-9cf8df453d6f", "value": 6807040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674905, "uuid": "68f62251-f8f3-4adf-8b7d-9e60d0a7d9a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2240e8-5ef1-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745674906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674906, "uuid": "d91da2ab-12d4-40c1-871f-20e0a1bf6448", "comment": "Malware payload (CryptBot)", "value": "37263ede84012177cab167dc23457074", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674906, "uuid": "7736f62e-708c-4530-87ca-138bfcf8a137", "comment": "Malware payload (CryptBot)", "value": "9afd9e70b6f166cfc6de30e206dff5963073a6faeff5bcc93ee131df79894fc2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674906, "uuid": "2d5e942d-9f7f-4c24-af8a-48d7433911fd", "value": "T13B66053A9B4341C9C13FA57ADC927F3FF4286ADC4369492B6C0508BCA756791E8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674906, "uuid": "af19c301-ad7f-4182-b548-6f82cc632f18", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674906, "uuid": "088f6db9-231a-4c66-940c-1f8a6ff461db", "value": "98304:RYXXi4g+Xlxnn0wG9lY/3HeEqD1iG05rY:REXiJ+Xlxnn5Ydpb8rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674906, "uuid": "a253d62c-0899-4152-b4e5-17a5f4f4680a", "value": 6651227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674906, "uuid": "906113c0-ab7d-4167-87b3-89f00e56b629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75f8ad9-4f64-11ef-ac1d-82aee05be84a", "comment": "Malware payload (XWorm)", "timestamp": 1745674908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674908, "uuid": "8520e548-399c-4ca2-8abb-4e61f31cb4ef", "comment": "Malware payload (XWorm)", "value": "d94cf1913f3dbee17014f7a765c09d4e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674908, "uuid": "597454aa-4afd-48b1-9925-6a1ce50fe939", "comment": "Malware payload (XWorm)", "value": "53808353c5ea94f91b9b1b3477805d1d49460533676e8ada3ea16fc406a30b6a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674908, "uuid": "0d6c20ee-1b8e-4f5f-b0e4-5b5e060508c7", "value": "T1B606330376C8C5B2D03724729B686B10A57CBD205FB38ACB83951E9ADF711C1D726B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674908, "uuid": "4368713d-3e84-481e-835c-c1c73ab1f8c4", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674908, "uuid": "5ced2f82-3031-4273-a16b-811690d7cbd1", "value": "98304:nTQ/bVZ7wW/fhUOXPbkvtexT8aWeGCcIol0CtFPRwVuTM:TGzN/JxKsx4aWeGlIoaAZwVoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674908, "uuid": "85bfeda8-717b-42dc-8d83-7d97e1462e69", "value": 3797507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674908, "uuid": "ba242230-e15a-49ea-bc98-fdd964afd763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49b004d-5720-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674909, "uuid": "d2401803-dcb2-4443-b1b7-0813697ebb7f", "comment": "Malware payload", "value": "eb2e78bbb601facb768bd61a8e38b372", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674909, "uuid": "3dd954e7-ab5e-46b1-99e9-7b996ba262d7", "comment": "Malware payload", "value": "09d97363cb679a12a09d9795569b38193991362c3b6981d7154b17d34f36f8cf", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674909, "uuid": "f3337466-9f8f-4c27-8620-f095815acfb7", "value": "T162726D639BE85E23EC6A6E3539FB4A110279F7424D55CBA7238EC2090F233D45B523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674909, "uuid": "2805d948-ff89-47df-8c94-a52c31fc3399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674909, "uuid": "37260ac5-3554-46af-8bb1-120db899af47", "value": "384:lwunIyqtyIEjRsVN20cunyGTVAM+o/8E9VF0NyPNjHE5V:kyyyI6sa0cgyGTVAMxkEdN7E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674909, "uuid": "c8fdbcf9-516b-451e-b89a-3c3599d1de60", "value": 16344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674909, "uuid": "9251ed3a-4767-45da-b74c-d43334a4bd54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7540a42a-7114-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674909, "uuid": "c907c2f1-487a-42aa-a4e3-7e25302f3efa", "comment": "Malware payload (RedLineStealer)", "value": "ec23d4868753f523df127f531451dcbd", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674909, "uuid": "c53e3652-c56b-49ed-94d8-17bb0d7fdc12", "comment": "Malware payload (RedLineStealer)", "value": "5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674909, "uuid": "ec1705b7-81c7-4afb-8362-11899da61832", "value": "T16845120174E18072E472153605E1DBB5AA3DBD600A924EEF67F50F7E9F243C2EA349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674909, "uuid": "b973ef6d-ab38-4b24-a69d-1c69121fde2e", "value": "53ff33fd5198e78ab468db682bbdf2b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674909, "uuid": "30821f5b-375d-4206-a80f-3ce928cfb7d6", "value": "24576:gtZEVdQRVaNvxIA65KTVpSTS0tZCQmGD8aLfySdfZnPsRcTb1Mgk2Uet8Pl4NJF:+ZAdweveA6KTeTS0HJmEJag13k2Uy8dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674909, "uuid": "9e8a09b6-6517-4f50-8f60-4715714d85f4", "value": 1165824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674909, "uuid": "6667764a-8e2b-4c05-a7e0-847d33497357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20f532e-8506-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674911, "uuid": "ef6d3755-2686-40c8-a48f-4ed9bb93179b", "comment": "Malware payload", "value": "a1264b7a67771b5d0224d179edcd5a50", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674911, "uuid": "ae5c5c64-f332-4f0a-9ead-4d8bb6073ea4", "comment": "Malware payload", "value": "ab18f8db9ae857fe8a663d968223a605bfdc3a268b501a5d46eefa4495cbed6a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "eacf8309-6f6f-4b6a-979c-8a81fb09be15", "value": "T1B344402867C8FB50C864A3B223F7835643F44CEE4371622F5E2879B16EE19F57B464", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "34c79ba6-f68c-4b3a-88e0-94fb0774a9ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "97a3cabd-1545-44dc-9237-d64e7c26d788", "value": "6144:xAyeq9D7RHvVlpeTFwbqwxUTr2oPIfOJfhtKbA:/Z7vffOJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674911, "uuid": "61507eab-b153-4ee5-81c2-24b47d6dea8e", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "dbbb3314-8357-4531-bace-13a99e77bfe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d692a8b4-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674911, "uuid": "fce1877a-5bc3-4c22-aa82-9845e001c883", "comment": "Malware payload", "value": "4d8b83fd5e8720909cccd163de5d9951", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674911, "uuid": "4d38c94a-5b69-4850-9a8c-839305fb61e5", "comment": "Malware payload", "value": "f0434db947410b795adc6a09d0da496ca07edb50ae8af72960d42ac8a89dfa29", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "8800fdce-e086-4932-b04a-d7236142888c", "value": "T19C762332E1514032F6F102B3F939A6307E7CB73823558869E2D4AD1D6FA849277BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "b85e51c3-9e4c-4b3e-8704-12248871e71a", "value": "d7e2fd259780271687ffca462b9e69b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "79397ee6-3851-4203-b180-5bda9aa831d2", "value": "196608:MfUDsNThCuFSx7x9ukkAJOdc9b5SFVf4dT5D:cIs9sxLTEdcB5K2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674911, "uuid": "d029bf3c-4668-44c3-b8de-2ea69c92be5e", "value": 7647016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "14f9213b-0aaf-46b6-bac0-85bb15c2eb72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578be6e1-79d4-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674911, "uuid": "8ca1566a-7328-4501-8371-2c5e444b5cd3", "comment": "Malware payload (LummaStealer)", "value": "2f1d09f64218fffe7243a8b44345b27e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674911, "uuid": "a30d4e42-469e-4859-abd4-5536757b38a8", "comment": "Malware payload (LummaStealer)", "value": "4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "704bb786-b1e7-4905-b5fb-948e8c91f27f", "value": "T1F4746B8AEF5782B1FE4A417960D5AB3F8B351B212334C8E3D794EF04E8636E151766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "33e078b6-3994-4d54-9e12-6474627f85a3", "value": "8a08f05f951e29daf72a243fb2aa4e67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "18a75b6e-db59-4f07-b543-3213dbec9142", "value": "6144:yEIbJdhhk012D9kEsrwRdvwoShfvM4MH0RoeAcGho33vXvIKgI5TdFaA51TIrxLD:yEIbJvhk0azddWtyA51C09ssEN8mhGfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674911, "uuid": "881deed8-f4ca-4fff-b7c3-ae8ddc2b7bcf", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674911, "uuid": "24525fa0-6b34-41a4-ac12-35d87441cc5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0901aa-55a6-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745674912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "1c940e28-bec8-4a8d-a89a-b28606cd1de2", "comment": "Malware payload (Stealc)", "value": "e78239a5b0223499bed12a752b893cad", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "217041d6-adf4-4b58-bde8-f94599104d57", "comment": "Malware payload (Stealc)", "value": "80befdb25413d68adbadd8f236a2e8c71b261d8befc04c99749e778b07bcde89", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "24fcc53c-1fcb-41e8-8579-1eecc7149bff", "value": "T1B3146D30F543403DE5A245FD6ADE5F6AE89D2D320320C0D763E26B8C26E11F5E975A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "39f24163-eab6-4e45-a62b-329eacccf54d", "value": "75f38a281962eafd8c14d2b02cfcdab6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "1faa8e36-f00e-4a87-bf8f-3ed1d5574260", "value": "3072:Wk9W0KFj5qj6o8KaxfE54HnnGqaKl+b2n8OwW1iTtFmpKa:Wkg/j5K62aOanGqCbAvgFAKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674912, "uuid": "054e6609-fcf4-4705-952d-b88a79fd7905", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "17eb18b8-88ae-446e-92bd-874a9160e2aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eeb2056-5d93-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745674912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "56638375-6b92-4cf8-af74-f9ee890d695e", "comment": "Malware payload (CryptBot)", "value": "d2f4d9f256c7535760e18337e4076d9c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "03eb5d9a-7a82-4503-bbc7-c2a65739dad3", "comment": "Malware payload (CryptBot)", "value": "6697bec4864bc595b26ed998bb6e2c7cf66184fbce450b808f5707a5213e71a2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "39ebe221-b5e3-43ce-9989-729615f3023a", "value": "T1C066F63A9B4341C8C13F657ADD827F3FF8286AE843A9591B6C0508FCA755791E8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "e8297bd9-a40e-416f-8c83-59c2a392ae7f", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "a543b09c-c6dd-4ecd-ba27-c43450db7165", "value": "98304:zeH/hGbUkusYRViahVrCTyaeZlWA1GiTd:zK+U6whVrmyagWAYcd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674912, "uuid": "8fca8b62-8d65-4add-9ac2-65619b458e35", "value": 6631722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "2fa035c3-b12e-41b2-8593-c725dca8828f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00cdd80-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload (VenomRAT)", "timestamp": 1745674912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "5ab4ec8a-deda-4d2a-9aee-d5d16e149355", "comment": "Malware payload (VenomRAT)", "value": "0e43108aac7bb6e9f68d769b746fea16", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#31D98A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "1c53842d-40f0-4d7d-9e75-c5204ec06d1a", "comment": "Malware payload (VenomRAT)", "value": "931a185152c1d316cd2b65998aee88d4f64f4acbe59df3efabb0ff968fa6c993", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#31D98A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "6367eb20-67c5-484d-81a0-0d578941dcd6", "value": "T15945124D0AE49E4FDD220F3C7AA4772DA2B9E0D03C2D920567F3A9D72990FC46D895", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "b3bcaaf8-dd70-43de-ade0-a3e904ab03a9", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "9165640b-a6d6-46fa-a867-1a9a0e76fa93", "value": "24576:D9e1IHkIpNfvY092Y1f9t2JZVJ+TJV8felYpYtx8zkUa:DUmHpBNv9UJZVJ+TJVuiMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674912, "uuid": "c415679c-03ff-4aba-8484-e1a475e7ad3a", "value": 1174860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "b2cfa3ea-66e1-4f58-a9aa-e39b2700c3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417fb717-5bdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload (StormKitty)", "timestamp": 1745674912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "050ec703-6e05-4360-98f1-d3427bccfbbc", "comment": "Malware payload (StormKitty)", "value": "ff83471ce09ebbe0da07d3001644b23c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#9cf321", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "6b9fbf5e-0d17-4348-8b45-bc3f852b82e7", "comment": "Malware payload (StormKitty)", "value": "9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#9cf321", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "c73e79a7-18e1-4bd4-a71e-81f3553338dd", "value": "T1DE650163A718CCBBF29A48F2E467D53018F2B55D45E4922F85EC6A15B59330328FF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "0a6009a4-57db-4ca9-9979-4cf693a35c4f", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "eb5a14f9-5408-49a6-a9e1-3a28addd2e2b", "value": "24576:nK7tMGUfQtpOdk3xWBq0qWH6JubmMTzfZwLDC4pZylqUAc2:JQ7AkiqQaJjMHWvlpOqUt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674912, "uuid": "a05528b2-ba70-4d26-a9a3-5d3ef21b7b55", "value": 1544729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674912, "uuid": "542dd2c0-c6e1-445d-b913-62ca52cc5aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e7e709-5ef1-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Vidar)", "timestamp": 1745674913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674913, "uuid": "5dc87f02-5e82-47e3-9c2a-a91c7e3d03b3", "comment": "Malware payload (Vidar)", "value": "6f858c09e6d3b2dbd42adc2fb19b217b", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674913, "uuid": "1bb5d95d-4ccb-403a-bccf-8a432a6ca556", "comment": "Malware payload (Vidar)", "value": "f6b2cd5327818418db45f70ed99bc6751d836eaf503a9bf33602af0c74f61e83", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674913, "uuid": "24f82612-b8d6-476e-8702-56f2b2993de9", "value": "T13825234B54304593FF490D30C26DE03B0EBDAEEF83D62196B95826383EC4F856B6BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674913, "uuid": "16f76ccd-90e9-4146-bab5-67b9cf53ecf2", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674913, "uuid": "8e10e920-979f-459f-9315-c6e0eb473d6d", "value": "24576:DzZkHUqsNgLbcSxM2RczPgnAK+vYOLtfIPOstlO5q:DSHU3ecSjoPWX+TLIOstlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674913, "uuid": "07358509-3ce3-4b8f-9aeb-54cb5e30a76a", "value": 972074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674913, "uuid": "be0e0257-6112-4956-8359-6e4d5544193c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e76cfb-5bdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674914, "uuid": "7029071a-cbc6-4e8f-b680-4550f67e9896", "comment": "Malware payload", "value": "e97f5c3efb2cc80e001129383d5a0132", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674914, "uuid": "d34f504a-0381-4e84-93d0-2718daaf37fc", "comment": "Malware payload", "value": "cc7a419834271b80acc994fb2a93988be5ca1c112e6302dbf57220f635fd385e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674914, "uuid": "5fec49bb-6bdc-4174-b68d-55bbc6f547f9", "value": "T18D754F20461D8DDCC2FC12B17BA39A6556F2C58C7CB1EB131E4684BB6ED83F628E60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674914, "uuid": "545f2196-8ebd-4210-93f0-c13801fa98b9", "value": "24576:XtT1LB2uuADSFT9JKmGafVoXiz+8x86E0qzxD8xMd4AxLxXbO:9T1LB2VADSp9JFGadoyz+SYxD8xM/Xb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674914, "uuid": "1d359eed-f93a-41f3-b520-0af8ea167283", "value": 1692672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674914, "uuid": "d7c5e3ef-3e49-48ba-92e0-8020e19f35e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818a8341-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload (SystemBC)", "timestamp": 1745674914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674914, "uuid": "bb026ec4-8f06-4364-b959-159fbe4430e0", "comment": "Malware payload (SystemBC)", "value": "eeecdefa939b534bc8f774a15e05ab0f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674914, "uuid": "8b856044-e97c-418d-8768-652a2e2860fd", "comment": "Malware payload (SystemBC)", "value": "3bdbca5f67754b92ff8d89e2db9f0ed3c5d50f8b434577866d18faa4c1fd343c", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674914, "uuid": "cd9f8afe-bb41-42f7-8cf3-2ca338e56b93", "value": "T1CA158E59E7E808F8E0B7E138E9525916F3B63C0D4370869F13A6556B2F273E09D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674914, "uuid": "7509f57a-ad51-45d7-85c7-9d3b15ed7a8c", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674914, "uuid": "3c1d53d3-d2a3-4c67-8141-77e75325a3d8", "value": "24576:juDXTIGaPhEYzUzA0aCuDXTIGaPhEYzUzA0bhK:KDjlabwz9QDjlabwz9lK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674914, "uuid": "63a535e0-bf3d-4288-91bf-38917915b345", "value": 920379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674914, "uuid": "f6c9093f-609b-4030-a49e-cba937941691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13607090-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (QuasarRAT)", "timestamp": 1745674915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674915, "uuid": "d792784a-b4c9-4d0e-9952-8dede1415f9b", "comment": "Malware payload (QuasarRAT)", "value": "3bb8ce6c0948f1ce43d5dc252727e41e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674915, "uuid": "811779da-992e-49fd-bf78-3678e7ef745d", "comment": "Malware payload (QuasarRAT)", "value": "709bddb0cbd2998eb0d8ca8b103b4e3ed76ca8cdc9150a6d0e59e347a0557a47", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674915, "uuid": "d70ba865-66cc-4500-b4db-ecea307e1b8b", "value": "T1EC36125BABE0D21D65C68A4E247085676DB33E05FBF4F1F7B22C8CE8324DD94609DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674915, "uuid": "a25d6d00-c0ab-4d48-82d3-31a356742593", "value": "49152:LxeCc2umUDF0sOCPtxKhir0HHypctekTQkQ1XIn3S+N7CASjZfjFzzp:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674915, "uuid": "8908e245-3956-411c-ad67-c68817f678d4", "value": 5044224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674915, "uuid": "ee402fc1-faf2-41b5-a601-db97583709c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7a07ec-702c-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674916, "uuid": "6a2256c5-db7d-4c22-b18f-0b3016a56b11", "comment": "Malware payload (LummaStealer)", "value": "36a627b26fae167e6009b4950ff15805", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674916, "uuid": "b033cf34-4a36-4022-b988-72abd799b09c", "comment": "Malware payload (LummaStealer)", "value": "a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "60331b3d-243c-45fc-99ba-122954e471a0", "value": "T1FC463801FAC744F6E903193044A7A37F63356D0A8B29DB87FE647B6AE9772D10C362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "e21b0a5b-7121-4933-91a9-fae279047777", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "4649976f-6da1-4cc2-b86d-c471b0248194", "value": "49152:NXJxAIQfc7wXnJu1U30/jo5UJZUntHvVkgKJswamhqp1ROjyj/2wW0j94lNI/pB+:BAIdik7/junt/2wr3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674916, "uuid": "3eb544ef-5f0b-439d-924f-53aeb2c4f2c4", "value": 5562368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "11980ded-6229-44f6-b380-1945ff4d8ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3007c8c-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload (PythonStealer)", "timestamp": 1745674916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674916, "uuid": "03e1a08c-7b9f-4f33-8ef9-0120304160b4", "comment": "Malware payload (PythonStealer)", "value": "da1695dba8bd25d00e05e7769d6d7e8e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674916, "uuid": "4960a225-1912-459a-ad98-88a3165ba10e", "comment": "Malware payload (PythonStealer)", "value": "7166d6cc2435061f32cf982dba8f6ec27fc23a46c9705aa52fb2ba08eb7011aa", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "c3858c35-7afa-4b58-b3fc-ae568ecdf52c", "value": "T16A073346929008B2F6E1D1389516C97BF732B0100754E2BF1775B2292FBB3535E3DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "a2ef903e-72aa-40d0-bc84-5f57dddd9a26", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "e44f4b99-bcba-460f-9f80-0aad709ed21e", "value": "393216:uEkMDn78nxpUTLfhJuW+eGQRCMTozGxu8C0ibfz6e57xeBOxImR07KWHOcpd:uUDn87UTLJ4W+e5RLoztZ026e5VeM2KM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674916, "uuid": "e6582a41-e117-4ee7-b149-a8d19a94a2c7", "value": 17171619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "13f47c5a-fe5b-4a88-96c6-5ed318831c22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad5e331-8f03-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674916, "uuid": "91004dcc-3d26-45ba-883c-ffa3f7501999", "comment": "Malware payload", "value": "c3927a5d6de0e669f49d3d0477abd174", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "teslacrypt", "colour": "#416d44", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674916, "uuid": "15d320da-cb90-415f-acf2-efa5df297d29", "comment": "Malware payload", "value": "f430f588aad57246c8b1cd536bc9ae050a4868b05c5dfaa9b5c555f4593a4b33", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "teslacrypt", "colour": "#416d44", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "b52ec6d6-fbd0-400f-acc3-5dfc18a77ac1", "value": "T100448C11B892C472D1B205336978E726567DB8300B685AFFB3D85A3EDEB01D16732B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "397f3e09-e6b5-4046-b65d-b0682c76dc8b", "value": "c6971b8ffe6ea217a1c47a178402ba28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "9e5c0506-ee7d-45a6-aab5-45f9df97bf6d", "value": "6144:pFQ66iAtfKMf8jiOvNLoLbAOQvAQyRvMj:/Q6Hqff6RsS40j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674916, "uuid": "1bd73b00-8554-4c29-99da-d2d5910b7cef", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674916, "uuid": "ef26548e-8042-448a-82fe-df10ef2bf62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7585ca2e-f2e4-11ef-a514-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745674917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674917, "uuid": "64ed1c6c-4d9f-420b-be23-1d848f210127", "comment": "Malware payload (CredentialFlusher)", "value": "e9a8537a4efba5386c2a5adf0355eb4b", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674917, "uuid": "dca51bb5-4f49-49fa-99a1-88b6a4c6e273", "comment": "Malware payload (CredentialFlusher)", "value": "e1cf2ba38614911db7f8a5f595b03697f76c79fe0de026f3571090db401b2c25", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674917, "uuid": "2be6aa27-5417-479c-b4d1-fe72116cb9ea", "value": "T146259E027391C062FF9B92334F5AF6515BBC69260123E61F13A81DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674917, "uuid": "9b1c6e5f-5e94-4db4-ba44-17633e8af5e5", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674917, "uuid": "6d20dd4e-83f1-43c3-9fa2-a619ea0f3e69", "value": "24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8a2CWuR:mTvC/MTQYxsWR7a2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674917, "uuid": "a5cae639-54f1-439f-a375-688e8f490685", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674917, "uuid": "f88fd7bc-7c54-4b09-9ac9-507d7c758777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e9f078-8677-11ef-afe5-82aee05be84a", "comment": "Malware payload (Adware.Generic)", "timestamp": 1745674917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674917, "uuid": "6912b9df-2304-4215-802a-3ff2e600a5ea", "comment": "Malware payload (Adware.Generic)", "value": "0d43698dffc5ee744f805a699df25c00", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674917, "uuid": "9952f0c0-96b3-4b97-9914-49772671d5f4", "comment": "Malware payload (Adware.Generic)", "value": "de14c3b860519dc781aaee813d4fa3adc67d7653c544327f8d26d5b386564712", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674917, "uuid": "bc913fa9-aede-43c2-8564-ede65b740a0d", "value": "T15085CF3FF268A13EC46A1B3245B39310997BBA61B81A8C1E47FC344DCF765601E3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674917, "uuid": "5e4aa3c8-f42c-44a0-a3d0-09d8cd5096d7", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674917, "uuid": "c3bf56cb-bf03-4d84-a5a4-46a90599a7ad", "value": "24576:s7FUDowAyrTVE3U5F/ZGqKUA4Kic6QL3E2vVsjECUAQT45deRV9RY:sBuZrEUMz4KIy029s4C1eH9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674917, "uuid": "715fee8f-d161-43b0-97ed-db5aa8fb6b53", "value": 1764368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674917, "uuid": "0f2bc46f-bb86-4d1f-a200-a3836682d22d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15440b2-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674923, "uuid": "ab9401a3-176b-4aa3-b775-c4dd02ef0392", "comment": "Malware payload (LummaStealer)", "value": "6b470f7251aa9c14d7daea8f6446e217", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674923, "uuid": "543b7e3c-a9f2-4be5-928e-3e3d78ffa7f4", "comment": "Malware payload (LummaStealer)", "value": "8b9097b795d42c49c3b2c560714226361671a3f1d711faa9aeaee20e22e7095f", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674923, "uuid": "11117be4-f5fb-4fcd-a729-7ed8638b5c73", "value": "T1EE7423E0A4EAD27ECDB5443188E317B6D5F58A7E806F177B2462B27E4C18749223FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674923, "uuid": "b439891a-7e44-4f6e-ae99-0c8e6379160e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674923, "uuid": "df2ea8fc-dc21-4e52-807f-c8bb5cde4f19", "value": "6144:A9qV5P6oqa2R9xVnirCMSaMp1iXh7Dvnj+c60jNyRBEKjbXIEloBTOZu:AOB2Rx8/4p1ix/njn9knbvlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674923, "uuid": "c6b28f19-6f51-4511-87d3-2976b5bcfdc0", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674923, "uuid": "d3d985db-60eb-415b-90ab-c5abbf04aa29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f1d683-8506-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674925, "uuid": "2948f30e-a8b2-45f7-a0f8-34c9faeef457", "comment": "Malware payload", "value": "4799d8fe5e03634f8c5fe0b040194520", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674925, "uuid": "ba4ec04c-de49-4709-90fc-5c77579f6bc7", "comment": "Malware payload", "value": "58154750186d6e8a6f4e06ed3d458e2f279019b6f35e20992a879079277cc6a0", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674925, "uuid": "c352a091-1f34-4c6d-a8de-043c89a40a79", "value": "T113435368BBC5EF70C8245AB022F3075443E9D899D2B1A31F5E18AD613EE25E97F414", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674925, "uuid": "e0838c89-e214-4f3a-93f8-676e172c785e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674925, "uuid": "65fc9be9-2028-496b-abe8-c2a5f56e1f68", "value": "1536:CYuBs94669XxrnnPLBA/fctKl5yNAJjQoTXZzwU2WbM:CZ669XdnnPLBA/fctoyNAJjQoTpzrbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674925, "uuid": "fec0ccd7-7aba-4f1c-87f9-1ca82bfbe977", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674925, "uuid": "43e29d7b-1a13-4dad-90c9-5c4b97eebf89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3506712d-7a8e-11ef-afe5-82aee05be84a", "comment": "Malware payload (MeshAgent)", "timestamp": 1745674928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674928, "uuid": "a4b3bdd8-b4d2-4f23-8457-b0a6029aa0ec", "comment": "Malware payload (MeshAgent)", "value": "749bd6bf56a6d0ad6a8a4e5712377555", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#985f9d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674928, "uuid": "eb977d70-e114-46e0-a4fd-8b5c898afede", "comment": "Malware payload (MeshAgent)", "value": "e6148c7e8cec3a4565e97a139d2b09dbdf2f30460054fa168624fdc1050421d3", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#985f9d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674928, "uuid": "e18d742c-d0cd-40b8-8370-c06d743f78ff", "value": "T1E58522982074D527EE243AB74B49C4978C3E5D768FAC6F072E523FAADD3098ED7092", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674928, "uuid": "fefad786-c367-4fda-8303-510f7875b5a1", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674928, "uuid": "8b960616-00e8-4b7e-acf1-466b6d10fb97", "value": "49152:UkQletNpj4NmwF1tBE6BAfTm9k9MJsuAfChboFtcZo:UFletXjoD1tBEc90XCo6Zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674928, "uuid": "cd2e393b-3c93-4633-9ad2-980dcf57d96a", "value": 1873695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674928, "uuid": "6f615f2c-3bbf-4080-8309-7b0011577236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9884f6-81b9-11ef-afe5-82aee05be84a", "comment": "Malware payload (XWorm)", "timestamp": 1745674929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674929, "uuid": "41c0e6bb-0aed-491e-b7b4-0d43d4e15bd1", "comment": "Malware payload (XWorm)", "value": "1ef39c8bc5799aa381fe093a1f2d532a", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674929, "uuid": "af698397-e139-418a-b742-82c051614311", "comment": "Malware payload (XWorm)", "value": "0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674929, "uuid": "f1cd1a9d-fc65-427e-857d-8501a458e871", "value": "T1AE25231C57CA50AFC9581EB839FB8B8A13F98A97A443D712F9A51820416FFFD3E011", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674929, "uuid": "f8a9020c-149c-4ff7-a1a0-5e01604c3f52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674929, "uuid": "fb3ecdfe-609a-4f7e-9bde-a67307f63433", "value": "24576:6MGVJ/Oap+Bh45LEwaV1QghDHm5GQTSmGg:6NJ/jpi5waVhjm5GQ2m7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674929, "uuid": "8d4058a0-c99d-4997-aebe-67c8d41307de", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674929, "uuid": "4cc2e0ad-421d-4e08-8380-184c84b74d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dfbcf7-4acc-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674930, "uuid": "ceea8b86-18d3-4748-a27b-fdbf635e8e12", "comment": "Malware payload (RedLineStealer)", "value": "a9a37926c6d3ab63e00b12760fae1e73", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674930, "uuid": "2d4ce0dd-6cf9-4040-9d00-44d54d9255b1", "comment": "Malware payload (RedLineStealer)", "value": "27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674930, "uuid": "064b04de-a976-4291-8e76-a6c3d25acf3b", "value": "T196646C1867EC8911E27F4B799471D2749375EC56A512E30F4EC06CAB3E32741FA21A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674930, "uuid": "4ded062e-2c58-4ca1-b2c7-ac8ee2c7b558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674930, "uuid": "bdb47226-9a06-49be-a28e-56f552c63c54", "value": "3072:aq6EgY6iQrUjGk14lwPK4qw9LwwPITAztASKwlcZqf7D34leqiOLibBOh:ZqY6iwwPIknATAZA+lcZqf7DIvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674930, "uuid": "de2c24a5-0046-4d3a-8cb1-b672dbb8d6e5", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674930, "uuid": "f78d2bb9-85f2-41d6-9692-1faaf6832dc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f019e8c2-4cb8-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674931, "uuid": "33326dd0-6a70-45d9-9a71-f03057e6905d", "comment": "Malware payload", "value": "ae3dd2f4488753b690ca17d555147aba", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674931, "uuid": "c9b95fa9-c004-45e9-bb04-26c0ba44b27f", "comment": "Malware payload", "value": "77bdb3c46654446f1edffd1a388e3f64d8ca4dc24acd9575b95e94c26b8b43fe", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674931, "uuid": "58307bd2-b677-470c-8d0e-cf9e42c4caef", "value": "T1EE94E0107A85D436E1E207308C34C5F5663EBCB65EE9668B36B83F1F3E711816A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674931, "uuid": "8fc9587e-3e8e-4b43-b0f7-341e9163c73b", "value": "976b33a49b3619a38b3ab50dd40fd590", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674931, "uuid": "8dcd7380-34af-4718-86cd-c4b322040cc5", "value": "6144:aPvOGvTbPoC8lV5AdpKndv8w7UkvKw1SthsFLDXW7nX9TCR/QYZuWDv7ZNk:aPzv3PL8lV6IxV/Kmes1Dm5SQYZuWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674931, "uuid": "31cf7313-e64c-4492-996c-906486184778", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674931, "uuid": "4558e4e3-252d-4a19-bdb5-71f2c0f71cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b53a39-78fa-11ef-afe5-82aee05be84a", "comment": "Malware payload (XWorm)", "timestamp": 1745674933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674933, "uuid": "cb619559-43b0-4863-87c5-88fdb827b554", "comment": "Malware payload (XWorm)", "value": "d052b435681e5ec1b817de6dbbfe1e1e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674933, "uuid": "9c823523-4d72-4de5-93ea-4e035a4307fc", "comment": "Malware payload (XWorm)", "value": "53e566dcbba330c8ab80171c8088c90db438f499ad613b55070787b2c4bd2121", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674933, "uuid": "01aefc20-7c3b-4217-a77f-9e9abb7d6329", "value": "T17435232553A9856BDC6DA7F4E8B9D64117F0AF4AB420C3D82D94F8FE1883FC145213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674933, "uuid": "e3d217ae-ae55-4b9f-95b5-f762fb4905f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674933, "uuid": "1b26ae80-b631-40e7-81a6-320b9a359e02", "value": "24576:FrVhrEgB3DFw9QwFvslU26864l3tw4Y+2uucgw/:Fr7rEgV8QwFUU26lz5ubx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674933, "uuid": "f9fe7e32-c629-4c64-81ec-3a03ec37ae2f", "value": 1097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674933, "uuid": "d68dd077-26f1-410d-91b6-5dff57657331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d495ade-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674934, "uuid": "d6fb39bd-17a7-4256-b864-262e4d5fd335", "comment": "Malware payload", "value": "c3555ffa261822a6b1d04314c5370151", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674934, "uuid": "ef542ac7-3f7b-4ed2-9c4a-12b7349f5a56", "comment": "Malware payload", "value": "a8b4fb8e5e17df94c0caa0118382f193ec0fa63703b14d0efc12317f7b80f4ce", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674934, "uuid": "0cfcf211-b474-4cb2-a319-cc5339b48833", "value": "T192F31218FDD82A65EAF945FD38460310E827B60006AA42FB463E4CA0B6F3B5587676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674934, "uuid": "f2a4c4f2-3634-45a6-814f-93c427ee8712", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674934, "uuid": "c2fde90e-c5ec-49bb-93ee-58cd13756c65", "value": "3072:GewS32JhImIpXUeXljzm7ikzXCciWM5koxQY1ZK3d2qcyEzc5:GeR3tmIpUQl3QikzPHM5koxQY1ZZvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674934, "uuid": "cdcf2b87-805f-4035-b676-5bc48970dc34", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674934, "uuid": "a005e9b1-2faf-4292-8d27-8bd85ab0aa5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00318fc-8bcf-11ef-afe5-82aee05be84a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1745674935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674935, "uuid": "34dddabc-47cb-43d7-b538-49c1c6181e02", "comment": "Malware payload (RemcosRAT)", "value": "13095aaded59fb08db07ecf6bc2387ef", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674935, "uuid": "a13d89f6-19fb-4808-9fc0-82b5beb994fc", "comment": "Malware payload (RemcosRAT)", "value": "02b4e1709e79653e9569bf727301f92d4928726ba69d8d764db5841b94d63671", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "09244bd4-f10a-48cb-93ad-f46ac3d4b7ae", "value": "T1C2B49E01BAD2C072D57514300D3AF776EAB8BD201835497B73EA1D5BFE31190A72AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "d4394620-80bf-4317-b91d-361020b9ad32", "value": "1389569a3a39186f3eb453b501cfe688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "ea425b35-d2a3-46cc-988e-bd60a3407da3", "value": "6144:iTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcr/T4:iTlrYw1RUh3NFn+N5WfIQIjbs/ZXgT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674935, "uuid": "d9087a35-98f7-4354-bc70-3f4d3f1a5ffc", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "918d82d2-a876-4623-bdd6-d4222a9fb80d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "772ac349-1932-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745674935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674935, "uuid": "e47eea37-8944-41db-b46b-2478fe86249f", "comment": "Malware payload (Amadey)", "value": "3ec886e81b3a5649ff9dac6d88baba96", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674935, "uuid": "39377af3-704e-4727-aac5-03f5e053e69e", "comment": "Malware payload (Amadey)", "value": "ecc4cde448fa9b09bffc77555b878e1656ac4e5c6c4218b08078ee85b1b8f8d5", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "a9dfe240-3aa0-4070-b9be-e73ca3a3ecad", "value": "T115945C217813D032D66291721F79FFF585ADA8259B7109DB7BC00F769A202E27A31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "cc89fb96-21b3-4aed-9d52-511521470656", "value": "1e7280afbf80c2800b272220ce0718da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "f683eb67-824b-4fa9-a366-2a4bacbc976a", "value": "6144:tiUuGdolfFd313lcnGpPpnbJoHtbspmZfkCw3uWgGUS/T+WiU+9GTA/nw4AO2i2J:tiUuGdolfFd1lGkpbCVkCweWgB7A99j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674935, "uuid": "2fc8aa02-d594-4fce-85f2-8cded2dd0710", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "424866f5-c459-475b-9be2-7d898cb76195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf8a0a5-799d-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674935, "uuid": "1a103583-5996-4c94-935c-c442d5257fd3", "comment": "Malware payload (RedLineStealer)", "value": "44e17821665477b21d6c50cee97c84ef", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674935, "uuid": "5a4ed9d8-e0ab-4b34-be5f-741fc0455b63", "comment": "Malware payload (RedLineStealer)", "value": "5adac427a6eff8b0c1674c6095e2719d5ee46945fd4e397384af02b8ec691045", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "3b028ade-8b25-43f3-a8b2-bf6cb418707c", "value": "T1B0646C1823DC8921E27F4B7994B1E2749375EC16A856D30F4ED06CAB3E32741FA15A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "9abeac78-ac2c-4c5a-979e-27be57298fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "4f73975a-616f-4db3-89a7-13bb245cc920", "value": "3072:0q6EgY6iIrUjatQcwPBgGzXnuTAmthSKMFcZqf7D34teqiOLibBOP:fqY6iwwPZDnuTACh+FcZqf7DIXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674935, "uuid": "f49e825f-a729-41ef-9a71-4db9d3e8b728", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674935, "uuid": "52a0d640-942d-42ed-a72d-d0656dde8b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817ecb16-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CobaltStrike)", "timestamp": 1745674937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674937, "uuid": "8a09ea3b-c7ba-4085-bf79-ad4ec4050794", "comment": "Malware payload (CobaltStrike)", "value": "a23837debdc8f0e9fce308bff036f18f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674937, "uuid": "bba56107-3fef-4c84-86df-e081a6f851e7", "comment": "Malware payload (CobaltStrike)", "value": "848260ba966228c4db251cfbcc0e02d6ca70523a86b56e5c21f55098cec92479", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674937, "uuid": "08be92e2-8067-4a7a-9a1f-8520a941fbda", "value": "T145452347DC588A33DDA35D702AB06323A736D3A46D21D22B5A48EB6C3CA7705DC1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674937, "uuid": "2222c4ef-410f-446d-802f-b3a0a43f3b60", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674937, "uuid": "c38263ec-6b73-4bcf-b70a-9e3664255c0d", "value": "24576:F5OnmONUzLJq/wjcOVe+/O6B9ZdIadBjfZF/KIu4LtaXLKBTfME0gG3vdSCUxXT:CnmONUzL0/wjtVe+19Zrn/kw9T0uG3vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674937, "uuid": "ba402899-8854-4019-bea3-7fb814c11858", "value": 1184734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674937, "uuid": "d5c0da01-a962-40c6-ba5e-48a03728c711", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41840862-5bdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674937, "uuid": "aaf9ae75-040b-4e5a-aea3-dd799f1469c8", "comment": "Malware payload (RedLineStealer)", "value": "9bba979bb2972a3214a399054242109b", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674937, "uuid": "f8480470-6f4a-4a1c-9285-175d9432f9c0", "comment": "Malware payload (RedLineStealer)", "value": "17b71b1895978b7aaf5a0184948e33ac3d70ce979030d5a9a195a1c256f6b368", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674937, "uuid": "6c6fa6d9-dc0b-45ec-92fa-4dac4fe14d8c", "value": "T17D646D1823DC8921E27F4B7994B1D27493B5EC56A856D30F4ED06CAB3E32741FA11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674937, "uuid": "c02cd885-e2f1-44af-ad1a-37b32dc8751b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674937, "uuid": "f235355c-2fd1-43d7-96a3-2a589d97268f", "value": "3072:Vq6EgY6iYrUjp3o8PwP9qyW9CgTAwtAVKtpcZqf7D349eqiOLibBOv:cqY6ivHwP3YCgTAsAYpcZqf7DIHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674937, "uuid": "0248e8a7-885e-4154-98eb-c905c44b4974", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674937, "uuid": "f377ca96-eb74-40d8-8065-5a433bbf3c1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d7069b-b516-11ef-afe5-82aee05be84a", "comment": "Malware payload (PythonStealer)", "timestamp": 1745674938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674938, "uuid": "67cfac01-8840-46e6-9022-108212ffabcb", "comment": "Malware payload (PythonStealer)", "value": "0367368930008d4a8a1e61dd36397276", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674938, "uuid": "59bc599d-9b6a-457d-b489-1c19a70138ca", "comment": "Malware payload (PythonStealer)", "value": "510907f8ba688b4b58895856b9d3e920d671c4d9713188ab098cae2397ea5929", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674938, "uuid": "4933935b-1063-410b-820e-45f76e285531", "value": "T16CC6336EB0D010FAF2B763BAD98156207536BC084732975F57A4B6AA5D232C40D3EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674938, "uuid": "92ac13d8-ab26-4707-9ab9-ee9363bb26ac", "value": "8e3dad4d4ea6736338bcc4aca7b446c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674938, "uuid": "d819753d-7dc1-483a-9e72-066195cc25bb", "value": "196608:JJbogDVZ0St/251RWFCVozr+aAD9xAy6k3/buHfmWR3B8gOPMFzWpJAZl6KPc:TPDYSt/251RXGvssy53Klxn7JWnAz6KP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674938, "uuid": "ad5ea339-0874-408b-a844-be3745fd524b", "value": 11687936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674938, "uuid": "58054d37-5b37-40c4-a4e4-e5bdd3095972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f4656b-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674938, "uuid": "533ba69d-1668-4181-a9e6-fedcdfec009b", "comment": "Malware payload", "value": "a2163bf270762a1deec37145f2ef5267", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674938, "uuid": "c0b879e8-f080-4a2a-b527-2caaf861aaf1", "comment": "Malware payload", "value": "e0d09374471bb956744258603669a06473cc5920b6096928ac345c640d089403", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674938, "uuid": "47c4377e-29fc-42af-a78f-8874f32ec7d7", "value": "T1EC942950E640FDFAE8D9CBB510D23349D1EBA060DB1DEA2B6940FE3C015AB6859339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674938, "uuid": "3a54ea48-6b0e-4134-9fae-43f649b42592", "value": "56cb00a5fa58cf34ccf8b9263abc87f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674938, "uuid": "0c7dc183-ed16-463f-9670-3e64ef60b7ea", "value": "6144:nUMYwNIRcCdh4vVgCAoyLInAkAdQX+wWNDBUhigzp00NR6MohqUia8Qv1ke8We:nUlDsyqyEA16rdZjnT0j58We", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674938, "uuid": "bd6a1139-095b-4577-be08-4f84a0d5e436", "value": 430505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674938, "uuid": "e33266e2-1537-4c16-8246-a06f26de3f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ad1731-62e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1745674939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674939, "uuid": "123c1b49-0740-4d9a-93f6-fe5318728857", "comment": "Malware payload (AsyncRAT)", "value": "d0dd63b98bf3d7e52600b304cdf3c174", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674939, "uuid": "f2619c8c-a71c-488c-8fac-4e4ff8890c84", "comment": "Malware payload (AsyncRAT)", "value": "023f2601d314d0fc9bd5a6992d33194ae1c71a559ac3c132406f2e0b88cd83d2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674939, "uuid": "730bca7f-1701-4f95-ae9d-5d8c74618d2a", "value": "T184566CF23706E2DFD7870474F067E907992943F18625B922DC7AB878DE42E9632C57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674939, "uuid": "334abcd7-eeaf-4831-85aa-ffba07a7cae3", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674939, "uuid": "f4d68747-f0f1-4c35-97b9-128cd7dc35a6", "value": "98304:IN5yA1a7c5z8Rlj3GmWEjH/XfxYzLgKK8o0wu1OudrlKv7G1Q6:ysN7HjPigKZpw+07G1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674939, "uuid": "b70a8358-2213-4767-8ba3-c37f42d34364", "value": 6427648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674939, "uuid": "7aaad09b-cc3b-4d1a-bff3-8eb339c3656c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe89b432-736f-11ef-afe5-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745674939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674939, "uuid": "f32040ab-6cda-4de6-889c-6d8a2a1ad52e", "comment": "Malware payload (Amadey)", "value": "2b01c9b0c69f13da5ee7889a4b17c45e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674939, "uuid": "905f096d-11f5-42f4-b598-b57cbadcc98b", "comment": "Malware payload (Amadey)", "value": "d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674939, "uuid": "a87b2eef-1f3b-431f-80e8-2e72ffd9adf0", "value": "T10E55230082B38066FDB16BF16973911287F3FAA05290C11BD32E79CDED36DA6561DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674939, "uuid": "0c402961-b3de-4936-9441-dbf7b8322ee8", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674939, "uuid": "c4b1afd8-ce6c-4648-884a-fd4e2f4d6bea", "value": "24576:b9yEBs1ZKaxv6rRVO9VdLCjJehm4v2TeLUzguXpdQhgRQ7SoYafkW:bxqZK66rb4V0cxtQzv5dQhgRQ7SxID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674939, "uuid": "d0b47180-ee42-475b-84a4-054426f1b0d4", "value": 1381143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674939, "uuid": "f6a91822-c5ab-4a47-9e33-8306f27986b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cf342f-e8d0-11ef-aa7b-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745674940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674940, "uuid": "f16694f9-1f8e-463a-94dd-e8ce20e35b91", "comment": "Malware payload (Amadey)", "value": "bc3b0fcb68c9a3e6ce6ee8b3b9c258f6", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#c8921c", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674940, "uuid": "95a1c5da-4a59-4058-aaa5-3d236102a70e", "comment": "Malware payload (Amadey)", "value": "c4de054a99bee0ddfb0969f6e7a371ab4c0cdf3fb5e6e712d657eb58f5e916d8", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#c8921c", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674940, "uuid": "cf6eea9a-53b4-44fb-8f50-1f754529b851", "value": "T1E59533F29C3439AEE311F6F81E5285046B08788C87F5B6D71D4477B28E2DF068E669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674940, "uuid": "5d330810-acbc-4b1e-8313-f716c84914c4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674940, "uuid": "4a4321fe-f258-441f-9cde-5cca2a8c3af8", "value": "49152:y3OcrT0HpwEszQyM6w1muKtmMSb65a2wz3pcM:K4GJzbM6qmuKtjSb65ybV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674940, "uuid": "9410e171-8fd3-43b9-854d-5a874385a6b4", "value": 1913344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674940, "uuid": "95a740b2-b968-45ce-aabf-942ee03f6661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c390ac26-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674941, "uuid": "256a0862-f475-4c44-9b91-6b375014506e", "comment": "Malware payload (RedLineStealer)", "value": "6e2ecc4230c37a6eeb1495257d6d3153", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674941, "uuid": "e5e3a6dc-9802-4a6e-9626-22a68a7a6009", "comment": "Malware payload (RedLineStealer)", "value": "f5184103aaacf8c9a7b780ccf7729be92cb813b3b61f4d1a9394352050ae86a2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674941, "uuid": "d055fbd0-818f-4a68-a7a8-1068dfc9f29e", "value": "T1C234810823C8EA10E6DEE671C8D820F09F669C8BF5DDD61BCED1BE9D76302D4A7502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674941, "uuid": "8f26a69d-60b7-436d-9500-9fb452393c4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674941, "uuid": "46020c04-935e-45dc-adbb-c9dffd9369b7", "value": "3072:UBIppKca6VxpvAgGJqzDayF077u0uxv/B1Wr7ct9hKde1OO:LjNYnJqzDag0c+/II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674941, "uuid": "7dbd7599-5992-4be3-aa3c-4abf8908d52a", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674941, "uuid": "56d614fe-42ee-4b93-9fe5-c06edf1fa65e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad5c639-81b9-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674941, "uuid": "06854e2e-611c-4080-b8df-33d6f570bc36", "comment": "Malware payload (LummaStealer)", "value": "c84baaa0b67d15dbc989ca2eb55a9b1c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674941, "uuid": "540c1668-3687-4067-a7cf-68dd0f927c6c", "comment": "Malware payload (LummaStealer)", "value": "9f8b8bd90df6a73c3fbd5eb730ca6866f2de8f09ba273d73e7a91731ca90ae79", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674941, "uuid": "7d8d8c11-5dee-4e7c-8345-fddf26ae2737", "value": "T16A5623092885C15AD8DB01F892336BE576F29383CF524476BACC63EF6B73D79612B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674941, "uuid": "70635dbc-3947-4f1e-8aed-4b758445e4a7", "value": "567040e23b638fd749fdb81638258d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674941, "uuid": "b0adffef-1bd1-453c-90fe-66380e0ec4ca", "value": "98304:pXnW8kAUw7PG+CO9Qkq/fGBcFeZuvJhqJXVt2W395FBbjWX1URQZFquX4QCU:5W8kA4+COeGKM8+Jlt2W3THjm15F5IQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674941, "uuid": "8ed5bd78-5cad-4e1d-aba1-913539eb4e3a", "value": 5992432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674941, "uuid": "2e4651cf-077b-4c2a-8920-59998c85ffa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52cae892-4f65-11ef-ac1d-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674942, "uuid": "7b2cc8b0-22a6-4558-a821-41fdd5e82ed6", "comment": "Malware payload (LummaStealer)", "value": "9b3eef2c222e08a30baefa06c4705ffc", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674942, "uuid": "c703108f-e2c6-43b1-ba84-ea87957e3614", "comment": "Malware payload (LummaStealer)", "value": "8903d4bfe61ca3ca897af368619fe98a7d0ee81495df032b9380f00af41bbfc7", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "db917fe7-d583-4439-b5b9-2766604c5a17", "value": "T122647D05DB3354B1C84A467574EEB33F9A241B1383384EDBEBA0DFD876136A29176D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "0f6faf64-4d22-4df4-a082-14a1956f8fdb", "value": "93d38faa538d34592b2dd571bcadf806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "dde279ec-c4dc-44ec-b72a-272f1ea61200", "value": "6144:IRRWRbDEMV2g0ZnVISTj2+QzZucXq7oyHWjqG5Rsz3Pp:IDgEMYgYnau4yP22G5S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674942, "uuid": "eef458f6-df40-40ea-bfc9-a5c0cfde162b", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "f605eaff-0f26-451e-82ef-3f574a194c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f55d67d-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674942, "uuid": "4a1c9905-02d6-4b11-8260-d21aaaf358fb", "comment": "Malware payload (RedLineStealer)", "value": "ca0a3f23c4743c84b5978306a4491f6f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674942, "uuid": "6d380b5e-ade3-4741-a10b-73ca51c4883f", "comment": "Malware payload (RedLineStealer)", "value": "944113e85a7cf29d41fbbb30f87ea2554d036448a0bdb1e4e2b2ade3f99a9359", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "0f40575e-ea71-4340-9f80-fd691d5b8046", "value": "T133F4929D365072DFC85BC8728EA81D64FB6074BB831F9243A0671AED9A4D997CF140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "14056ec6-7e62-469c-8376-887356a88794", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "f75357b8-ea83-4f8b-ae83-5fd8ab68994a", "value": "12288:AzEx8eyYxSIRuqJ7MJgtgWd89b9X0D2fwDe3RPYyz1UTMLJYYZIjRdBPn2TSUjQN:CEx8qUIRuqJ4JwgCu0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674942, "uuid": "34b5db9c-2213-4190-8c12-070260aa236a", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "d5b4989b-f28f-4488-829c-4db1e8c9834c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6d6557-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload (CoinMiner)", "timestamp": 1745674942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674942, "uuid": "ae9b0996-50c2-4e28-9da1-7d704fd0263c", "comment": "Malware payload (CoinMiner)", "value": "deec0a7c5e6af53603b0171a0d7d5174", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674942, "uuid": "10ec5a5f-e5fc-4ad9-b91e-43ed21ff01c5", "comment": "Malware payload (CoinMiner)", "value": "df22795e42488daabc77eeb96f724ea6df453ed2ebcae81db03993b560ed5ab3", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "99c91cb1-1f8f-4e75-9bc0-dc31156d18a7", "value": "T172369E56A2B400E8D9BBC138C987C907F7F1B4150770EBDB16E046A91F27AE55E3EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "f0fb7690-5bbc-4a5d-a85e-ee36896af4dc", "value": "4c081bda08b2cdcb111caff99f9d918c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "f0cba6e5-a4a6-4223-8195-7c0f6ff0c108", "value": "98304:DPNkPXSgzYO/Iy5OAWHd7NUEi2R5It2CR8aPA//WDPAslUMFBsyB:yPXS7R5y2CR8nOD1ltt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674942, "uuid": "c78a1f85-5a96-43c0-aa05-637d8da19e56", "value": 5005312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674942, "uuid": "40c21859-5656-4600-abb8-ea63d28b0ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a048c89-7c34-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674943, "uuid": "ec50ac46-1067-4f76-b89f-f6a9fc74224e", "comment": "Malware payload", "value": "081c87c612e074a69ed34d7102543bbc", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674943, "uuid": "588fa0aa-ea18-444b-95ff-72fd13a4da74", "comment": "Malware payload", "value": "2808948b635ccf20d4bf679457e45bfe21a783ec99e095e55382bede47f6579f", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674943, "uuid": "60cc854e-21be-419e-b584-8734d92a5c56", "value": "T1A3C512536A8D7CC2E8A856B29937B18513B5FC7954B21C1AF892BD37F073203386E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674943, "uuid": "3d93aba2-a94e-4330-a8f1-4e0a5198378b", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674943, "uuid": "6ea14706-3611-4669-b195-312b47699b32", "value": "49152:IKydSmx3lii0Kf9XNbFuRx4nSpWnkn23o94gcwmAkZZioz12:hyddxWK11FU4nScnkH9PcwmACiow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674943, "uuid": "9231bef3-f43a-42df-8064-32d573cdb92d", "value": 2595072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674943, "uuid": "775bb619-6100-482c-8ced-509db5d152b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0245ef50-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674947, "uuid": "0242778c-ae13-4659-95b5-59e1243ce6cc", "comment": "Malware payload", "value": "3965af8553f2dd6467b7877f13ec3b2e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674947, "uuid": "4e4e352b-77b3-49a6-85fc-efd7f4a1d759", "comment": "Malware payload", "value": "604dc2088913709520dbde3830c37c44c9cf9dd1ddd493a1ea71a710c3650015", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674947, "uuid": "051de282-952e-47f4-a6bd-d48421b9d8d6", "value": "T1D85649C7F89449E8C0AED335856292A2BA317C495F3023D76B50FF282F76BD0AA757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674947, "uuid": "f3c6bbb6-b665-498a-906b-f0f964f9bfeb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674947, "uuid": "2055379c-e035-478a-8036-789105221341", "value": "49152:K9gbHOPRgCvqwc0wrWx0rukWhloAJSztNvFjnQ5EV7+w9xWpUPY8ORufm3p1ip4h:KJgHTrTrAJSz4EvmTrhqxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674947, "uuid": "7aa1a993-2495-4332-ad71-d79bac7f7ccc", "value": 5994496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674947, "uuid": "8a27dcd1-97d6-44f9-8915-7bda519d5515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639fc5c3-7435-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674949, "uuid": "c649d7e2-a73b-4d6f-bb93-cd7736bcc7f2", "comment": "Malware payload", "value": "6ca0b0717cfa0684963ff129abb8dce9", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674949, "uuid": "ed92dd94-196a-4cca-baa3-b0253a6bb119", "comment": "Malware payload", "value": "2500aa539a7a5ae690d830fae6a2b89e26ba536f8751ba554e9f4967d48e6cfa", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674949, "uuid": "d5036091-5fa2-444a-9f8b-ab7f99d69ceb", "value": "T116B43B00B3A1C074F9B325F55DBEA29958BDB9A01B2980DBB3C419DD5A24AF4DC31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674949, "uuid": "9bda6d0e-198a-4630-bcea-af3a7dc8091e", "value": "35f27bc0ac1cdb6dacd786947214021f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674949, "uuid": "5f777e90-5711-4b49-b8f9-cec55fd6c9f1", "value": "6144:paNY2RhksAZnFcHQgu6NRvBf03SJRvX2CRXZGS9PlUlAREoghgAOAw7hB1:cN5CsIFcHQHGRvVrL99PSoghgKwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674949, "uuid": "ecb9b585-ea25-460e-a880-7a1384e6b68d", "value": 519680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674949, "uuid": "e7ee9240-206a-4edc-a5b8-2b825e3ed4f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afb0b6e-5be1-11ef-ac1d-82aee05be84a", "comment": "Malware payload (GlorySprout)", "timestamp": 1745674950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674950, "uuid": "c7c37593-bdb4-45db-b4f7-950dd1882f5b", "comment": "Malware payload (GlorySprout)", "value": "92ae7a1286d992e104c0072f639941f7", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GlorySprout", "colour": "#40C3EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674950, "uuid": "67403fae-6952-44e4-acd1-9b45f353ebd0", "comment": "Malware payload (GlorySprout)", "value": "1771c4e6e34fda6a68c7b1d980cc3dffbe587c651f985bf7235c6af9a8904fd3", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GlorySprout", "colour": "#40C3EC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674950, "uuid": "6d8e9fdc-e179-45c8-a2e5-89d773e3f683", "value": "T16F549D22B6598172F2110033ADAC5BD086BCA5710E624AD3F7DA652FE9F05D3D520F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674950, "uuid": "8651714a-4802-4052-b7d6-48688aef3dbc", "value": "17ce412007ec6b063cb9a92ee7b9b417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674950, "uuid": "da9a7c47-7f56-487e-90aa-ab70b9cd87bd", "value": "6144:S7iHIcfYlXolTFsr91vzWmUuNTuBjEKz7nwWYcEZoSNDyaN9b/7:FPYJolZsr9kjuNTuVFfnwHYSNGOb/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674950, "uuid": "83beb0a0-bf0a-42ed-8f65-e183442acdb9", "value": 285184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674950, "uuid": "4a2f8dd7-81c1-4728-a124-c411b6cccd55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f210c0ee-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674955, "uuid": "df0eaae7-aa63-4874-a3b3-59d74f60b71a", "comment": "Malware payload", "value": "1ec718ada22e61a5bbbc2407a842b95b", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674955, "uuid": "b3ba7aee-6f40-4994-b115-890e415ce98c", "comment": "Malware payload", "value": "2e3bc4c6b0789469f9b7fe876adbc47b5b22f6b15ec7dff70ad588d838937677", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674955, "uuid": "0f01ff1c-fd9c-4625-b7cf-55fcd9daa3f8", "value": "T1BCC38C11B5C0C072D9B729310974EBB6997DF8340F106EDB679C1ABB5F302C19A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674955, "uuid": "5cc2535e-24fe-44ae-b613-492f874ef590", "value": "b3d8d380bba0cee3b72bee02e5aa3f89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674955, "uuid": "7af1d152-8706-481b-be3e-d331d15f7029", "value": "3072:9WEYctSTGOg5dYR73ouB4TiMauyW1qJU/42qLJJGm4rWuj7x6Uv3tqGYs:oJGOJ3ou9Mf1+BJJzU6UFqjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674955, "uuid": "475e6232-434e-4146-9448-21519381c462", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674955, "uuid": "51d240a9-dfcb-43c1-b831-5360eaafa002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a75313-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload (Adware.Generic)", "timestamp": 1745674955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674955, "uuid": "490fab1c-5e7b-4fa1-b03f-487a4682de09", "comment": "Malware payload (Adware.Generic)", "value": "b3de5ec01cfa2163f0f62efb3bf41171", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674955, "uuid": "213e02bf-13be-4673-ae6f-99cee0824ad3", "comment": "Malware payload (Adware.Generic)", "value": "d55d43e8ddbba6faacaef5a6884a776162d8350212d44f02fbc8b853d8275984", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674955, "uuid": "e6d61dab-7705-4bfd-9d59-5d95efaa6e39", "value": "T18E85CF3FF268A13EC46A1B3245739320997BBA61B81A8C1E47FC344DCF765601E3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674955, "uuid": "e336d91c-cb28-40d6-b8f0-031792bf51b7", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674955, "uuid": "a9c3488e-86b2-44fa-9eb1-03d9207c8b86", "value": "24576:s7FUDowAyrTVE3U5F/kGqKSHZdKic6QL3E2vVsjECUAQT45deRV9RR:sBuZrEUJkLKIy029s4C1eH97", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674955, "uuid": "be3d259f-a231-4848-a970-7397964182b6", "value": 1764423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674955, "uuid": "923e3b89-5b47-4f27-b537-c8b15d3f4cd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36519a02-706a-11ef-afe5-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745674958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674958, "uuid": "feeb18b2-548a-4ae1-834f-bfc96d5544ae", "comment": "Malware payload (CryptBot)", "value": "58002255ca7651f46ffd07793008bad2", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674958, "uuid": "10254e0b-3973-495f-ad8f-2b8ed19d9007", "comment": "Malware payload (CryptBot)", "value": "6c77c2a923fae249f3f2c0d4c2f5153896a09076ffd9699b3a067b7f7d1da0fe", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674958, "uuid": "c1aaa077-8f9b-42b4-8363-bdf86e3d359d", "value": "T1B366173B9B4345CAC12FB57ADD827F3FF4286ADC4329892B6C0508BCA755751A8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674958, "uuid": "943a5d81-bbab-4d93-9741-56b6e7430fff", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674958, "uuid": "43097b15-0d53-4378-a5b7-4e1393474136", "value": "98304:azurvr60mnyHyDZzyzRS+MKHGKWp2J5zD2mg:azua0aySD9gZMnKWpED2mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674958, "uuid": "234ddb62-2156-4222-99e5-526fa5ccaf17", "value": 6682397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674958, "uuid": "d29fa230-9c58-4865-810f-3a99f979cd9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6bd118-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload (DCRat)", "timestamp": 1745674959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674959, "uuid": "cacc429b-b9b6-42bc-aa40-70c82141ee3b", "comment": "Malware payload (DCRat)", "value": "34684ddf1deaabe5f923e130dba8c260", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674959, "uuid": "2e147d8c-2abc-4a6c-ab26-7935e51de6ab", "comment": "Malware payload (DCRat)", "value": "61e53470ede2379e70259853cb6b4727cb5bf519dfff5ed643f22eb9b81c12cd", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674959, "uuid": "5ce91063-1514-473d-9b1c-04f0e3a90a14", "value": "T17AF3501927408E8AE5DE8D774104FE118A31F8839A737FC92B4915E76B8A84FA509F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674959, "uuid": "d9fc392c-b8d6-4483-8e29-866bce07586a", "value": "3072:wJwPUfRrKZWz9N4ZbZejgvBTMTo1mkf6tez:weUfIW4Zb0jgvBTMmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674959, "uuid": "21bdf1c3-fbea-42e8-bfc8-50580a92e5fc", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674959, "uuid": "3d3789d1-3d71-4cb7-8294-d4e578a2fe3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ee3382-61de-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745674959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674959, "uuid": "087f1867-829d-4630-9259-3b8d399ba565", "comment": "Malware payload (CryptBot)", "value": "9436c63eb99d4933ec7ffd0661639cbe", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674959, "uuid": "d0e730b1-7719-4f10-941a-1a739d90ec22", "comment": "Malware payload (CryptBot)", "value": "3a79351bd8099a518ecb4258aacecc84f7ed44cf67426b482b7583ce20c17e4e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674959, "uuid": "908723b2-ffbb-496a-bb03-fda653ffd565", "value": "T15D66173A9B4345CAC12F757ADC97BF3FF4286ADC4329492BAC0508BCA755351A8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674959, "uuid": "0c82c691-7c7b-4f20-b8a1-5eb79c8ff7f8", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674959, "uuid": "e0899066-aada-4fdd-b47f-e0135c221669", "value": "98304:GUdayOhRSDm9Pa0Yn7jUQY1bmG0ko9EMIvFPR:GXySRSDYY7jUD1bmG099EMaFPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674959, "uuid": "9633941d-f842-4e2d-8a29-9a87202798d8", "value": 6675527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674959, "uuid": "0548500f-7f2c-4839-bfd6-dd921da7d039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2ac5dd-5217-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674960, "uuid": "a7c2508c-1136-43e2-9953-51038a46f99d", "comment": "Malware payload (RedLineStealer)", "value": "454a942056f6d69c4a06ffedffea974a", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674960, "uuid": "c4605119-a876-44eb-951c-b35d4d783969", "comment": "Malware payload (RedLineStealer)", "value": "2b9de0299a80e370e454b8512ee65abf2eac12ab3fe681201c25745978b199ed", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674960, "uuid": "6388482d-cf31-4576-8bfe-23ad43be1fbb", "value": "T17EA4012436C1C6B3C476523144EACF398A3574211B79D6DBB6DD2BBA5E123D0A3372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674960, "uuid": "7289950f-b21a-4575-aae0-68cd38426ce6", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674960, "uuid": "728f6517-6dee-44b5-87f4-5e3aca478b25", "value": "12288:Fh1Lk70TnvjcwkhK/wO+FkH6GQx0Xs8eqUVd:Rk70TrcwkMY9xfJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674960, "uuid": "64b6568d-d6b8-4337-8f4a-fd00077541c4", "value": 482304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674960, "uuid": "204de4b8-6830-41d2-b6bb-3ef8a20022e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f1e6b0-62e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload (XWorm)", "timestamp": 1745674962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674962, "uuid": "cd0ea08f-5c28-45d4-a59c-dab0ea39303a", "comment": "Malware payload (XWorm)", "value": "26d737343527707f7e4fbad11ef723ad", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674962, "uuid": "7b4272b6-796d-47d3-998b-6b5c679ae693", "comment": "Malware payload (XWorm)", "value": "079cf111fe3c63bd27b7bb93c589c250e519bea006aea9e0a5be2a9e4503d45e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674962, "uuid": "6c2d1848-d31f-4611-90d5-fdd002aa284c", "value": "T1B825E5DD725076DFC85BC872CEA81D68EB6074BB471F9203A0671AAD9A4D897CF140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674962, "uuid": "7bc3f3eb-88d0-4a5d-a3c0-96f84edebeb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674962, "uuid": "36744abc-cfca-4a67-8dc0-08295b451550", "value": "24576:RvdPwin5SxmIyvYpLY85ZDAddc5RzGlWkuNe:RFP4LJ+iZDtyWke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674962, "uuid": "bad0b5c5-a7d8-4c8e-9e20-3e14a1fd3c84", "value": 1006592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674962, "uuid": "3a005bf5-7bc7-4a09-8029-5e3e95925cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df14261a-711c-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674962, "uuid": "42fad19f-333d-4c43-b24e-254f1b9ed6bd", "comment": "Malware payload", "value": "af91873c641aab500eba3a3ad6f17b74", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674962, "uuid": "aa3dfac9-cdf6-43a5-93e7-81600522780f", "comment": "Malware payload", "value": "f568d5c96eefd67d284787b804ab17a610a93dcc48d855515fb187f1b6dba249", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674962, "uuid": "c7067835-890a-4a70-b05f-53edfedd3750", "value": "T1D2361209E794ACF8E4A7D778C892160AE2B778588734D71F23A09E2D1F273609D377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674962, "uuid": "21fbe9a0-7a1b-45c8-bbf3-d8f5ad8bf22c", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674962, "uuid": "3665a493-fd78-42a4-a923-7b4b692af8bd", "value": "98304:rqwLdiOqeEadJ1VQ7zuRN8BOBfKHXSBSQdkd0cr/ylwD+/lZUdmkUH0Tn8VIRgQp:rqwLb8/3SSQdkCtwq/lSJU+0Iz6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674962, "uuid": "67a66a01-0715-4427-90c6-866caf5a0fef", "value": 4946299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674962, "uuid": "0629de9e-a04a-486c-8726-172108feed77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c556f017-5368-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "46e920f6-85db-4da4-9bea-3a488498221a", "comment": "Malware payload (RedLineStealer)", "value": "0f02da56dab4bc19fca05d6d93e74dcf", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "8f5376fa-3385-46db-8c26-ab4106756361", "comment": "Malware payload (RedLineStealer)", "value": "e1d0fe3bada7fdec17d7279e6294731e2684399905f05e5a3449ba14542b1379", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "f28f62ec-0c9a-4410-8574-a9e9e0a012d6", "value": "T176647D1833D88511E27F4B7998B0D2719374EC56E817E30E4ED16CBB3E3A741EA19A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "8250d902-34a0-4034-be12-acb57cec76c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "32739693-d909-4cd1-862a-c2dc334f71cd", "value": "3072:wq6EgY6imrUjTBUzwPC24EowndGt16TAHtASi6lcZqf7D34leqiOLibBOw:zqY6i8wPeEZndGtMTANAUlcZqf7DIvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674963, "uuid": "44871889-c262-4820-8e16-24aa298fdb6e", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "aa508d61-8e9f-4d6d-aee8-644b2acbd9e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34cb103b-7a8e-11ef-afe5-82aee05be84a", "comment": "Malware payload (GCleaner)", "timestamp": 1745674963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "6891accd-0f19-4326-b7ed-a585246a7fbc", "comment": "Malware payload (GCleaner)", "value": "ddc9229a87f36e9d555ddae1c8d4ac09", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "da562dc0-98ba-44b5-a5d2-1d631794770c", "comment": "Malware payload (GCleaner)", "value": "efec912465df5c55b4764e0277aa4c4c549e612b4f3c5abf77aaec647729f78a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "b359bb8c-2bcb-4ecc-a3b6-a0482c70fb83", "value": "T1C991B31093E84B7BD9374B71AD73170122B4FB92ED57DFAE2884620A6D272540E33F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "a4e71ef5-8e3d-4dae-a60a-d909633bc263", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "47b7069c-048f-43d2-bf9d-606ab09142e0", "value": "48:66sn7l2zMdoHSe0rHNMMb9Y7VxCioXsTfxZsFtow/ljhFvCFipfbNtm:PYqX9VxCJ8U/3F5zNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674963, "uuid": "bc4640cb-cf86-42cd-95a5-e5fa73d27fd1", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "43cad23c-4279-4145-b3d9-47c0f7edb179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42c330f2-61de-11ef-ac1d-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "3e2fa526-d692-4a07-9ac4-e11ec0d44ca0", "comment": "Malware payload (LummaStealer)", "value": "40e9f5e6b35423ed5af9a791fc6b8740", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "a0e796a5-50f4-4876-9c78-c46c684f48be", "comment": "Malware payload (LummaStealer)", "value": "7fdd7da7975da141ab5a48b856d24fba2ff35f52ad071119f6a83548494ba816", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "a9807385-7bfc-4b36-b848-5e3e70df4e86", "value": "T19E446C0AE39790F5DD4B15B950BBF33F9634AA0E4328CEDBDBA0DB5468133A360769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "28ee3f80-7b13-4515-bd09-b03e44e1dda0", "value": "08b1b12afb6e1cdcf5adc795ee884ca6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "e36df856-0d10-40a8-a274-c7b1a6c67d49", "value": "6144:oNQRN4ApoymSc82PitnBpAl5LEqG3/VCqcC2XD1a8ESM+N:oSuymSc8xtBWHBGcBEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674963, "uuid": "0045598f-fcc0-4ec3-ad6d-e93c523f44bd", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "b4642dce-b61a-4f56-9cb1-cd977a86a75e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c056d839-8bcf-11ef-afe5-82aee05be84a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1745674963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "523f28fe-468f-4b39-ac38-6eb8b56b2c9d", "comment": "Malware payload (RemcosRAT)", "value": "6520492a4e7f9bc4dfb068de1c7b6450", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "74b0a8b5-a30c-44bf-9d3f-e67144eb2c13", "comment": "Malware payload (RemcosRAT)", "value": "94465e214c05a6b477f6310957448e7d891ce37c960e36d246294eb6843081aa", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "cf94a74a-0514-4ac1-bda8-88e48b135536", "value": "T1B6B49E01BAD2C072D57514300D3AF776EAB8BD201835497B73EA1D5BFE31190A62AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "1069ff56-3296-4748-a3b0-83cca619427a", "value": "1389569a3a39186f3eb453b501cfe688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "473347fe-dfaa-40ce-a790-4cbf8c57ad85", "value": "6144:KTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcr8T4:KTlrYw1RUh3NFn+N5WfIQIjbs/ZX/T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674963, "uuid": "f96d13c9-0e6c-4274-af8f-00c01aec2c80", "value": 494080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674963, "uuid": "fe4e6a39-57d7-45ff-b119-983e32aca110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdee4e41-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674965, "uuid": "a59cbf7f-4e74-4b6a-806e-b0537af3eae7", "comment": "Malware payload", "value": "bda1e244f73c16499b8faa763e79cc52", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674965, "uuid": "c384fa1b-b596-4de0-8dc6-04e80a6ff637", "comment": "Malware payload", "value": "c1de42382bc44f0871f0fe67c18d669a57291deace62b9c27f7ad76872231886", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674965, "uuid": "b6b534b0-254c-461b-a25a-1f1d4785c4d6", "value": "T1F5D59B716286C95FEBCF09749913F26E49181530D3EF78D3779C05A00F23AAC5AAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674965, "uuid": "dade56b5-cf32-4be2-8db5-f9172214144a", "value": "27ebf71807d158548592c8dd22d718b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674965, "uuid": "1075e51f-41ef-4cb8-9243-69a636c0e7ef", "value": "49152:svp0T5bwrOmRphb/FIHh5P6N2VVx/j9W3ywrthpcQY1czzHn8dEa6JVjkl:svKT5bgOmrhb/FIHhd6NoVx/5Oywrt7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674965, "uuid": "20f46d82-27cc-477b-a83f-618aa577d92f", "value": 2973184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674965, "uuid": "fd815ad6-a8c9-4532-b057-827448ac25ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ba3e8a-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674967, "uuid": "b322a85a-3500-44ed-8ead-882511387b04", "comment": "Malware payload", "value": "3adfc7cf1e296c6fb703991c5233721d", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674967, "uuid": "083dbe83-315d-4757-bed1-2747730672b4", "comment": "Malware payload", "value": "6bc23179d079d220337ede270113d4a474b549f5f0c7fd57f3d33d318f7ae471", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674967, "uuid": "68abe613-de7c-4ee0-9853-f12ad7209f26", "value": "T1DE651852EF91EF19FB66E878C1F72B28A3A2E8C76731561FDE9556430CC36E41C884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674967, "uuid": "9f684944-ad87-4a8e-88c8-d83c4c9c6a33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674967, "uuid": "9efeb512-2705-4b52-9e35-ae59a664f79c", "value": "24576:XF1ci4Lmy1ZBk0arIT4+hmmnPgM7jixqS8fWW9MVWCmx:X3ci4LB1ZW0p4+hmIPgM7wV5mx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674967, "uuid": "691e9b22-d8e8-4021-8422-dc8119928cf5", "value": 1422336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674967, "uuid": "d165820c-907f-4d33-ac3f-90d408964981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abf4b74-5be1-11ef-ac1d-82aee05be84a", "comment": "Malware payload (ZharkBot)", "timestamp": 1745674969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674969, "uuid": "a525a47b-fc40-4184-b6ed-6c13ad74a1de", "comment": "Malware payload (ZharkBot)", "value": "f48972736d07992d0cfd2b8bc7972e27", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674969, "uuid": "dabf0823-5585-4f8e-b87c-1f4d7a534d83", "comment": "Malware payload (ZharkBot)", "value": "56d97e9f42ee5b7efdbfcd7d56da50e752fb08599f3422ee0cc9b697a92e56da", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "50644867-f52d-4f8e-ab42-5747053fb77b", "value": "T1D4648E11B681D072D9B114705B3CABB58A3EED300F6416EBB3E40D6EAE602C1D776B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "c12d7be9-d08b-4f29-bd69-a4d2583c281e", "value": "86066554454deea625edb22af31c51bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "60ca9103-5c94-4aa1-a405-4560601824e6", "value": "6144:eyrVs12rjxDPCle3vOYL5q1e0eBEpw2ePRflnm3QBbLVKnzf16Ja2PBipAxWn7jT:eyrVsmjxDPCXfEJaUBipAxKbxLOKP2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674969, "uuid": "f8a8db72-29c7-4b17-af73-b94075ef4c67", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "432406da-4670-4f5e-a372-9f99e253a363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e55c46-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload (DCRat)", "timestamp": 1745674969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674969, "uuid": "2653b0c3-ba44-4de6-8324-1e2dd8bd3ef1", "comment": "Malware payload (DCRat)", "value": "8f81ac89b9f6dbccf07a86af59faa6ba", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674969, "uuid": "5d27b6ab-e1dc-4cd9-8d11-ab863ddc7227", "comment": "Malware payload (DCRat)", "value": "766b497466955f86e0d049c25aa6f99880d230acbb8d1141408fe0e8169fb46a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "a2275eff-8ed9-4b65-b916-915fa463a992", "value": "T19E2518107AEA0136F1B6ABB155E1695E86BDF9F3B7168FCE304082CA87167C0CD617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "a6703cd9-efe8-41bc-b9ce-973c15d57944", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "f141c856-4586-4841-ab56-3f08b7be178b", "value": "24576:2TbBv5rUyXVUxJMVI3SyKnUh9E1bm67+f:IBJcJMrEh9mbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674969, "uuid": "5ec7fc31-fafb-4ebc-b9f1-d4e581863e10", "value": 1011382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "12d29726-f7f0-4714-b464-9797c2c9baf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f10bd60-49be-11ef-ac1d-82aee05be84a", "comment": "Malware payload (PythonStealer)", "timestamp": 1745674969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674969, "uuid": "3efd31c8-4d6b-4b9a-b2f2-e9faf1f53b28", "comment": "Malware payload (PythonStealer)", "value": "c8cf26425a6ce325035e6da8dfb16c4e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674969, "uuid": "b2e06db9-99fe-428a-96f3-928402b69ec1", "comment": "Malware payload (PythonStealer)", "value": "9f7be9bf913d8378f094b3f6416db9aa4c80c380000202f7cfaddadb6efc41b4", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "440f3e39-968a-4b7e-ae74-49e2b95a6b59", "value": "T115B633275AB21498CE87D371F61678E2B474FC7D1116443E12ABF8B12BB2EF16F085", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "3ec562ed-5bca-411a-82c0-ebe68d835bcd", "value": "a15389e7a3e3d8aabef3d1422091a217", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "858d82d1-0cef-49d7-b7cc-404e55ad5151", "value": "196608:SnvxO+j9q6y7PuZANMCgvUF+j6yrO5H+KB4kj6vgC51U7BlUdinrDRQF6f1:WvxPBly7Pumdgv9RrOF+LkGvgMGBa4n7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674969, "uuid": "2d4558bd-4f43-41d0-8736-9e12ebac4cf2", "value": 11267584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674969, "uuid": "357e5537-c655-48f7-b529-78735d8b57db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b29f8f8-799d-11ef-afe5-82aee05be84a", "comment": "Malware payload (PureLogStealer)", "timestamp": 1745674970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674970, "uuid": "46cf586c-fd05-4670-9e5f-577db419e43f", "comment": "Malware payload (PureLogStealer)", "value": "6b4b9ced2c07fb6c8eb710e0b1f2c4cf", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674970, "uuid": "e3109e77-306f-43e9-9c54-d683b97949b6", "comment": "Malware payload (PureLogStealer)", "value": "8742d826742550fc07f65ac00f1e1e037a3941862aa85cde104945fa0decbff6", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674970, "uuid": "a5c71d9d-85ff-4b56-b280-7cdaf53d69b0", "value": "T17774232718123B59EA3646387E396F883D3FF4A8786F6F85067C1C5E884770A22F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674970, "uuid": "5cc26390-cf8b-4a20-bc00-7509860923c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674970, "uuid": "12471724-b3ee-4526-99d0-22f32b475031", "value": "6144:JYfDPOqtaJVEQuKkVBPJWuaMp4ueSOlmBZ171gFzcZ6hTtKEBPlb8n7us8HfnhaQ:JY68HQuKcsVSOs3zgJYAgek7usYnhaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674970, "uuid": "0db0e52f-1b7f-4d9e-a64d-450c7b9f8f25", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674970, "uuid": "cd961c93-7776-42c5-af04-7984c40d7abb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d40a8e-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674970, "uuid": "042c0208-b0a2-4b10-b98c-695c06797823", "comment": "Malware payload", "value": "47f1ea7f21ad23d61eeb35b930bd9ea6", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674970, "uuid": "74a9a1ca-2521-4612-b383-0a7a291ef72b", "comment": "Malware payload", "value": "9ef55d2f9f8b77a6d426df4e7b113b7517bbc94eca4230e423d6eef546eb7357", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674970, "uuid": "018e42d0-7685-4895-ac67-b24503c2889e", "value": "T1EFE36B11F1C0C072D8B7283202F097B1AA3CFA704B965DEF27951EBE5B745D2A631A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674970, "uuid": "a50d92a1-018b-43a5-b643-00fe680f704f", "value": "5ea7906ccb2039cfbed17247637d9d50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674970, "uuid": "726ec166-c84c-4487-8974-7cb8e4f7d255", "value": "3072:3hpn3mlOE8YNtuK/mni5jYo7KhdttS1jcyX9gr30iR:36/eKui5jYOKDXu1gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674970, "uuid": "5e7ed6b1-37a5-4583-b009-5d08b0cf41e4", "value": 156160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674970, "uuid": "f9314d82-ac4e-4f42-9134-962db1871f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3389b3-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745674972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674972, "uuid": "4ef2def1-6a6b-4ee6-a938-52e2d3440921", "comment": "Malware payload (LummaStealer)", "value": "28a1cbc8f12e270ceb258acbd16a4ccd", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674972, "uuid": "67253b74-85f2-4b67-81ee-32a33080bf41", "comment": "Malware payload (LummaStealer)", "value": "cda497a1eaf3cb9d33c3c6d9077ccd423f61607ad7da1180b38f72b7bd1ec1f9", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674972, "uuid": "a8ac211e-3549-471b-b3a9-8c67ae565b7b", "value": "T19FD62982FACB84F5D9434831519B722F67349D058F29EBCBE744BA29F87B2D10D362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674972, "uuid": "9badc827-8838-4c28-9021-c2e5f9d4a036", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674972, "uuid": "c1e97039-71b4-426b-9a71-a48ea60aed6c", "value": "196608:SRtCzqDOvudKSnwelubQA3PGksXpZQdp1YwS7uppypJzc+:zzqD7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674972, "uuid": "b73398f3-1598-49db-aa20-e52ad7b29f33", "value": 12797440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674972, "uuid": "df787661-704a-40d9-b2e8-57a18346f541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3bda52-4b78-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674975, "uuid": "01dc1f9a-0948-409d-a1e9-47b06e1cc63d", "comment": "Malware payload", "value": "410e91a252ffe557a41e66a174cd6dcb", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#8F0CD0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674975, "uuid": "ba21c0f7-0992-4c8a-b34b-f1e8df265d3c", "comment": "Malware payload", "value": "67ce38dec54fd963ff28f4a257d58133eb241c909f9e06c859de0a7f00976202", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#8F0CD0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674975, "uuid": "c0d04e8a-670e-418e-8d6c-0d11b4d206e2", "value": "T1D1D56C2B4979558AE3D6C07CF52B1792AC3136884E39B37715FAC3913B30A1C6B6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674975, "uuid": "2e9b515b-cc3c-41a9-a53c-b32b99b4f335", "value": "e49b63183dc452ee4abc90a6e47f6582", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674975, "uuid": "4ee71664-d779-48f0-b007-79e668e10040", "value": "49152:wXduhClX5Td3dKHJH2u4DTUN8A0AAlFnK9O5JDW0ZX+Gh8e9waVp/EoQ4PKw/n0+:LkUixA0Zea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674975, "uuid": "b311a2a2-a9cf-4289-b4f0-762ce3242a51", "value": 2755072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674975, "uuid": "4f2b3db8-0085-4118-b815-a442eff419e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadd33eb-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload (CoinMiner)", "timestamp": 1745674976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674976, "uuid": "ff436f37-fbb3-4601-a057-dda93fa76957", "comment": "Malware payload (CoinMiner)", "value": "58819721cbc16ea7033be23e69bd2058", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674976, "uuid": "4dc6e49f-bae4-49cc-80de-2cd6cde1b60f", "comment": "Malware payload (CoinMiner)", "value": "ff7d03accac70da489c7f108fa7d7d5fb58e02bcc32f4933ed418451663cc74a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674976, "uuid": "6926f8e4-8d3f-41ab-b934-06c27a4c8595", "value": "T16F862344354947FAF459E834057291A1E7B3BC269B22EB8B2790612FDF632F25F353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674976, "uuid": "3228ab06-7be2-4cc1-b599-9f79651a324a", "value": "72a5ce0c0a3d6f27f94d6e1307a5a6d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674976, "uuid": "5075b288-6da9-4a5d-a4eb-15505515aa10", "value": "196608:VDJEXA2kauB2cZGgCgdjZeakFao8FaPsCsCDCRo0bxjU/vHjqjkrx:V0lkau8EG+UBCaUCnDCe0bG/vHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674976, "uuid": "d547625e-f6bd-45f6-81a4-9d2725822b3e", "value": 8467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674976, "uuid": "a4ff93b5-76e5-4773-a66d-b4038fd3b467", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fec40e-5e28-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674977, "uuid": "9071cfad-e81e-4f99-90ec-e7f884a5ec03", "comment": "Malware payload (RedLineStealer)", "value": "2a601bbfbfc987186371e75c2d70ef4e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674977, "uuid": "1e2cc05e-e202-4e65-8b67-7bd3f970d32e", "comment": "Malware payload (RedLineStealer)", "value": "204e8268d98a3584e7fda52820025c6b681fd5dca6da726512d3ea97fb4510d5", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674977, "uuid": "d229c561-3c29-4eec-89c8-f21b933c8eb6", "value": "T11E65BB212DFB106E7373BEA55FD8B5AF8A5FF9732B0AA0B9105103464722E41CDA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674977, "uuid": "1ea8a72c-064f-4c70-9ee5-43bbf44535b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674977, "uuid": "119cb6c6-275e-454c-bf89-e1df9b226cb6", "value": "24576:4pIaZk3zA3CZfN0rKOWN8O3b0/3GhiwUkWlfBP3:4eSk303UN0rKOWN8O3b0/3GhiwUkWlfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674977, "uuid": "9dc5d9cb-a0e2-4a28-8c31-56dbd3973ea5", "value": 1526784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674977, "uuid": "8045f57b-8deb-4ba7-96e1-96e522d403e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6ee338-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload (Vidar)", "timestamp": 1745674979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674979, "uuid": "6f5010da-a458-418b-b1be-8cad5702d6be", "comment": "Malware payload (Vidar)", "value": "d78f753a16d17675fb2af71d58d479b0", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674979, "uuid": "cc3630bb-c4ca-416d-aea2-16951b4b8cdf", "comment": "Malware payload (Vidar)", "value": "ad9c40c2644ff83e0edbc367c6e62be98c9632157433108c03379351fe7aeca5", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674979, "uuid": "9cc0f361-48da-406a-9068-cf08fcdbe5ba", "value": "T180848D1623A030F7E2234575BA454322CBA7B8341661F75FABC405699FFA6C1EE2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674979, "uuid": "7499e1e1-1209-4a96-ab8d-3f27f2ade981", "value": "118187c3a5a9d853faf932e2bfb655fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674979, "uuid": "1e845c9b-ad33-4f82-a202-ece63f590620", "value": "6144:elqPvKpKJNJGyRlyY8aSp0Vbux0R4kF/Y/o8+:emRJNMalyjaO0Ix6BY/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674979, "uuid": "34d13e59-5f7c-4021-89a9-be0d4c8aab6d", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674979, "uuid": "447cd0fa-2d61-434c-9f93-86c0c090d1b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97876a0-4acc-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674979, "uuid": "c1e0c120-92c5-41d4-b983-54c78eda20d8", "comment": "Malware payload", "value": "faf1270013c6935ae2edaf8e2c2b2c08", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674979, "uuid": "1e03e757-da81-4c1d-aa30-1011c75573d4", "comment": "Malware payload", "value": "1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674979, "uuid": "bcc5edc6-afa9-4559-b08f-af7ff91537bb", "value": "T10EB6338026100D92F4EB223598A3542ADFB6B056036AEE6F57F093B51F67BF65D333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674979, "uuid": "d3885b44-ac4c-41cf-bd4a-91cefbfb666b", "value": "a6cec5b1a631d592d80900ab7e1de8df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674979, "uuid": "53fff390-8768-46c2-bb5e-59ef8f8e0c37", "value": "196608:I3pwZJjbyU3b01Kpn3V+uq+VvpqL2Vmd6+Dfc/f/+SveM0EVRuvEKn:uSZL01+l+uq+VvIL2Vmd6mfc/e03RMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674979, "uuid": "db956e59-041a-45cb-a522-b6a0a58d38c6", "value": 11437924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674979, "uuid": "05d9cb5d-9ff6-446a-99e5-4187e0778a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68f9059-7d5c-11ef-afe5-82aee05be84a", "comment": "Malware payload (DarkTortilla)", "timestamp": 1745674983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674983, "uuid": "dc9598d4-ee59-4f5c-aca2-3cac967b63d7", "comment": "Malware payload (DarkTortilla)", "value": "2a8cbefa5a5ded237d6563bd540a29f5", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#98530E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674983, "uuid": "eea0081d-e603-459d-a642-aa31a112dec1", "comment": "Malware payload (DarkTortilla)", "value": "bcfe44741427dfc03aed758dec7fe189aa27a55c2d7e18d7bc9bd1d6231fd4a3", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#98530E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674983, "uuid": "df74220b-46a7-4344-a1de-8c15fbd4d7bc", "value": "T1EF16DF56D6BD4498C9A9D1F88517490FE3B238011370A3EF4AE48B1D6F3BBE5AB783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674983, "uuid": "4b798a31-512d-4e8b-86a7-78b4c2c15891", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674983, "uuid": "ca0b8b64-bcf2-4799-9075-ea7ad51821aa", "value": "49152:Z8XSBgOQFZuvyZadGhcJ4RdQIlivHLSThjGNGu0zGuBPZ7s7jsjS4znnqyIn7Trc:6ygOQnvZDzxyHLexGNGu0zJbzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674983, "uuid": "4aa1f21a-9a32-408a-b0da-fa8bf03444a8", "value": 4045824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674983, "uuid": "02ff419c-7566-425a-bc55-c8e79b14eedf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e239ff-56f8-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Formbook)", "timestamp": 1745674983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674983, "uuid": "9ce2f695-693a-45b2-b0d4-9b16f2257ed7", "comment": "Malware payload (Formbook)", "value": "db5717fd494495eea3c8f7d4ab29d6b0", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#860d30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674983, "uuid": "7e6ff423-82c3-4e7c-ab45-7363c4ac6b5c", "comment": "Malware payload (Formbook)", "value": "6b59309ab12f1859a94fb2ce1c98639b2a538e6e098ffac127e45c29733bd993", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#860d30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674983, "uuid": "c833f2c7-41b0-4527-96aa-dd8ded1f139c", "value": "T132937D5C3BEA0019F1FFAFB11AF17656CB36F7731902962F24C5024A0617A85CD91A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674983, "uuid": "30c6e9a6-0be3-4413-8113-6783c1de0614", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674983, "uuid": "78e820cd-94ea-43e2-85cb-253539ba468a", "value": "1536:1z8H8uTSHKoKlDeE0C3shB1ueVby8EXEFA4Xib6TWcgMfAOISZsw61EmS:+c/q/l6EP3mvuwby8EXuhX6cgXOI0stE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674983, "uuid": "0168ad0a-7a20-4336-810d-c6644c3554e7", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674983, "uuid": "28097a8b-836a-456c-9ac7-b867098fadff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d3debc-61de-11ef-ac1d-82aee05be84a", "comment": "Malware payload (XWorm)", "timestamp": 1745674984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674984, "uuid": "ce4fa07e-bdc1-41bc-a991-58b4b03551c8", "comment": "Malware payload (XWorm)", "value": "616b51fce27e45ac6370a4eb0ac463f6", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674984, "uuid": "73485c1e-1eb3-49ff-963f-c294d6ec78a2", "comment": "Malware payload (XWorm)", "value": "ba22a9f54751c8fd8b2cfd38cc632bb8b75d54593410468e6ec75bdc0a076ae6", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674984, "uuid": "9034540d-3139-4ade-8670-d9c042fc50da", "value": "T10805C038DF9719FF827B8D66CAE201D7FD592413321C5B8A888A13E20D53B5BB991C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674984, "uuid": "ab2e81d8-32ab-4c22-ac8d-603c7435bd68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674984, "uuid": "fbe8c0ef-64f2-42ab-a93d-6a71cfb149e0", "value": "768:0oW6pkM8N3Dch0ft0S9Ou4h0bM6xpgeQwwDD1L3noWQrewsHY1pRur9bCr86+xDG:3jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674984, "uuid": "5899e3b1-2619-4ee8-a2af-130c2edb3735", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674984, "uuid": "01894e74-e8f4-4763-b569-6421447d1146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028f3e68-5836-11ef-ac1d-82aee05be84a", "comment": "Malware payload (NanoCore)", "timestamp": 1745674985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674985, "uuid": "f88a2ded-2ea9-4c35-945a-94abbfea3f78", "comment": "Malware payload (NanoCore)", "value": "1873f27a43f63c02800d6c80014c0235", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#d0f361", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674985, "uuid": "c2ea1338-b40f-4030-a5c5-9b42bbb8ad3e", "comment": "Malware payload (NanoCore)", "value": "4bfcba248d79dfd6c2cba52d7c9ee18842f007bfa0e3ba99ababacb4794e8c6e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#d0f361", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674985, "uuid": "96e48b51-2a4a-4b6b-bbdb-4c5509c9f158", "value": "T1BAC4022537984A3FE2DED47EB0111612927CC2D2ACD7F3EA58C455B64F163E54A0B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674985, "uuid": "0d700d04-ecc4-4228-aac0-3b03694cddd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674985, "uuid": "5fbf8831-f331-432a-98c2-a56a46148237", "value": "12288:WLV6BtpmkzPLrQIh+ReoSwN+Jp9rQj3SHdEIzqLPxc3hHyOm:EApfzPfQ9RecEp9NzUi3JyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674985, "uuid": "bad762f5-f261-40c9-a54e-74123bf0ac9d", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674985, "uuid": "e951451d-8716-4d59-aa08-1cd6204c83d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5f822e-5fdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload (MarsStealer)", "timestamp": 1745674985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674985, "uuid": "78eff670-a705-42a7-a790-fc02ddc4d957", "comment": "Malware payload (MarsStealer)", "value": "031836b5b4c2fc0ba30f29e8a936b24e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674985, "uuid": "869eb138-0311-406e-b286-caa2f8afef1a", "comment": "Malware payload (MarsStealer)", "value": "bf4f27f6932ce75b1746f5364af3abacbdafa59913da513a168d86ea0ad3a3a4", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674985, "uuid": "0e679690-3f9b-4867-935e-1d8b0d7d6e1f", "value": "T1D72423159BF5041DFE275930A648D339AE7F93E34482EB8E40A8D9DAB3127311A6F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674985, "uuid": "dde7aa4b-adbe-4b49-9c77-da47148dae9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674985, "uuid": "a6818c49-812a-498e-a519-586066217d5f", "value": "3072:PFSL+gz5/zYlDZO9vWStZ7CP7rn0c7Qaw/QRC8ZrrP0VCGXtuVZS5lg8ExE:YaYYD8tZeP7rn3Qaw//qPeuVZS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674985, "uuid": "4af74c2a-a8e5-47fb-8f2e-274fcfb2bd14", "value": 213368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674985, "uuid": "79ae20e8-1221-48b0-a605-8cdf186996de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aede563-5689-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745674986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674986, "uuid": "5fe5a865-74a4-4cdd-a622-09839e0b8887", "comment": "Malware payload (Amadey)", "value": "7adfc6a2e7a5daa59d291b6e434a59f3", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674986, "uuid": "0dd0a002-4c98-4769-80e5-451b61760189", "comment": "Malware payload (Amadey)", "value": "fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674986, "uuid": "0d15edbf-0466-4983-8956-407a5c7c8d59", "value": "T124352346AE718453F6E10E7165A56AC30CBAFCB11975E61BF4468F0F3900AC6CADCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674986, "uuid": "553f56e6-af4d-4ad4-bd12-d01f0422b0bd", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674986, "uuid": "e443aa15-b299-4023-8cab-ad1c26d7cae3", "value": "24576:RvqqvYZAFnc7EtexlphsFHMQSuRoEPmXG1YO:8qvOA1jexlDsoAmXKYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674986, "uuid": "184b983b-5115-42ba-b6db-a194b071c979", "value": 1146632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674986, "uuid": "880b275c-c17e-4b8a-88ca-e6f919263463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f434e765-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745674990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674990, "uuid": "ce4a7b90-41a2-44cc-8c84-5757b3bb9430", "comment": "Malware payload", "value": "7df3608ae8ea69762c71da1c05f0c043", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674990, "uuid": "58294515-1708-4968-97ca-c03424c96884", "comment": "Malware payload", "value": "ecf9b0828798392080348e096e843458267b9df11ebc035ecd9c738bb69db470", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674990, "uuid": "0bd0d83e-3ea5-42e4-a94b-f6fabb39a968", "value": "T1EF941950B540FDFAE8D98BB910D2330991EFB060DB1DEA2B6940FE3C015AB6859739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674990, "uuid": "b7dad332-d469-498f-ac45-14344bb8e933", "value": "4bb209079142e48b3f78473c20f639c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674990, "uuid": "1422eabe-b135-483b-89b4-217ecdbddfd8", "value": "6144:xUqYwuIRcCdb4vngCuoyGIlAkAzQXIwWNQBUh7g600NifMohIUiaBQv2kzmOWw:xUXCio4yLC1k5Gq0o0a8FrWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674990, "uuid": "38079533-090d-4811-9c6c-ac517c1b6118", "value": 435820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674990, "uuid": "930aa7ed-d4b7-43d9-b641-d566fad3768d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cdb84c-4acc-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745674991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674991, "uuid": "c80ed7ea-670d-441b-92de-2505a1d2488f", "comment": "Malware payload (Stealc)", "value": "5dd9c1ffc4a95d8f1636ce53a5d99997", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674991, "uuid": "53016e1d-f5e2-4e76-883c-9df87c6bd4ad", "comment": "Malware payload (Stealc)", "value": "d695267de534c2c99ec2823acc193fdbec9f398b0f78155ae2b982457ff631aa", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674991, "uuid": "83d4a104-fb35-499b-844a-aae969e16a89", "value": "T12E84D01135C1C4B3E93329350AF4D6B96B7DF9704EA64E8F67984F6E0F302829621B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674991, "uuid": "ec1f1171-1efd-4f1c-a9f9-ada0d9e89ac2", "value": "6addd02d82538c2ca23958c8c292883b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674991, "uuid": "c8c0cf1c-4356-4144-a844-c8ed047a778d", "value": "6144:VykkCFQ1esX/lLdp9k/dO/Yu0u9KIv7AGjTm7iIJ3Aqu4lQdvqb:lkUQ1esP01uYu0u9n08m/xV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674991, "uuid": "fc939722-6cfb-4063-a8c4-20ffab8091b7", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674991, "uuid": "09549fe0-785e-46a2-ae77-e722009076de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca30404-736f-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674994, "uuid": "03d2de85-d6d3-44d6-aad7-76ad93407bd1", "comment": "Malware payload (RedLineStealer)", "value": "1b2583d84dca4708d7a0309cf1087a89", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674994, "uuid": "776ed1f8-9199-4b31-9749-02afe4dabaf5", "comment": "Malware payload (RedLineStealer)", "value": "e0d9f3b8d36e9b4a44bc093b47ba3ba80cabd7e08b3f1a64dec7e3a2c5421bac", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674994, "uuid": "ca2c7f08-b0d4-4d69-8205-9251c902dba9", "value": "T115C49D81B359AD12DA6B06F6900518A01E71FF79E90BC71AAEC77FBF7EB232151118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674994, "uuid": "3f6e0632-31d4-4429-941b-b32361e7af2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674994, "uuid": "a03d1933-212c-45b0-b0ed-be934f979222", "value": "6144:sYqdc0NkzDVATfmTIlA41EBcN3p0NIb88WsNMPaKFP3b2V122J0sL:s9J82jXccN3CNIb88WsNMP5F1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674994, "uuid": "2db497d8-f51f-4b14-8edf-917365c4da56", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674994, "uuid": "94f0e580-bf66-4949-a43a-7651f98c6dc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0570091-62e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CoinMiner)", "timestamp": 1745674996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674996, "uuid": "7fe33d02-1b7b-433e-aafa-b658df72d565", "comment": "Malware payload (CoinMiner)", "value": "43bce45d873189f9ae2767d89a1c46e0", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674996, "uuid": "b55b1591-e479-433d-b544-b086c6591773", "comment": "Malware payload (CoinMiner)", "value": "9ae4784f0b139619ca8fdadfa31b53b1cbf7cd2b45f74b7e4004e5a97e842291", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674996, "uuid": "8502e48c-8df7-48b6-99fb-4a032da72828", "value": "T19EE69E5AB7B900A9E477C278C5975217F772B811037097DB1BA4A6B91F33BD0AE3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674996, "uuid": "afbcf163-856c-48bd-8d6d-b11f39c65624", "value": "7f0e1170ffadddb37aa500dea54d9334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674996, "uuid": "1bd6c0b5-1ed8-41b3-bacd-427c4c7b3e7c", "value": "393216:4PsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCvfxlXnwXAaGueVW3XSdEVB3:4ITkS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674996, "uuid": "a7bace08-d17b-45db-ab97-8aa6213e3924", "value": 15180800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674996, "uuid": "4203bb85-40d0-4480-91a3-96b5ae121d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af058be8-55a6-11ef-ac1d-82aee05be84a", "comment": "Malware payload (XWorm)", "timestamp": 1745674998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674998, "uuid": "e150aca5-7ab6-413c-b8d8-73a1ff108974", "comment": "Malware payload (XWorm)", "value": "0ec1f7cc17b6402cd2df150e0e5e92ca", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674998, "uuid": "7392b243-0648-4941-96c3-b2cebc789f5e", "comment": "Malware payload (XWorm)", "value": "4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674998, "uuid": "e701d7b1-0197-470f-85c0-00a9d86b1271", "value": "T19B649D11B541C032D6A110345B38BFB1892DEE350FA856FBB3D4497EAE702D2AB36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674998, "uuid": "630cb0e2-92fd-42ac-bb7f-407015b2d819", "value": "89d186e701948ed4026afa52bc6342f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674998, "uuid": "fe4bc31b-6eba-4011-a776-167d58711529", "value": "6144:nx9ooeWfqpO3HS0f+KIXDyqR9NKtU5tyt7EJtdb/yw0cV3IOfe52GGZ2OGe+CKip:nx9onKM2+KIXrLGw0ci22OGe+CKiV9pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674998, "uuid": "8e102056-319e-4ca2-b1e2-9ad05146c22f", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674998, "uuid": "2b9f3264-a7e0-429e-b11b-8db1cb08e306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddce021c-571f-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745674999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674999, "uuid": "0a30d643-cb05-49b5-a30f-d63d508a03b6", "comment": "Malware payload (RedLineStealer)", "value": "0d76d08b0f0a404604e7de4d28010abc", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674999, "uuid": "e5571502-2a89-45e7-9ec6-3cd37fa30ce1", "comment": "Malware payload (RedLineStealer)", "value": "6dcda2619b61b0cafbfdebb7fbb82c8c2c0b3f9855a4306782874625d6ff067e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674999, "uuid": "6bee2495-2721-470a-a9a3-43f9bb660eac", "value": "T1E1647D1823DC8911E2BF4779D8B1E2749375EC16A813E30E4ED06CBB3E36741EA15A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674999, "uuid": "a8bfaf65-ebc8-4944-8ba3-35eda4413729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674999, "uuid": "682a2a0d-eecd-4864-b48e-3bc1fab86282", "value": "3072:+q6EgY6iOrUjZxA0wPE9tHpZQgeHTAetVSKPyccZqf7D34teqiOLibBON:lqY6ipwPuHp+geHTAqV9yccZqf7DIXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745674999, "uuid": "435e31eb-cfb3-4610-8d92-fca90e68937a", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745674999, "uuid": "21cfd95b-d21d-470d-85d5-526c5dd10825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c209634a-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675001, "uuid": "5eb6c245-5d14-427d-91b8-547077f9f351", "comment": "Malware payload", "value": "4f87c94096d58e923812c23b8d5c36b2", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675001, "uuid": "7680734a-a3bf-4938-9083-98d2d7b4becc", "comment": "Malware payload", "value": "27085156ea5d861390ca922d8aa78e234171f64747c942de379bfa8917cceb17", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675001, "uuid": "6dc308a5-89f5-416d-bc2b-6a3e65706f0d", "value": "T1488218107BFE951CF6B71E746CF27682097EFBA32D12C69E1945520A5D23A848CB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675001, "uuid": "64667ee8-bab8-4c93-8d57-775ed283be57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675001, "uuid": "a1bcf072-a916-4ece-a628-2708b29bf521", "value": "384:Vp9wkk1TDt69/M/XKl8e1EQjec9XsEmJUOanQQV+:EtD4WKnLyc9+J0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675001, "uuid": "a2d290d1-6059-41db-a1ad-8d2806c57671", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675001, "uuid": "6afb45a2-f227-4164-bf4a-2108e76c27a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ca90c6-81b9-11ef-afe5-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1745675004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675004, "uuid": "821980b0-855e-41cf-bc20-42e826d7dac1", "comment": "Malware payload (AsyncRAT)", "value": "8432070440b9827f88a75bef7e65dd60", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675004, "uuid": "97bd89ee-3ad3-4a83-af32-11822d76c787", "comment": "Malware payload (AsyncRAT)", "value": "459443def8fd0c940b2da33d9703fcf5771dbcd9ce4aff2dcc670528c1d1d3c1", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675004, "uuid": "27f95366-d6d6-4975-9860-7eafe74bd7f1", "value": "T16C15121567ECD0B6F4631B340AB2DB7669F9ED100078C10BA2D7FEEB7A72089855CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675004, "uuid": "e1728082-3c02-49d9-888e-30ce62bd34c9", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675004, "uuid": "297eba92-1bf6-44b4-9516-a1da2443aa7f", "value": "24576:ZY/1EAAfF8FU1lqbrkSqdKHYiJfLYkoDhsYPWLiK:8VAt8FU1lekSq0c68FK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675004, "uuid": "36ac7857-a1e3-4db8-8d07-54fa8bace26b", "value": 874887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675004, "uuid": "9509dc73-a6a3-4122-82b2-47169f7f5432", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21729b0-5ef1-11ef-ac1d-82aee05be84a", "comment": "Malware payload (XWorm)", "timestamp": 1745675006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675006, "uuid": "602b546b-52b6-4000-ac67-262b0ce8b9a3", "comment": "Malware payload (XWorm)", "value": "11f656a0e8ab8563f91028a3c95802e5", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675006, "uuid": "2629c773-6675-48d3-a045-99653b20ceec", "comment": "Malware payload (XWorm)", "value": "b4a7a6e6fb511671814ff6b1070923701594b1a20f2c8f0ab5f658259cce6973", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675006, "uuid": "837900fa-39af-4c7a-8834-421756f0bcde", "value": "T1D512E80A97E84B27E0B65F7A3D734340023AFA658D26DF6F59CCA10F2E7335446227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675006, "uuid": "3d131b7a-2e78-4301-9ae9-c275bf57a986", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675006, "uuid": "922a9510-19aa-444d-a380-1aaa4643f3fc", "value": "96:2VUvX7JP7VEKiMY9q40+fjTMeNj4KEBFBQW+rGNcY0lgz2AcCMJG4xYQV0u342zj:2VoX7JPuRXH9j4K2h+l6oZVYQV0HQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675006, "uuid": "71b1e9e4-9ee4-4195-9b1a-9ed252b8098b", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675006, "uuid": "e2b8f7cb-9a06-451a-b0cf-57d30fe7fe6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5eafd7c-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload (DCRat)", "timestamp": 1745675007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675007, "uuid": "18a4db82-8b97-4b4c-a2c1-ff4f32bd2fc9", "comment": "Malware payload (DCRat)", "value": "2167dbb528ac2b7b3c6e33f287bd2b8b", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675007, "uuid": "185b3a70-719c-4008-8749-a46991de685c", "comment": "Malware payload (DCRat)", "value": "34de8dd822d879b0b1e32d2fb7e1a08757a2803fa610ffe714b2951c7f1e74d8", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675007, "uuid": "61e365eb-0dc0-416c-9579-64e3c833dfe5", "value": "T18C657B017E84CA12F0191633C2FF854447F4AC91AAA6E72B7EB9376E55123937C1DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675007, "uuid": "a045dea3-e1ae-4ae8-ae83-752573f9cdef", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675007, "uuid": "c8f1a60d-cf61-4c82-995a-bbde373fc75b", "value": "24576:U2G/nvxW3Ww0tynsUHw3iQnhF5rH9WDZOxz7pQmMn0PPxS7zH9L:UbA30OANbBpGn0PPa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675007, "uuid": "2630cd98-5658-4569-becf-3c1631ebb8a0", "value": 1443555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675007, "uuid": "8c558974-88d9-4426-8d6d-4e6960ff6c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8d0444-5f09-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675008, "uuid": "2444bc0d-7675-4ba1-970e-cf9e8b3e1cdf", "comment": "Malware payload", "value": "1f6c6f36d126cd027ded1915e321c693", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675008, "uuid": "ad308035-8020-49d4-954e-4ca065f63121", "comment": "Malware payload", "value": "cc3557f4fdaad9aa47bf46dce4f0a8e0a45d7e81084962a54b67b4f55f8bf64c", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675008, "uuid": "a42fd873-1d2f-4112-aff9-046ac3d8008f", "value": "T1E5076B43E89540B9C59AE231C96682527B757C48873177EB3B60F7B87F76BC0AA787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675008, "uuid": "b95e5ede-0aff-426f-bc5b-8105e32e0bfa", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675008, "uuid": "721af538-d251-47e8-a17b-364fdc2e96ba", "value": "98304:8WJWZ3fhw2RuB0yZ8KhBc18zCEy5h3RUcNikFElaeDiyilOIN+gkypKuZ8U:ZWfhwH0L18zPy1Nik+RmJkhypn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675008, "uuid": "22bad334-8e7e-45ed-82bf-5bce2791f90d", "value": 17171948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675008, "uuid": "eba02dce-9d0d-4c19-bb77-300e81449f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99d43f9d-62e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675010, "uuid": "e0907471-861e-4ad4-8243-2ef095031457", "comment": "Malware payload", "value": "457c9342db5fc82febdcf8a348123a0e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675010, "uuid": "44ef1004-83f6-467e-a050-82853e9c4eb3", "comment": "Malware payload", "value": "c4343749a452155318b249b122c8482e953994e31627cbc82a3c3e52c21ef902", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675010, "uuid": "db24167c-8385-48cc-9a6a-86426f7889ff", "value": "T1528523177D6681A2C6882BB6EBA715487377D741A302D70AF85E23261C0FFEBD1613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675010, "uuid": "e30c03f9-5c61-4072-aec6-de2b11142cc1", "value": "49152:qF2F3S1EtBhUFwbKfy4idBIuBjwTiQocguqaw+V:q8F3S1WUubYTjuBSkcgVaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675010, "uuid": "7d916aa1-8dea-4a44-b256-fbafbf5440a0", "value": 1856512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675010, "uuid": "0fda2468-8b93-4632-ba7e-be4ff3d6d32f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bd0ce7-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675011, "uuid": "b65539a9-76f8-4383-8d7e-cf53865f788b", "comment": "Malware payload", "value": "1f602b0591142d5da70ebd17228d2d46", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675011, "uuid": "c9604183-0be3-43f3-aac0-b363e04a2464", "comment": "Malware payload", "value": "a2eb96a74d37068c2116ecdd5f6efbc3bbe83220d98ed9b3bbbe22f6fd23ea72", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "dd4f0b21-3d0e-4877-9e10-010203ce07bc", "value": "T14BE5AFE8D0AE40D2FC076FC564287EC747323273CEE50428276E7A484F7BAA95549E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "00b556f3-ef9c-4f2f-9373-f38b53f0282e", "value": "24576:clQiaq/CwSo9kRrIBFmKvTRtWOdn73O54R6HlufvWKw3N6TWZ8yYh03Ll:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675011, "uuid": "2d224b0a-bef2-4d20-98b9-9b64ef9f228d", "value": 3195392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "153016ef-94de-4902-870c-2b501e910edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3800977-57ef-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675011, "uuid": "93f6c2de-06e7-4063-ac6b-631d98187a84", "comment": "Malware payload", "value": "5f283d0e9d35b9c56fb2b3514a5c4f86", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675011, "uuid": "4e0f9584-e278-4087-91b7-c805c684f8b3", "comment": "Malware payload", "value": "41657910cd010c7e5ebbbfc11a2636fa1868a9bffe78d98b8faa7bd0e9c5c3b8", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "ebda0440-bbb1-4787-b783-d33cf49c717d", "value": "T1ABA67D7F72A6926CC2AEC53AC1A38F00D43371B51B33C6E7929102695B169C95E3FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "2f5a0ffe-960f-4fa3-8d76-3858a47741be", "value": "93b0547f5090c9427cc4f187c26f3f73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "2006383c-e8ac-4ccf-ae0c-19c52670d01a", "value": "98304:PhkHWcnoeoJETpLcGQF3CRqQh+R3VH+TSBEcDqpK5:pYWQoeo8cGQ3wqQGleTSjq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675011, "uuid": "3cc6a2ac-540d-4175-8ef7-fe4429691372", "value": 9638912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "377d3b26-1e9e-4639-a600-ba354c08ad5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bee9036-799d-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745675011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675011, "uuid": "7ddee508-461f-4501-8522-d95eab27ddf5", "comment": "Malware payload (LummaStealer)", "value": "8560f9c870d3d0e59d1263fb154fbe6c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675011, "uuid": "e36ac74b-1cb7-4b70-b9b9-bd1599bfde31", "comment": "Malware payload (LummaStealer)", "value": "99d846627f494e80a686d75c497db1ac1aadf4437e2d7cc7ace2785ffa5fa5e0", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "36c4fc40-df9b-48a0-9bd4-ef291608e40a", "value": "T19B64223A06755B9EC0F34A7BA44621596731B33E1E23717306430539887BA9ACFD27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "33454280-0f70-4462-ad2b-2014acfd1666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "59c4f4c5-4e05-46de-a4fa-eeffbfd11f9e", "value": "6144:t7QNIQVT4lLQC1ILO/3zesu2r3dEZCqYFREoBDYd47z:FkT6n2LmjBT8wFREU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675011, "uuid": "22c39b18-b7ed-4f00-a9af-71b9529a1aa7", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675011, "uuid": "287fd56c-0a39-4650-9c98-fab62e3b2d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f35ae5-5f0e-11ef-ac1d-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745675012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675012, "uuid": "1ed32075-db23-446c-97f5-5bb85f618e1d", "comment": "Malware payload (LummaStealer)", "value": "4b85d1518b4edc2239da008e3a91a323", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675012, "uuid": "7c601429-59b7-4c74-a8e5-f44ac7e9dec6", "comment": "Malware payload (LummaStealer)", "value": "3266bf53273feea7374264865066f706462ea323d8c26cba051cfcbefc1fcb80", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675012, "uuid": "e70633ae-acf5-4357-ab0b-57de20d24e2b", "value": "T1C1365A17FC9144E4C0AAD63589669262BB717C884B3123D72BA0F7783F76BD09EB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675012, "uuid": "eafde4ba-8185-4b3b-9f0b-fb9c50ff3223", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675012, "uuid": "997ae3c5-cf3d-4bf3-9e6f-7f2eff6e78dc", "value": "49152:0GxYkG5bhNgDjTkxPpq89ZyQo+3rk8nT2X0m/EbwNjPXAjb5Et/VMW/TJxFPRcKd:DBGFIDOrzT2ke6EK1GdCLuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675012, "uuid": "eb3607b9-0181-44f4-87a3-dda26183cbf8", "value": 5181952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675012, "uuid": "b854d4e9-9e4d-4adc-b7e5-301ee6c32a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a70d54c-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675015, "uuid": "701e2c98-2c06-491c-a146-01c69392d973", "comment": "Malware payload", "value": "7682909e9bda1e07a178ee76c114e42c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675015, "uuid": "b660d29a-3da5-4b36-8a66-ed35d21e1379", "comment": "Malware payload", "value": "c9c2671d59e747d93585102e1af0215aaa8e9680c5616f17599380e5209a0d0d", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "50675459-7cc5-41ee-b0c9-90864fffeed6", "value": "T180375B6F76A58278C16EC13EC0B38F01E93370B91777C6E752D106A98E569D09E7FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "04c22a85-0db6-4fd5-9ddc-ab06737cd75b", "value": "5a6977da69b938abc407aaddd312239b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "47728079-6e04-42b5-a8f5-eecc310a7dd9", "value": "196608:ZBws4UYoeoQhEmVgRq8syfKmRQpBVZrasK5hTuAvYct:ZcoeoQhEmGLQph6UuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675015, "uuid": "491caba7-88ac-4217-b692-0efa6b1c80f4", "value": 22418944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "1edf37e8-fe8d-4f22-a99b-d2e7d34423de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414db233-c23b-11ef-afe5-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745675015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675015, "uuid": "acdba45d-beaa-4666-a382-7978721de493", "comment": "Malware payload (Stealc)", "value": "89ad45b4a0e2d547c1e09d0a1ea94df6", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675015, "uuid": "7a659989-3352-4e69-9af0-0a54643a0980", "comment": "Malware payload (Stealc)", "value": "18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "c34ab43a-2cc5-4c6a-8137-d78c4418f5e1", "value": "T1B7341925EF40443FEE12867CD6F963D5B22669A46312D8D333C825198DF40E32D7E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "f986ac29-cd70-4486-b9fc-d632d23e0a2f", "value": "d071ac95ea1d6b0ed6ec53017449901f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "ddbfc220-14fd-4cfd-bc17-0e082c4cc94c", "value": "3072:skv0eu6ZJlctXwLISyqlsxfKPkAck1gD1l567pGDUJ42pUvp85lmv6RReHeP3Kqc:/MeNRFLIu5ckeHgFGD+jpUvwzzeot+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675015, "uuid": "2801a190-5954-433e-bf25-0340867eee8d", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "152ce152-7c16-4b68-9764-82b14b85636e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04015fe4-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload (Vidar)", "timestamp": 1745675015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675015, "uuid": "b5cb965e-d729-4952-a1c2-aaaceb6d424c", "comment": "Malware payload (Vidar)", "value": "1e1d5412616216fd90ea3cb6a87353db", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675015, "uuid": "a2c3da9e-0ee6-431f-abd9-334d91a5adf5", "comment": "Malware payload (Vidar)", "value": "765eb00651ebf6ddbc9c8d6e687292dae89f0d8260cea08505020992835208d8", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "e6272457-67a9-471d-b699-972b804e9d38", "value": "T151849D1623E130F6F2225534B6494721CBAB78341622F75FABC805656FE6BC1EE2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "dee5c99c-b633-410d-9cf2-5c564e056456", "value": "118187c3a5a9d853faf932e2bfb655fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "a3ddb0bd-48b7-4f09-8168-feffff66680d", "value": "6144:MGO+83+N11n5au8LvOWjTMZG6wn+O8qkx0wKYHMCsHW+S0ZaaPG:MGOv3+N11n5ALvpjTACn+dqk0VYExdZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675015, "uuid": "3672b839-7626-4aa6-a5e6-7e48bc79bd0a", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675015, "uuid": "a7c73b5e-520e-4adb-887f-719c2bba1a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721c23dc-5b1f-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745675016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675016, "uuid": "cbaec476-b589-4c06-a152-36a9dd83c32b", "comment": "Malware payload (RedLineStealer)", "value": "6b1bbe4e391cdfd775780d8502ccbc41", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675016, "uuid": "5827be38-0041-427e-9ac3-2a7ce6bdf940", "comment": "Malware payload (RedLineStealer)", "value": "2999b0ecf157b9f37dcfa1cb4a0ffff73092c416499a356fdb1558d66985e9a3", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675016, "uuid": "97266d28-df40-4f48-a3ff-424ac910ac37", "value": "T127C49D81B359AD12DA6B06F6900518A01E71FF79E90BC71AAEC77FBF7EB232151118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675016, "uuid": "3d7841c0-c5e9-48f6-9057-25651851339f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675016, "uuid": "119b2d7b-65d4-4711-a6b0-2a48a4ccb659", "value": "6144:sYqdc0NkzDVATfmTIlA41QBcN3p0NIb88WsNMPaKFP3b2V122J0sL:s9J82jXgcN3CNIb88WsNMP5F1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675016, "uuid": "9d4d3c83-cb57-4e56-90c1-b54db467d3c3", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675016, "uuid": "20f0502d-044a-4d1c-93bc-f7a6d8c5a514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463a6768-521e-11ef-ac1d-82aee05be84a", "comment": "Malware payload (SystemBC)", "timestamp": 1745675019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675019, "uuid": "fc4d1acc-dd2d-4c9c-9f22-d5cc5471a871", "comment": "Malware payload (SystemBC)", "value": "170fb4fa36de83de39a9e228f17b0060", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675019, "uuid": "bf11f54b-c569-4a1d-9c4a-5fb0050e255a", "comment": "Malware payload (SystemBC)", "value": "145dbb397089105d6d06a861d62b48be9fd2527fb7d023b114cf05b723cd3858", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675019, "uuid": "0e8f2f58-e38b-4079-8091-738452af7809", "value": "T19FA59DE491AA40D2F80F9EE05428BE8207B132B399DB153D175D7A084F6FF947989E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675019, "uuid": "cc02c069-9c86-43e1-8615-82a701d6fb8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675019, "uuid": "d0276b72-e0da-48c3-9c4e-bd177d8fe17b", "value": "24576:qM7wJrWiSgXXHgdjvYiKs7KHxGoz8oVWtnq4cPgv07ZNAqbJBO+kLQL3cOEKFHt:r7wJVSoFL3cYFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675019, "uuid": "c5bc4d3a-ccca-471e-8d85-7a6242968b9c", "value": 2147840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675019, "uuid": "7eb36673-94c3-49a8-9599-5602ee093332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896e6494-7783-11ef-afe5-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745675020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675020, "uuid": "d8df6862-4057-46b0-a716-669b35cc7d84", "comment": "Malware payload (CryptBot)", "value": "99848d0ddfc95e855c62d8932845ae6f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#ff0948", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675020, "uuid": "e88d3751-02eb-42f2-a3af-05cbc4aea269", "comment": "Malware payload (CryptBot)", "value": "79d833993d87d2a09f6ba97c17af49e30483e7d934950c00c762ef5dc3893b84", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#ff0948", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675020, "uuid": "d6406a7d-5697-46f2-a36b-5ab8156f3531", "value": "T17066283B9B4345CAC12FB57ADC827F3FF4286ADC4329891B6C0548BCA755795A8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675020, "uuid": "56231f47-739f-4503-9722-05b544ebbb88", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675020, "uuid": "3773f9e0-7c07-4b72-955a-36ae6191c18d", "value": "98304:BkuXLm0IH9OJy/fZ6IcLWTMEKJRnghQICSeli4EekEJ:BXXLmz9OJyXZ6IkkArsQAqiPekEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675020, "uuid": "1b767516-4567-48fe-8393-99b609fc5bec", "value": 6677109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675020, "uuid": "7906243d-6538-49dc-b1d5-1088a0bd47ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd0132a-4e17-11ef-ac1d-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745675020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675020, "uuid": "79f1d385-46b5-41c8-aed8-040beb310ad9", "comment": "Malware payload (LummaStealer)", "value": "c53bb047b93851b66fead144d7c46ff3", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GoInjector", "colour": "#240504", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675020, "uuid": "d3ec2f97-9df5-47bb-95f4-654ab73e6c7e", "comment": "Malware payload (LummaStealer)", "value": "54092d2fb30f9258ab9817de3b886997dbefdee2963b4d051b70c0309aea99e6", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "64", "colour": "#aa8ece", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "GoInjector", "colour": "#240504", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675020, "uuid": "99f4851e-b58d-425c-96ea-1d40601fc9ca", "value": "T132373847E99545E4C1A9D534C9628626BBB17C498B3037DB2B60FB793F32BC0AE793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675020, "uuid": "418c44d8-8cee-4977-8235-92e5d0a2fd0b", "value": "d309dd91e2ebd5238728f8f2ffd958fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675020, "uuid": "0ddea0a3-c9d5-4c45-8463-f495f1765117", "value": "98304:8/9by/rwaIUiwqrhpZ28B8ENcFsBEu7eHIHZvEGIjwXApNZciGC5mNX:JrwaIuq9G8BVNcSeJGLqciGqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675020, "uuid": "74acf32f-c056-4e79-8ceb-13d830201d99", "value": 23120896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675020, "uuid": "fb7e36db-b2de-41c1-b422-6a28c17f6b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd2c089-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675022, "uuid": "218b12a5-951d-4086-9c2e-d949e92fa805", "comment": "Malware payload", "value": "e6d27b60afe69ac02b1eaec864c882ae", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675022, "uuid": "109bd77e-d06c-4e5c-9f6f-bf0f1bd3cbce", "comment": "Malware payload", "value": "aac36ff20ea7bfc0591c1d6b145b456bad394ee8e619343ec10d1809188edd75", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675022, "uuid": "488c6de9-f335-406c-83da-152a41962cca", "value": "T1C965231539D0C472C1B615321EE4DE715A3EBA714FA1DD8F23908FBE9F20381EA256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675022, "uuid": "689b1f4b-d32b-487b-be9d-559e88625afd", "value": "2a3a77821d17fe4f1ddd06a7e2305b3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675022, "uuid": "a671ca1e-921b-43a0-9812-029e8349972a", "value": "24576:8IzF6Nh21lqc5q+ufSpodH9iJFK3PJ+4PvXpWRq1Wd3pUNKrXDIcmt:8IQo1IcM+ufSmdiUfg4PPpWRKkUZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675022, "uuid": "c71de034-91ae-4eb1-be86-6711a8bc10ac", "value": 1451088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675022, "uuid": "4d29f0d3-2aa5-4cdc-bbce-62769862eada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f4630b-52de-11ef-ac1d-82aee05be84a", "comment": "Malware payload (PureLogStealer)", "timestamp": 1745675022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675022, "uuid": "a537affa-2788-4fd0-a1c5-b6f61215dc72", "comment": "Malware payload (PureLogStealer)", "value": "1de4c3cc42232c1e3d7c09404f57b450", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675022, "uuid": "7e23bf6a-6cda-46f5-afe9-8d6b3fd9073e", "comment": "Malware payload (PureLogStealer)", "value": "131e2baac32f898ab2d7da10d8c79f546977bc1d1d585ba687387101610ed3b9", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675022, "uuid": "26bf24a7-c546-419b-951e-080ee0185e97", "value": "T1575539DC765036DFC86BD4729AA81CA8EB6138BB530B5207906729EDDE4C897DF140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675022, "uuid": "03c2fb9b-10dd-4337-8f24-0e9d5cef2102", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675022, "uuid": "34ce65c7-fc44-47f6-91f9-61ea5ce7cdf9", "value": "24576:lEr/LERGBci2VYs1xSiWepMCpmh8Qa4sJ/50iU2:CWUciCtxSiyCph44y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675022, "uuid": "eb93f7ec-18a8-4265-a1d6-1764886f4027", "value": 1403392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675022, "uuid": "909dc51d-e6df-49b5-a825-1c5376af8732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b8f063-5ef1-11ef-ac1d-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745675023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675023, "uuid": "6e7abb86-873b-46e5-82aa-201768875112", "comment": "Malware payload (LummaStealer)", "value": "9954f7ed32d9a20cda8545c526036143", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675023, "uuid": "de718461-6ae5-45e4-8f44-43b8e4603efd", "comment": "Malware payload (LummaStealer)", "value": "a221b40667002cd19eece4e45e5dbb6f3c3dc1890870cf28ebcca0e4850102f5", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675023, "uuid": "8d7f2a90-aeb1-4c51-9997-a635b6ee045b", "value": "T19F4523C3DEF09111FB5B8F3425C894A26E785E50FDA48286D2987D947BF2BC5091C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675023, "uuid": "51efafee-5561-448c-89fb-47fdc493a2a0", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675023, "uuid": "dba12977-ae49-4d6a-be75-97ab5f3f6019", "value": "24576:VzZhl2UEVJ/TDFjNuNl0S7u3dqoIESs4OUYyPF8P7cMDeB5obaWXRWIWI:VkvbDpNuT0S7u3dtIbYUYyd8PAMC+aiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675023, "uuid": "83fe642b-8e72-423f-8644-75cf902ea663", "value": 1190888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675023, "uuid": "004cc4dc-e81e-4671-b02c-42e902efad4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815bd4a8-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675033, "uuid": "3e835ce8-c510-4001-99c4-0a6b0b480667", "comment": "Malware payload", "value": "4ae02ce23e76c0d777a9000222e4336c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675033, "uuid": "cccdeda6-8896-4dea-aab8-e28a20e42285", "comment": "Malware payload", "value": "87202ddd20d67f566b2e49c98ceea801f58f72e66b47e61f8daf0d70521546f5", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675033, "uuid": "9091f3e6-830a-4807-bdd8-0147fc9c8148", "value": "T1A1E42345BD69DB62F8B645FB298404FB3CAF46AD0197010659D4B28F9AE130B3133B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675033, "uuid": "adc03652-c5d6-4d7c-8f5f-66cba317e9b9", "value": "12288:p5f3l8xufKg2UMSo/olMCsfMWsM8bs/AqFyJVH8sy9r/ud013YQqrYDiDM4kp:ptCFnVwlMaKAmyJ9etmyYQqrwiJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675033, "uuid": "c5871819-13a6-44e0-91f9-9e1959e0d28c", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675033, "uuid": "c1d6f869-c0db-4ec2-a374-08372499bbd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2458589-55a6-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745675039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675039, "uuid": "141775d4-487d-43eb-ab31-1b1dff56a8e7", "comment": "Malware payload (RedLineStealer)", "value": "aedfb26f18fdd54279e8d1b82b84559a", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675039, "uuid": "d2134cfc-172a-4d4b-a31b-e117b6f9ccf2", "comment": "Malware payload (RedLineStealer)", "value": "ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675039, "uuid": "3579df87-c880-4b79-94f7-6a74f1a1be8e", "value": "T1B7646C1823EC9510E37F4B7994B1E6749375EC16A852E31F4ED06CAB3E32741FA11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675039, "uuid": "66ebf21f-2131-4dc6-a8ce-f8d628f6408a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675039, "uuid": "c636b704-4d43-45e8-a117-b9cd155276f3", "value": "3072:lq6EgY6iwrUjL849wPzsyozn/jBCTAvtA2iZpcZqf7D341eqiOLibBOc:sqY6i/wPEPBCTAFAvpcZqf7DIfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675039, "uuid": "e4b5f02f-6f3c-4ae9-8897-f27f9285eb48", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675039, "uuid": "28c44241-c7a9-4a07-b154-4eeeafd406a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfac11f-21c1-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745675040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675040, "uuid": "07ca8b5e-ae4b-44e4-815f-88cba89d32e4", "comment": "Malware payload (Mirai)", "value": "a1a4bc1ee68bf59c52d6d81422b401d6", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675040, "uuid": "2d1416e0-a46e-4349-89f2-88d4e1a9a71b", "comment": "Malware payload (Mirai)", "value": "896283fa190704ad5efda474ff9e6b96b8cd00caa2946d9d348b8763bc01df93", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675040, "uuid": "fd97c5ed-5ccd-423d-8da0-284abb110289", "value": "T1D1C33AC7E642C7F3C4430EB317A7E66D4625F836891A8F99F31C7CB49B129C9B2192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675040, "uuid": "bcdf6b2c-298f-4cd3-87a7-e9e506f2feba", "value": "3072:MBkENVx+92JRVaTeuEBFkPTRnpysbmF2v69ny6JP/KTiFi:MJvx+U9RbWTRnjmwv69ny6JHKTiFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675040, "uuid": "73786716-a784-452e-869e-cc140e98e195", "value": 122398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675040, "uuid": "c7b6a490-d685-46c4-a716-03657b1e9f25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130082fd-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (QuasarRAT)", "timestamp": 1745675043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675043, "uuid": "96f4ca8e-5932-49c6-9acb-8beb9048ff6c", "comment": "Malware payload (QuasarRAT)", "value": "94222631ef1071a4f7ceb180cf8a4a5a", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675043, "uuid": "20127943-c72a-4d60-b716-5bfedcfb1f82", "comment": "Malware payload (QuasarRAT)", "value": "a45b373b780f5b9fcf5c51473c69bbf0ed650f300523097602b35f5222bd122b", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675043, "uuid": "316f3cfc-b5f3-473b-8c12-cccd54bb00ce", "value": "T154E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675043, "uuid": "5cc8f8ce-85aa-426a-b5df-511b2f3beeeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675043, "uuid": "7f3b1fd2-a0ae-4a53-86d0-504b78ae3dac", "value": "49152:ivht62XlaSFNWPjljiFa2RoUYIo7RJ6SbR3LoGd+vTHHB72eh2NT:ivL62XlaSFNWPjljiFXRoUYIo7RJ6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675043, "uuid": "d994e94b-1536-4bae-93d5-efd52bc04ed7", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675043, "uuid": "64150bba-b9cb-4390-85d0-34d967bf029c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2197f486-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675043, "uuid": "f35bce91-cb5f-4164-baeb-0f07b59e8901", "comment": "Malware payload", "value": "62b9695de8a9804b9ea04b2a724ea509", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675043, "uuid": "0170033c-2134-4b70-bc60-f5901a33ea6e", "comment": "Malware payload", "value": "fda5a3cad6c0b17feba517625f66e3585f668e5f341ae8a41edf7aadb98c8904", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675043, "uuid": "669870e0-f324-4e7c-ae3f-3a32e54ebec9", "value": "T16D964A17E8A540E8C0AED674C92692637E71BC485B3027E72B60F7642F76FD0AE797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675043, "uuid": "a80447be-aa60-4b38-bacf-9bcbcec3dc15", "value": "5a4f5d74f730fa768c9ddfb9189df87c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675043, "uuid": "7a4e196e-027a-4094-a635-767c815db9e4", "value": "98304:8weNNnuXwASs4iMLghjkYazGW7VuCAp/EcQAdk:IhuXwASs4it+SMAKNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675043, "uuid": "13ad3826-37f7-43be-8727-6c739ff3be78", "value": 9241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675043, "uuid": "074147b9-130c-4fae-846e-9d63a7471d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584fd652-6952-11ef-ad0f-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675044, "uuid": "cb598d41-ff2b-4bf6-89b4-63966967598e", "comment": "Malware payload", "value": "b73cf29c0ea647c353e4771f0697c41f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675044, "uuid": "2cbe97bc-0477-4cb2-8448-8c5edd93f014", "comment": "Malware payload", "value": "edd76f144bbdbfc060f7cb7e19863f89eb55863efc1a913561d812083b6306cd", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675044, "uuid": "5463ca25-69bf-4c2a-a903-99cfaf0a3c7f", "value": "T1F7134A61B2572E23CAE90AB5715412C007234E426850F7D82CEBB7BD5EFA741C571E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675044, "uuid": "8c9b39a4-1491-427a-8307-b47810c821b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675044, "uuid": "6650711d-f998-42fb-85df-3631bee6b28e", "value": "768:fcbuPx+zgDwfIH/335cJX2om4VQRIEvmg5+FOKo5h:flxT1H/335C2ozVQRItgMF4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675044, "uuid": "937bc0e2-9cdc-42b4-a8ac-ddb361eb2d3c", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675044, "uuid": "f39e783f-013e-4624-a632-ea3c45abc0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111fb8e2-8678-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745675044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675044, "uuid": "648a6a2a-7f34-4186-8eca-2b1fc1e58c8c", "comment": "Malware payload (RedLineStealer)", "value": "ea51ca3fa2cc8f5b3b438dc533b4f61c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675044, "uuid": "84845fdb-2e24-467d-8412-54620f8c2b9e", "comment": "Malware payload (RedLineStealer)", "value": "7659c35138ea1c6a181cc44d2c4cd6b2a30c995690b2d6566bb7e7875400db48", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675044, "uuid": "11fcea8a-b5a0-401a-8847-b1898b1f5ebd", "value": "T155646C1867EC8910E37F4B7994B1E67493B5EC56A452D30F4ED06CAB3E32740FA11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675044, "uuid": "8dddc936-73b6-4f7f-afdb-6346173e3fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675044, "uuid": "ddd5702d-65b4-4d42-8e6b-d919a073bfe2", "value": "3072:Wq6EgY6iwrUjpgcDwPdJCaKFGTAftASqOxcZqf7D34teqiOLibBO+:tqY6inwPqPFGTA1AIxcZqf7DIXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675044, "uuid": "6d3a0c8f-1f20-40e7-8d74-6970f4ef97fc", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675044, "uuid": "4e32784e-c9ca-4283-820e-c43d3f0f4ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41534b9-4b30-11ef-ac1d-82aee05be84a", "comment": "Malware payload (PureLogStealer)", "timestamp": 1745675046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675046, "uuid": "450e18d3-08d3-4902-9d87-64d61ba2343a", "comment": "Malware payload (PureLogStealer)", "value": "c1853d1c36dc461668c9af843d07cc58", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675046, "uuid": "2fe6da96-1fcc-4417-bc5f-34d08c577ddd", "comment": "Malware payload (PureLogStealer)", "value": "83cd3dcf4a855593ff0f594158ec9d27a8eb94172a92c4092138db7abfbc8793", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675046, "uuid": "f3509497-91f7-41ae-bbfd-7f4c88498806", "value": "T152958CDD762072DFC81BD4728AA82DA8EB5074BB830F5207A06755ED9E5C89BCF141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675046, "uuid": "fe2e38ca-d743-4428-81c8-da3597c8d6ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675046, "uuid": "4fc57f68-66f5-4be8-9798-1b71fbfe5b50", "value": "24576:lRZWnXWCyuj6D/ilNRjGjW9W9xiLdde7U8COWjp9/4QBmAsQtzOjLUt0yKHDKZHC:wnG5ujO/ilKjW8Ss7n0cfAHJbj1lg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675046, "uuid": "1645bcf6-2098-4e9f-b8f4-6dcc855ef7a6", "value": 2016768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675046, "uuid": "fc07332b-8878-4ab8-bc78-92b321be9e5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcdab33-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675047, "uuid": "dabc2f47-4925-4494-8305-a7e95524a53d", "comment": "Malware payload", "value": "7daf2d8d7def7cf4420e42a69d75b56f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675047, "uuid": "f69dfe25-2cab-49dd-bba6-11fbb8e5b32d", "comment": "Malware payload", "value": "03a1a478360f687b547445d82320989121f006f3cead2e3e6b9c02fde90b3f22", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675047, "uuid": "743c5b9e-ea5a-491b-acb0-7ad58aac6b90", "value": "T1DAA533D8CEACF078EB7497B428507511EDB74E1209B5F81F07909ECE39B2ED15A286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675047, "uuid": "93aa91a8-5ee0-438f-b72b-67e49b7bab7b", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675047, "uuid": "c953c713-796a-4ed1-9175-324fe4023969", "value": "49152:mrb82wedIM5/IsYrl099sKODU4qfrlY1s:qDluAIHwODElYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675047, "uuid": "93c59ac8-b645-40b4-9e00-0efd4b6ef402", "value": 2238837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675047, "uuid": "c0fa9ffc-82de-45db-bf92-cb4eadc1dabd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79ae0cd-4ced-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675047, "uuid": "2e36645e-a22c-465a-83ec-ca8d10f0c287", "comment": "Malware payload", "value": "dae181fa127103fdc4ee4bf67117ecfb", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#8F0CD0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675047, "uuid": "c7c3b598-8874-4ee0-ad1e-a4982e1575ae", "comment": "Malware payload", "value": "f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DeerStealer", "colour": "#8F0CD0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675047, "uuid": "7b1822a3-9439-4510-b42d-ff754aed4a10", "value": "T1FCC67CAB73E8866DC16DC13EC0978F01E837B5755B33C6E382A10678CA665C95E7E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675047, "uuid": "552a6f43-403e-40e2-89d3-6fcab08d5ab0", "value": "e5d00afba90fecbc1c6936fa6ea35d71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675047, "uuid": "f39ccf5c-629e-4326-882e-cdf9f4c01cef", "value": "49152:wdzUsKA6g3+fvby11dPgTdDdCSsYc30ZRiCXohOnCP+N8yG09rR/57WWTBtNUQ8d:cDGG09r957WWTv14E1pH3Xgb3kQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675047, "uuid": "cb80d882-1749-446c-acbb-9c2feb47d6b3", "value": 11482112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675047, "uuid": "e67f8c97-4f49-4974-ac63-24603b349d5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eca1fda-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (PureCrypter)", "timestamp": 1745675049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675049, "uuid": "e1681562-a30c-4da6-b578-dd599ba1b606", "comment": "Malware payload (PureCrypter)", "value": "2e1da3b03de67089bb9b8ffdf7e1c7a9", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675049, "uuid": "afd91234-ef52-41ac-a605-7f10d7d4a1a9", "comment": "Malware payload (PureCrypter)", "value": "0b7846217c55d059c76ae8dfa0aec50305daef334b2bb72b63b64d76412bcae2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675049, "uuid": "7ddcba5a-7dd1-49a8-8214-fe600f53957f", "value": "T1DA45231A839EFD0BD97999FAE8F213588271D13F1163D71B4E90A34936EB701CA250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675049, "uuid": "066773e3-b022-4f4f-afd4-e488befc3e01", "value": "24576:tpylhoJAaaXVdk1HcsIh8UzlbL46NB2eY5YQKhBG6PUKoSQ6max9SrEN8STSq:TShoSaOVdMtIyUzR0aBBY5YQKhBJP8xI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675049, "uuid": "889e314f-1602-41cd-9cfd-275c9465f95a", "value": 1253376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675049, "uuid": "ef0701c4-a934-45cb-8e0c-6d9e812cab29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c813efb7-4acc-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675049, "uuid": "3c821291-70c4-4cc9-89bb-6d503ec67746", "comment": "Malware payload", "value": "fcd623c9b95c16f581efb05c9a87affb", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675049, "uuid": "9689b5bb-fc0a-47eb-abf5-e73ffd698939", "comment": "Malware payload", "value": "3eb7b830379458b4788162b6444f8b8c5b37a3190d86d8e00a6e762093e1f2b9", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675049, "uuid": "771f5e7e-d9f6-48af-b990-0c1e887c4b59", "value": "T169E4021174C08073D5332A3209E0D7B966BDFD714EA65E9F67940BBE4F20682E731B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675049, "uuid": "7923faf5-5ca5-4040-8a7a-454eb55d8820", "value": "6addd02d82538c2ca23958c8c292883b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675049, "uuid": "754b642d-458c-406a-a70a-428f604a59ef", "value": "12288:wV2oMpiojk1ruHufjr5tIaZ7+Prk8HbEFQRsfNjaxxmmU1E4NyKVQ:wpsioQ1murr5WaZ7SQ8HbTspoxS1NcKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675049, "uuid": "c4b9a1b4-4994-44f4-bba2-d531707d3d71", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675049, "uuid": "8458e51a-17d1-45cd-806a-bde4872844fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497b4b8f-642f-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745675050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675050, "uuid": "9794532c-6f75-4ccd-a8a0-f0d57f306eb4", "comment": "Malware payload (CryptBot)", "value": "703bea610f53655fa0014b93f0fa4b7e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675050, "uuid": "3e5632a6-0a7a-47df-be13-0f52a7f4d460", "comment": "Malware payload (CryptBot)", "value": "1dac4bd2e15c7e98e3e8c657e9f6463f6d4f7d6a1256a3270649bfa5154c9e73", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675050, "uuid": "00c6e896-98bd-4140-aead-15854291494f", "value": "T1AC66287A9A4341C8C13FA67ADC927F7FF4286AD843D9492BAC0508FCA755351E8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675050, "uuid": "785d7d98-5b0e-48e6-9429-85f799b1e67c", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675050, "uuid": "8c42910c-ca37-40cc-9442-5e4410468c47", "value": "98304:FQAe5kuZp6Qrb0iF0MdenCghMYAvFrUtK:FQAe2uL0DCghMjvFwtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675050, "uuid": "f8e581f3-b949-443b-ace8-6f3c5a569f3a", "value": 6623144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675050, "uuid": "85feba50-9fa0-48cb-9604-da70251bb7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b3c41e-3b0a-11ef-b2b7-82aee05be84a", "comment": "Malware payload (StinkStealer)", "timestamp": 1745675052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675052, "uuid": "afc30838-7cfb-4c43-aa87-408aaab1b1ce", "comment": "Malware payload (StinkStealer)", "value": "e38edd674f3dd8b7c0a679d40702282c", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675052, "uuid": "d67706a5-5a49-49cb-bcfe-ff6e020ba2b3", "comment": "Malware payload (StinkStealer)", "value": "67a549acc82bb89265859ebfa67fab003eb43884f847e754bc0a8ca631ca3c1c", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675052, "uuid": "c4982c17-960d-4a1f-8ea4-98110fcdd18c", "value": "T11A763362D9434098CB8FA9F86BD1A991F87CBC5C1A25E0FB07E0A2F02B579D5CB513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675052, "uuid": "b84777b8-b944-4fee-8bfc-f91877d99662", "value": "a7b0793ae6dd3f16ef244d19e4de0c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675052, "uuid": "b1d89e7e-3c31-4d06-b701-e084f6ea6fea", "value": "196608:LEsau8NahQEllmKU2Q+4LLZCNTJ30nVC:QsT8NahzlmKUV/LbnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675052, "uuid": "4af9b2c6-6a43-4104-aab0-e556570e667b", "value": 7418880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675052, "uuid": "b908d0f3-631a-4883-b884-912e03e33751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41821eed-5bdf-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745675053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675053, "uuid": "e43bf23c-20d6-4cc5-acb5-ccb8e191f21d", "comment": "Malware payload (RedLineStealer)", "value": "bbe6311c3e2fab459f729dc8cd6e3519", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675053, "uuid": "fae13f50-4ba1-4d26-83a1-15da2d16031a", "comment": "Malware payload (RedLineStealer)", "value": "95fb9ca82017f2a6bc59df0d72fc6f90043e135799d25e9922d4943da4c36874", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "ebce7e9b-fee6-4e99-96c3-72e42b62f357", "value": "T1F23533C72E7C654AFAD9C97614A16D0BFB32CC7051B6A30FF79940253858709A30EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "e09509c8-ab67-48ba-ae78-ae99c1ff1fcb", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "a3a35fb4-94ad-4e6e-9ae8-5dec2fa23ada", "value": "24576:HzZyi0Kg1ySDKr8TP/4xDVMRy5MxcTCLA8dUtp+FPlDha1edx/M2:H0iTezbe9jp+FPlEoHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675053, "uuid": "e4a61ceb-bc38-4160-9263-53119d7afe70", "value": 1119801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "a685022a-ee2b-45ea-8692-9a369993a9c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7287543-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload (DCRat)", "timestamp": 1745675053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675053, "uuid": "667dc8be-3743-473a-a0a2-61639a36b31f", "comment": "Malware payload (DCRat)", "value": "1bfbd30885f39ec391d870075f5981ba", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675053, "uuid": "7bc556af-1f75-42ab-aad6-0a3645d17dbb", "comment": "Malware payload (DCRat)", "value": "c0d7ecfc651f90642687a199e5b94ce4723e380a4f592ff9e59cd01d52f06473", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "7a79a1c6-bff4-4501-ae29-7f886aef6c78", "value": "T12295AF13B5A24E73C2643F3594D7001F52B1DA227A52EF4F371F59A1AC0A236AF126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "4b7c59a3-4b00-4199-ba25-bdab7cb32790", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "53df7856-3abc-4d7f-9024-490b5233c890", "value": "24576:2TbBv5rUyXVoQCD41fPrBT5IItfHot5spoKD3tXLyEn02OAjorvpU+EuTm3z:IBJoC/t/q5axyJwjP+EuTmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675053, "uuid": "cd58e0bd-b3d1-4102-af60-4d02f1bb16ec", "value": 1972036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "109cf8d6-8f1b-41cf-92fd-61b69ac6a6d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f456b55b-562b-11ef-ac1d-82aee05be84a", "comment": "Malware payload (DarkTortilla)", "timestamp": 1745675053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675053, "uuid": "f8444275-c7ae-46d2-b737-b45fce5e6d43", "comment": "Malware payload (DarkTortilla)", "value": "f5b93d3369d1ae23d6e150e75d2b6a80", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#98530E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675053, "uuid": "c57444ba-f6fb-4db6-97da-5a411efd9bcb", "comment": "Malware payload (DarkTortilla)", "value": "343ea56746b6f08c7eccbfbb9fe1a544952a9a933140c677179f4f8c7bb60b81", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DarkTortilla", "colour": "#98530E", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "a9da7edf-20fb-496c-974e-894777728e1b", "value": "T19C25120FADCB40F6C18B8B36C7B0159887B563B73171B3B646C822E09D726EF554A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "b23e7cc6-248c-4034-ad2b-f91cd47c81b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "cfcefcc7-5536-490c-b2ee-159b6dcd6d93", "value": "12288:pX8RkdnkRZOwECM98hfcunLIYCx28xur5GbYkpMalQBEnxSSraaoKZ2A:SRPRAqM98qCRCxnx7YpauBML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675053, "uuid": "8e8a0986-a135-4b8e-ad6b-de91f668b7f5", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675053, "uuid": "4e0f14bf-e22c-4063-9f2a-d31a005cc590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003de7b8-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload (SystemBC)", "timestamp": 1745675054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675054, "uuid": "e49fc670-4eac-4808-b0f5-c307321ceef3", "comment": "Malware payload (SystemBC)", "value": "6da3ec62800b295f92d268c84f121259", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675054, "uuid": "ef04d13b-9441-4adf-9470-bf52f21415fe", "comment": "Malware payload (SystemBC)", "value": "46e0bbdbdffa58d201e3aa377f77d4f85a7704a60042eaf13d5cedf70808e937", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675054, "uuid": "db84b38d-83a0-4a3d-a490-e1ae521be93e", "value": "T1CA15235AC360640FD4C85D3EA8FDBB016F24EEE6E686EB2F8EC435645A4F60119424", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675054, "uuid": "46c5ace7-4555-4068-850a-611753716455", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675054, "uuid": "4c3fc0dd-6262-4bec-b376-75b1c6db83e4", "value": "24576:kCNgmMtTCrukMSZvRWDrlU/1TP477WS8Cy1IZVKU1WALQ2k:ymMBCrhMSpRW6tTl5mZ0jALQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675054, "uuid": "c5610ac5-c0d5-4f75-85fd-b3f041103e93", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675054, "uuid": "2dca6158-35d5-4c05-a9f7-bd4d07f3d974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48113741-7a8f-11ef-afe5-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745675054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675054, "uuid": "11b62815-55ff-41e6-89ae-ddfb1d16ff93", "comment": "Malware payload (CryptBot)", "value": "65eeea19b373583f916bf3070acbfd58", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "encrypted", "colour": "#726a10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#ff0948", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675054, "uuid": "c0832680-e6dd-4b2d-9ef5-8e3fba00e677", "comment": "Malware payload (CryptBot)", "value": "c671e33f6757cef930713d2e4efeb8642177675e95fc05de92e124213022a00b", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "encrypted", "colour": "#726a10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#ff0948", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675054, "uuid": "8395e5db-c349-481e-8a2f-a5085b1bd464", "value": "T13C66F63B9B4345C8C13FA57ADC927E3FF4286AD843A9491BAD0508FCA755391E8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675054, "uuid": "345bfb00-1e26-4c88-ba99-73ca20bea46e", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675054, "uuid": "2a6b4106-16c8-43e5-a01a-75e1a65840bc", "value": "49152:Us61pW8W3itNrOiSylbFBJjDVJ0g5CDBGKZf6Zoz1E/2RU87BDarlLfj4F8Gw:y7W6ZBJjDVug5CDBGK0ozJKfUFRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675054, "uuid": "dec8a427-a851-458b-8215-a3ee78bab414", "value": 6643916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675054, "uuid": "9c5f7f10-60c0-4f88-a7e2-29e6b4f9e534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5d84d1-5bce-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745675057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675057, "uuid": "6de1a7f2-51a3-467e-825b-4652b85d1c2d", "comment": "Malware payload (RedLineStealer)", "value": "b7df5fdcfdc3f46b0b4f28c1ffb82937", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "jpg", "colour": "#89f234", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675057, "uuid": "2fa3f0f4-a2e5-4b54-ac94-00d6eef30546", "comment": "Malware payload (RedLineStealer)", "value": "7636d2367079eabd9da2bb40935df3da580affc47473fd93ed3b2e01ee6c46e5", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "jpg", "colour": "#89f234", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675057, "uuid": "ad948f3a-7a23-42a8-aedf-1e498ec6f70f", "value": "T1AA96F1E6A6471C13DE420FB885358E7958EFEC68B87504AD231AB418AF377C158672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675057, "uuid": "da0a9250-002a-405f-bc4e-af746740e233", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675057, "uuid": "99ed4a10-1eef-4fb2-9355-b443aadb4d73", "value": "196608:tAUdsL+AUdsLmAUdsLmAUdsLmAUdsLmAUdsL:tPq+PqmPqmPqmPqmPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675057, "uuid": "2c41c47c-c697-474b-8735-936da84f5069", "value": 8729379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675057, "uuid": "59d215ff-516e-4f4c-93b8-e083f08c321f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f97ea95-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675060, "uuid": "0b8fbb1a-1994-4eff-9658-2f6bb38884c9", "comment": "Malware payload", "value": "19fce7cfdad7e67cd8b36d39bf80f648", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675060, "uuid": "fd7dca74-96b4-411a-9aa2-c7f8876e8278", "comment": "Malware payload", "value": "627738fdefc4ea61846d05ffd2ad413263d894a30bc7730fafdb595cf87358d8", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675060, "uuid": "689c9393-3ee5-4672-9b68-ec5209388751", "value": "T153A54A4BBCA544F5C4AAD23289625192BA71BC440F3263C72F90B7792FB3FD49A797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675060, "uuid": "170f533e-eff0-4017-9edc-20a2022b2605", "value": "07361a3a7f515bf56ca93120b2aca73b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675060, "uuid": "061bd577-f0b8-4dbc-aa90-daab812c31cb", "value": "24576:PRGhn4AnznKuDGaC/oVWKhXNdQ3gjh6TNfl23pO67RUr2r:EhnLKuDGaCAVWKh9d4gjhsa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675060, "uuid": "c3507f05-306d-4bc2-ab81-161cc0299760", "value": 2222080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675060, "uuid": "bfecf68c-01ee-4de1-983c-52125952ebe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1507d1-799d-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675060, "uuid": "7911ba8e-1ed5-4181-bb1f-e6da805d99cd", "comment": "Malware payload", "value": "870feaab725b148208dd12ffabe33f9d", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675060, "uuid": "93f5d570-f2a8-4fa2-a4b3-04bbaaff11ee", "comment": "Malware payload", "value": "bbf7154f14d736f0c8491fb9fb44d2f179cdb02d34ab54c04466fa0702ea7d55", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675060, "uuid": "ed66f9ce-0ef1-462f-bfca-02c9318de824", "value": "T104D56D207A86C63BEA630570993D9AAF904C6E581FB485C7D3C81EBF59B81D316339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675060, "uuid": "0efe8457-036f-4d48-892b-3fd6f4e25f6e", "value": "e30b6006fb6f4fe4fb6e0a3e6913226a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675060, "uuid": "533a435b-3176-4e08-b76c-56dd65f8edc9", "value": "49152:C11fbWXfBeBqTww8Gkfoa0yeL8zj9JLF+lP/MatsfHVnZbhG3EVsMI62Pseaj/1n:QbWkuwwjkULhlPUatsfBxhsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675060, "uuid": "d5844366-d39c-4192-aa01-540c32aa4aaa", "value": 2837504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675060, "uuid": "5e1837b3-b314-43bb-9081-6bb4aa657336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40b9d35-62da-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675061, "uuid": "c5f5d6cf-e01a-41e9-8967-4eaed9b6946d", "comment": "Malware payload", "value": "4e18e7b1280ebf97a945e68cda93ce33", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675061, "uuid": "9889f45f-6001-4c7b-a45a-cabd84d51bab", "comment": "Malware payload", "value": "30b84843ed02b74dfd6c280aa14001a724490379e9e9e32f5f61a86f8e24976d", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675061, "uuid": "ec78ec8a-0f55-41b1-b3b4-7376bd5b114a", "value": "T10B956A2B55A961DAE3E7C07CE51A4792FC3132494E35A7BB24B68392333091C9B6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675061, "uuid": "dd8bddd0-74c9-4b3b-b0e9-9f12d59c0246", "value": "7ef8d58ff9037925d777e78c004fde83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675061, "uuid": "b4ab271d-d55a-4270-88ba-eab91f8cb683", "value": "49152:8i1FLAGEVvj+rY5gisiOrG5Xa+y0qdrANNf5eKX:tMhqWBIQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675061, "uuid": "04a0656b-f9bb-4508-8b8c-604334800210", "value": 2052608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675061, "uuid": "5d6c51bd-c2ed-4258-a408-a0c08d85156f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817ebbfb-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload (VenomRAT)", "timestamp": 1745675061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675061, "uuid": "3ef48d4a-51d6-434f-bb15-f1af59bd5e4c", "comment": "Malware payload (VenomRAT)", "value": "0dac2872a9c5b21289499db3dcd2f18d", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#31D98A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675061, "uuid": "17c72241-6b8a-4640-8e4a-ab0feda06ce7", "comment": "Malware payload (VenomRAT)", "value": "bbfda112b2d2742ec593b14cf9a0d2558cedaa24ae89d0cc9b5c94b94705c772", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#31D98A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675061, "uuid": "975c7a88-1dc8-4d02-a3c8-74821d8b8436", "value": "T1B68512E6F7A4CC7AF4A70E32AD3985A25E776C4564F0826E150CB74A297230244FDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675061, "uuid": "24fa86b3-324d-4b41-ae2b-24978aec8b36", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675061, "uuid": "35bd91a2-006d-48d4-bc3b-f64cf6ea28ed", "value": "49152:EzQfCT0ay5jIRZRQ+uGZU9zQfCT0ay5jIRZRQ+uGZURH9:ZNlIm2U6NlIm2URH9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675061, "uuid": "d4d738ed-7944-4bb4-90b0-ad74e9d101ef", "value": 1762283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675061, "uuid": "983bf38a-aed2-4a56-9137-713309ded30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a676fb0-62e5-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675063, "uuid": "1716e3cc-bdf1-414b-a8df-a30e4a652c0e", "comment": "Malware payload", "value": "c7cd553e6da67a35d029070a475da837", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675063, "uuid": "20fc1f43-7605-46ee-8650-097fa8f2b978", "comment": "Malware payload", "value": "d123bd0ec22d7ba6449474a717613b2186d812295965044ac432983df364aa91", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675063, "uuid": "03d0ea8f-964e-4410-b6b3-54f9459de244", "value": "T11F867D7B72B59269C25EC13FC5A38F02E433B4791B37C6E7929002595F129C4AE3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675063, "uuid": "67336a50-633f-433d-9e38-711d4314b01b", "value": "73c7e572536ce3b598c7740cf9a09ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675063, "uuid": "02c878b1-3ac2-4292-b314-102f7cffbba0", "value": "98304:PNtfmToeoe9SWeOynYe18OVHm6pmjyD+:FJmToeowYnYM8WumD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675063, "uuid": "52bba618-5de9-4544-85f6-d75cd6a90eaf", "value": 8439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675063, "uuid": "980f2f09-99a6-451b-b1df-8436d2129187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807c3956-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675066, "uuid": "8c48a9cf-eff3-4af4-87be-ae84a5a8b3bf", "comment": "Malware payload", "value": "4e87a872b6a964e93f3250b027fe7452", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675066, "uuid": "3187f9a6-73d6-40d4-8dd9-1b44174da9a3", "comment": "Malware payload", "value": "92d45c19afa0670b233d9b594c617194957bd0cf43e05ee28eb041c4e04ee687", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675066, "uuid": "64aa1ca6-8790-4ec3-8db2-2b56f80ebd4a", "value": "T15574DF5175C0C0B2D56329330DE4E7B96A7EF8700E61DA9F6B940FAE8F702829621A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675066, "uuid": "c752d5f4-365d-4cd8-8c8c-2002cf5ee9da", "value": "95d4113c25a148a48f2688574ed71076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675066, "uuid": "865fe83c-e4a4-4121-92df-87b62353e6f7", "value": "6144:Jd1W+Wsj4spbNWAP6xvh5cw26aj1bSp4MFbdeGa0tFYXgGBIX:ptnjdpbpa21jyvRAg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675066, "uuid": "1f4a5e43-b0a6-438d-bbce-03a17cf47339", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675066, "uuid": "8d2d8d6b-e676-4941-97e2-0d2469f14136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1047717f-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675066, "uuid": "febbfff6-a989-4891-bf52-7e6758e7a2df", "comment": "Malware payload", "value": "d07b3c00866cb1bba2cf2007161f84af", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675066, "uuid": "45f836cc-39d2-45e5-9b5c-822a09807c81", "comment": "Malware payload", "value": "d2662051702168049d751c1b90cfef9f1e34a04a6c7689db3c79a2547a7339ba", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675066, "uuid": "8f3d0695-3e1c-4e27-a3ba-8c6e57688f2d", "value": "T1EFC5C74369DB0DEADED667B861C35335A774BD31CB291F2AAA08C2316D536C4BD1EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675066, "uuid": "c5a824b3-5af2-480d-8159-be22a3f00f02", "value": "c2077e2c272c2d2cc09afd22034ff225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675066, "uuid": "0ee9bffc-66b7-4bef-9d21-0534c198f186", "value": "24576:eyx9LE+CI7ev4BWPYmOH4RKf4343ryZf4+Ec0xMki8UsU3AofxMXqE7V6IK:xx9LEXI7ev4Blmr43+ZfJxMXqE7V6IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675066, "uuid": "682456a7-2de7-4904-ae0b-5b211e40eb2e", "value": 2644317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675066, "uuid": "5225ee79-7d15-452f-8f23-d27eb18d51b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d277cd4d-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload (DanaBot)", "timestamp": 1745675068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675068, "uuid": "411f9148-9a3f-4c44-855f-ec6cab38ea7c", "comment": "Malware payload (DanaBot)", "value": "dc47a53a96f4b75313c9d8bc328d3dcb", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#860d30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675068, "uuid": "5aebc8e0-97dc-4a5d-ae7c-c456fc4002d3", "comment": "Malware payload (DanaBot)", "value": "1c0fcfa073bc2382b9736c02eb2fd7ba2344e59e76c485c531bb9259caf4138d", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#860d30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675068, "uuid": "15602a16-7da9-4bb7-9791-13a12c49dffc", "value": "T1E74623D6FAC204D1E85A06788D16FD3F32353DBA9E61AD073099BA4FDC73292A4365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675068, "uuid": "aa0c9f5a-4698-4d68-86c5-8bd4b87eda1f", "value": "2784ac08a9514473ae6de58d805cc1d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675068, "uuid": "e2c9fba2-f8e1-4264-b351-8e158ba17508", "value": "98304:bskRpCZRb3XkCBnGwJkdI9esA1VfrPJ68D/ZiUzcWdQqh4WziuS4Rs5e5xZfOKWv:bsJJ30CMBsAHr8KxPz4Zr4RT5xA1JPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675068, "uuid": "da62ae2a-c6db-4ad9-aa96-152432132727", "value": 5425152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675068, "uuid": "7c98ec98-b023-4cd1-b83d-7be09eca765e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3bbe5a-5be1-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745675068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675068, "uuid": "f2965000-2786-4de3-89f1-15b3711861eb", "comment": "Malware payload (CryptBot)", "value": "a107fbd4b2549ebb3babb91cd462cec8", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675068, "uuid": "984bf3f3-3461-4c99-892a-7b72e322c3b2", "comment": "Malware payload (CryptBot)", "value": "5a9b441d59e7ac7e3bdc74a11ed13150aecbf061b3e6611e2e10d11cd232c5d2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675068, "uuid": "46d28817-16d4-4d5b-b8ee-93648eec5440", "value": "T17F220800E3D48232CAB942722CB39786C737F79B18468EEE74DC511F7F2698587A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675068, "uuid": "82eee66f-5cb4-4f28-a094-107e49bbf4b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675068, "uuid": "16bb8f3f-84fe-4e27-939d-1df36d688fe3", "value": "192:Bxb+zdkacI2v0Hn7bEbIn+qeDIcugX8PAJ8stYcFwVc03KY:Xb++oH7bEbIn+0gX8YJptYcFwVc03K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675068, "uuid": "6b590cbf-0344-4ac7-b238-ffd6ee308d84", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675068, "uuid": "6266eb41-e150-46a9-908d-26e3988fea9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c5aa52-8e52-11ef-afe5-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745675069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675069, "uuid": "6919eb25-3571-4dc5-b568-5a4787134327", "comment": "Malware payload (Stealc)", "value": "dc860de2a24ea3e15c496582af59b9cb", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675069, "uuid": "a3994d70-d974-49fe-84a8-1f16b0104487", "comment": "Malware payload (Stealc)", "value": "9211154f8bd85ce85c52cfe91538e6ba2a25704b6efb84c64460ba4da20fa1a9", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675069, "uuid": "ea5a1591-34e4-4400-8873-9fc645dda552", "value": "T10B84DF91B1C0C431D97715320DF0EAB19E3DF9714EB29EDF77A80B6E4F302819625A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675069, "uuid": "899803a6-be3c-42b6-a377-4a3ddbd0dcea", "value": "f6d69f179a8bc849dc9fddc23fefb0bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675069, "uuid": "4c22b321-a5d7-4d16-af10-14c04916f7fc", "value": "6144:iUwFzqlqyEURK9rod9/or4txXZ1l4PyT6qdgNkwhjfdnw/omUS29zf7PT:zwFzqsynqM/M4tLw6DgNkQjfdwAZDPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675069, "uuid": "d4ee918b-27ab-48b0-82a4-b3f665c69b49", "value": 372088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675069, "uuid": "6fa9955e-ab5c-4ca2-8023-102e7099237c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944fbdfd-86fb-11ef-afe5-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745675072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675072, "uuid": "1bbfdf60-b786-4f98-9263-b1e6f6590b4f", "comment": "Malware payload (Stealc)", "value": "68a99cf42959dc6406af26e91d39f523", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675072, "uuid": "625b3bb5-cfac-4f35-b0f3-22716d3f0fbb", "comment": "Malware payload (Stealc)", "value": "c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675072, "uuid": "807efac8-e4ca-4f8a-8e83-1e3c18194362", "value": "T1FD646D32F65018BDE463417D95EE5F29DB6A78320310CEDB53D00A851FE22F5AD39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675072, "uuid": "947671c4-e75c-4c7b-bb2d-a54d8362748e", "value": "8e9e6de8c6aa184371108e1074479bb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675072, "uuid": "9be984f7-ec3d-4fe9-804e-7da29a42c62f", "value": "6144:k0wBiMDYtUokCulxMfpbjnekAoQGZRFsnE7w+Uw3NKR9hU/W9:RwMtUoH35nLP7Fa4wx8KRF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675072, "uuid": "60b3e5cd-3a4b-407c-afef-f99c82998000", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675072, "uuid": "1d3cc0cb-a872-4edd-8833-b3e6aa940c08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b15817-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745675073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675073, "uuid": "a274aecf-5285-460f-994d-d575cd88bebb", "comment": "Malware payload (Stealc)", "value": "7b0a50d5495209fa15500df08a56428f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675073, "uuid": "78804c98-98d2-4549-a746-fa9b9e2bcd12", "comment": "Malware payload (Stealc)", "value": "d7f591f60eea358649cd97b73296b31a682e22fc5784df440026c3086de3d835", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "8c652f2d-0393-4189-8bfb-9a3e5261dea2", "value": "T14694E12174C2C4B2D52329330DA4D7799B7EF9704AA19E8B7B940F7EDF30181E721A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "e2421d20-60eb-44c8-89db-05bdd01ed74d", "value": "95d4113c25a148a48f2688574ed71076", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "fe1271af-1b33-40f6-b32d-655606e29f2a", "value": "12288:uXUNyeOg3fUJlIWBdKmkUNsoFjbMd+g4Gq:uXUUeZsICQm51jbMdxlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675073, "uuid": "adeb2ec5-243a-4faf-9f34-0efc10f1bdeb", "value": 422912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "78c88124-51a3-4cdf-89c9-501cbd9548e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02576c66-7370-11ef-afe5-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745675073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675073, "uuid": "ef0ed4b4-bacc-4200-b117-03d6d68f3219", "comment": "Malware payload (Stealc)", "value": "7fa5c660d124162c405984d14042506f", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675073, "uuid": "778525d5-84ca-4def-a075-46719197ba14", "comment": "Malware payload (Stealc)", "value": "fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "80fc15c5-5317-49c0-8aba-8c24110037f1", "value": "T1F116E013A75C7E32D5F2E637CCF7373F8B2CA84038A46A236EA874742565B44E6253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "059e662c-b584-456c-8883-63a7851ac2c0", "value": "09461e896df904e3166547e3aded33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "ce69ba27-4f3e-43ce-8a89-d22428d32856", "value": "98304:if7X0ZueTTPs6deIF+iHtcbBt2VSFjUCaZ:8bPeVdeIMiHmbeVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675073, "uuid": "1d41a880-765f-4369-a858-deb1098efbe4", "value": 4278784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "fb79448b-9563-42e8-96e6-e8d190b71aa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcbc2d5-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745675073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675073, "uuid": "4b11ac9b-d4e4-4ce3-ab4a-d97a5148d14d", "comment": "Malware payload (RedLineStealer)", "value": "b5f31f1c9a5f7ed6445e934c0519e4ba", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675073, "uuid": "af60f92d-4b15-4e7f-8fad-40c50329ea19", "comment": "Malware payload (RedLineStealer)", "value": "b01f683b4f33b05ac3421d8d31fe59d2196660ec611ba089d0f6392065c25bcb", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "7d6f574b-0e5b-4715-8b71-d350c15f21dd", "value": "T1DFC49D81B359AD12DA6B06F6900518A01E71FF79E90BC71AAEC77FBF7EB232151118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "d04fe956-b42a-4cd0-a2ba-c2e2f3fd108c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "f03bd9a3-80d9-43dc-a722-e0ce777244c3", "value": "6144:YYqdc0NkzDVOBV6TIlA41F1cN3p0NIb88WsNMPaKFP3b2V122J0sL:Y9J8QbzPcN3CNIb88WsNMP5F1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675073, "uuid": "9bf3985c-405b-44fe-9957-2bb5f341cfe1", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675073, "uuid": "a873c27a-7bc6-48d8-971a-a112688c8816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db21c41-61de-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675074, "uuid": "a81814a2-c68c-4010-a898-fa042bf8ebb2", "comment": "Malware payload", "value": "4dff7e34dcd2f430bf816ec4b25a9dbc", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675074, "uuid": "cc7800bc-cf72-4752-88af-db5bf18818af", "comment": "Malware payload", "value": "6ce52f1764a1ea1e39d4484e39e3d4f494c6b29faf8f676b684f7428cf9fa33a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "dropped-by-PrivateLoader", "colour": "#769880", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675074, "uuid": "11343377-a14b-4f0f-94ef-e1a3d0374e4a", "value": "T108B67CBBB3E08268C16EC53AC0A78F05D933B1760B37C2E7129006599F669E55D3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675074, "uuid": "95b39494-cdb0-4097-817e-60824abf9704", "value": "566b19b5ac294f4a1afe5e76da03206c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675074, "uuid": "4655c8ac-c32b-47c6-b78d-c33f300eeae4", "value": "98304:ok8Moeo9VZ4odf8an8U/J1vD3NSPUv3KWQSy+Bk:d8Moeo9VZLf80vRlfKkhBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675074, "uuid": "6a990210-3089-42e3-9092-26a983923bab", "value": 10589696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675074, "uuid": "4ac2c770-0106-46f5-8a02-d9348463c9af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81971d5f-5723-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675074, "uuid": "ad294249-f067-4724-aaa0-16cfb659b8c1", "comment": "Malware payload", "value": "e3dcc770ca9c865a719c2b1f1c5b174e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675074, "uuid": "f3c8b97c-f805-4c50-943f-c177eea46447", "comment": "Malware payload", "value": "7a41fa61102269baa65f7f762cf868c3c6a506fb58b590b6ae1352b864f2831e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675074, "uuid": "a9485a57-ea33-4881-99c3-9c3f7bbe6271", "value": "T1B7154AC2134CFA81F73F5BB19154F8E583ABE9E688A1D64945C4A2DA37737807DE18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675074, "uuid": "09369c4b-8fb4-4a2c-a0f2-60212d45c97e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675074, "uuid": "9ab2ee99-71db-4a6d-b890-33c7979b726e", "value": "12288:bvsKwGRdLBBNNBqiLckdXZj8YNQDcodji13ywe4GOMvS5JfAu8G:bvs78RRNBqin7oYNCcoe3h9MeJ78G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675074, "uuid": "462b5a4a-ed80-490f-add8-33a1e2a8d8f0", "value": 928104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675074, "uuid": "b779ffba-607a-413b-bb29-05aadb584fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c504725-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745675075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675075, "uuid": "1692dd55-aec5-420b-9888-5e7eaf24252d", "comment": "Malware payload (RedLineStealer)", "value": "d417175785147e64361541f2978629df", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675075, "uuid": "9d1acad1-2809-4504-abcf-77f98ca75a88", "comment": "Malware payload (RedLineStealer)", "value": "525207b0d7f9df796999b8e184b3a1a2c285ae37e61a29eab0573898b3368e17", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675075, "uuid": "99389e91-95c7-4c22-848b-c3bc2182098b", "value": "T1166502A38E532C65FEAD003678DE85380B7D3E5F87115986D0F7AE326BD6D830B069", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675075, "uuid": "f8640c67-d7d3-4dd5-b93a-ffbf740a1a24", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675075, "uuid": "f01c4cd4-68d0-4394-ba46-ed0f168dc1a0", "value": "24576:DzZQUIJpz8YyUJK7KSXoOytlw1XOwwjB6X43jcHoExNz3WOWIWI:Dkz8YTJC4/ZwwjBW4zGNzmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675075, "uuid": "72c02bfb-cfe2-482b-8806-ef02e405ce03", "value": 1533044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675075, "uuid": "5e7f44e6-240c-49a7-b936-416ab2f1e8e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3032112-8e54-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675077, "uuid": "2aac53f8-9dfb-426a-a30d-57272ac1933a", "comment": "Malware payload", "value": "612bb24335958c4ae6e93dc6d038fc4e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675077, "uuid": "d83cfb7c-ce17-48b1-821a-b09e234b7a6e", "comment": "Malware payload", "value": "50442db395e89ad803b6f001aafd164dd1d275c51d0747ed724b358dc96e0787", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "f0b4587e-778b-41a5-a389-5fabeb502761", "value": "T13B26234EE7A804F8E1F3E574D9574942F7B67C4D03714A8F235A06AA2F273A0DE2A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "d861fc5f-dc7c-4596-bdcd-db16d1f16c3c", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "90455bc4-bc72-4fb6-b17d-02a861b6d3aa", "value": "98304:rqwgEpw6cLMSSvz5HhBYIn7UD2drBHYSpJBK56CIEn:rqwZ/cLMSSvzJYIUD2drV+5xT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675077, "uuid": "771f6acc-f4dc-48fc-aedd-d5282ea517db", "value": 4426442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "fb739d68-0e9e-4130-a80b-255db98858e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f3301f-60be-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745675077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675077, "uuid": "3fc5affe-af1b-4143-9e4c-0031b612eed0", "comment": "Malware payload (CryptBot)", "value": "5f5eb3caf593e33ff2fd4b82db11084a", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675077, "uuid": "4a5b27ae-6907-4e56-b006-b85f3c86a416", "comment": "Malware payload (CryptBot)", "value": "29036a1125ac5f5b8a4bfb794fa965efd1f5e24853db3fa901b17d96ba901ca8", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "64502975-687f-4176-979d-7f8266eec819", "value": "T1AD66063A9B4345C9C13FA57ADC827F3FF4186AEC4369892BAC0508BCA755751E8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "0d961482-2c9f-40ea-8eab-15c9abac2a64", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "20f10cee-5d4d-4e86-a3f7-f21d552b9eb8", "value": "196608:h/5aE/yir6wt+yVZjinfFQoff+lhfskwlpG6TRj3Nv2vnY1bPMbdKBVQ:J5aE/rr6wt+yVZjinfGofmlhfs1lpGMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675077, "uuid": "09dea79b-6cca-478f-bfe6-4146f4eabcfa", "value": 6642843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "b5a16bb7-9f16-4fcb-98ce-2ddae2d8c1f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a580af-57ef-11ef-ac1d-82aee05be84a", "comment": "Malware payload (Stealc)", "timestamp": 1745675077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675077, "uuid": "d3c9d006-6fd4-49a7-ba63-37c7b9750188", "comment": "Malware payload (Stealc)", "value": "abb5797dd47bf453358359acf2453551", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675077, "uuid": "67335e32-b968-4a23-be24-c9a433333756", "comment": "Malware payload (Stealc)", "value": "f7bbd59299cad16b2cb4916738ad1475f61e129763cae617f1f9184f20db1d99", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "bff273e7-2c45-44b9-83b5-726cd5d8ba37", "value": "T13F566E42A877E002CCCBD97691F59801F2589D6B6DD5712E29E07A2AFDB03724E538", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "ddfad861-36e9-4a30-b6f9-1cecc75298e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "b5889db0-8561-425e-9468-340719b09d62", "value": "98304:NBnTaRw5XvCTQsvyuC7qlML4ZRediPxWaNdW/FaJh:NBTaRbTBvyHqlML4adWh2/FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675077, "uuid": "fa894ab2-58ca-4204-b716-cf4d254c7c7c", "value": 6072320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "194b93ca-3548-42f6-8403-d85f09f1338e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6d5fed-571f-11ef-ac1d-82aee05be84a", "comment": "Malware payload (SystemBC)", "timestamp": 1745675077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675077, "uuid": "7fef692a-b2e9-44ec-b942-00ee2217a8d1", "comment": "Malware payload (SystemBC)", "value": "cee58644e824d57927fe73be837b1418", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675077, "uuid": "3f67420b-37da-4f15-b24d-5ccfa7a27cbf", "comment": "Malware payload (SystemBC)", "value": "4235c78ffaf12c4e584666da54cfc5dc56412235f5a2d313dcac07d1314dd52e", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "0fa6ff08-ab59-4e94-8ec3-c33a63bdaa61", "value": "T1FA1523923B5F2632C0195C7E64E9F61793F4F6B2AA2EE7535091222CC10F3D399236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "5f60decd-55c1-45fb-a25b-5e176d435ded", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "61c8fa9e-d888-4cb1-8248-9374a2f152ae", "value": "12288:etFDEnlFaqLcsjwwdbriOXrWh+7SmCHK4A04KJeYtS1dFXuehyFJ97wQjGuNafNJ:6q9ctmHiCpd4FJe0oeehyjPiuNv/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675077, "uuid": "76eaa373-9af5-4ba0-afab-a32f86f892aa", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675077, "uuid": "7ee33f65-d793-494c-87dd-a6827dad955e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cf96562-5f20-11ef-ac1d-82aee05be84a", "comment": "Malware payload (RedLineStealer)", "timestamp": 1745675079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675079, "uuid": "781455e1-664f-4b70-94da-208f86936465", "comment": "Malware payload (RedLineStealer)", "value": "3aace51d76b16a60e94636150bd1137e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675079, "uuid": "a0c08171-cd5d-4acd-b5a3-063f4f267a61", "comment": "Malware payload (RedLineStealer)", "value": "b51004463e8cdfe74c593f1d3e883ff20d53ad6081de7bf46bb3837b86975955", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675079, "uuid": "8611f3d9-8265-4959-9d00-2d2209059f4b", "value": "T1AAD5D015D3E802A5E47BD630CA699733C3B1B85A2734D68B0659D6862FB3ED14B3F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675079, "uuid": "9537756a-1eb3-4c89-8be2-5be8fb6907fe", "value": "9e02808def02e999c496dcaa4fcfd6ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675079, "uuid": "f7d7a303-c792-4fa8-89a7-fba820180ed3", "value": "49152:ZI/0Xh92X3FAOkoQgcK1UeVBOHpwIf0bOtW1sLjS8gumDJKm:6O2X33Dcp98bObLBCJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675079, "uuid": "aa141673-978a-4b6f-8655-ba7be23cb341", "value": 2806784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675079, "uuid": "43b2cc55-1d8d-4b3e-b2b1-2dd23d0564e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9c79f8-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745675084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675084, "uuid": "af896a29-e520-495d-bdcf-7ce310146baf", "comment": "Malware payload (Healer)", "value": "de1fd1f61ec827cc5f2cd0c599f66395", "object_relation": "md5", "Tag": [ { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675084, "uuid": "5455a1e3-92f8-45bc-9b8e-7ce1a00925e6", "comment": "Malware payload (Healer)", "value": "729415af9baf298ff9960f63fc570f2d0069f06fc39fb8266a3ef827099e0e3e", "object_relation": "sha256", "Tag": [ { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675084, "uuid": "e40c5e06-e549-4693-829d-7649f55c00d2", "value": "T1BD853329AED1FAB9CFC701706548C60CB3B7C11D942B5AAE272BD21E55E194D022DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675084, "uuid": "99dbaa86-9190-408a-8ebc-9953efd58f95", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675084, "uuid": "549eee0d-f305-4580-9bde-a2a4bd7e5d28", "value": "49152:kfHPpJMARXYhqrP3XXN+DBW5hw+W72rMK3WK:kfHPpJMAOhQ3XdgBWBWyYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675084, "uuid": "ee7be25f-3689-48ee-999b-36a356d6bcdf", "value": 1768448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675084, "uuid": "90ecc912-0268-4b6c-b4d8-57d3db46c60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56554e8-5ef1-11ef-ac1d-82aee05be84a", "comment": "Malware payload (CryptBot)", "timestamp": 1745675089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675089, "uuid": "ed95c0f1-a338-4ee7-a438-dd8cf1b75618", "comment": "Malware payload (CryptBot)", "value": "51dd8d9912686daa950d583dad0aa631", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675089, "uuid": "bffab02e-b0f5-48d4-86f5-9dbb00e3fb32", "comment": "Malware payload (CryptBot)", "value": "947320655731a7d64ebc3b134f74d35fa6e391f8c46b66536db11163f50440af", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675089, "uuid": "bd2e6b61-bb24-4c2a-bb3c-2be4f77ea68f", "value": "T19D66183A9B4351C8C13FA57ADC927F3FF4286AE843A9491B6C0508FCA755791E8AD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675089, "uuid": "169a38f4-7339-4c34-9701-742de6377263", "value": "92a00f4d0a4448266e9c638fdb1341b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675089, "uuid": "03636f26-3782-4bca-a3cb-41a64d3f614d", "value": "98304:y+oMqykeNRETio94vurpBb7fBRWPTmOSAItsvycC:y+uoKTVivyBnBkiGoeycC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675089, "uuid": "73a4b4c8-0e22-476b-a819-9dd6396f71d6", "value": 6617715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675089, "uuid": "e44b8545-7853-4c79-a24f-a0ad273410a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f360be6-8e53-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675089, "uuid": "0e6a92c4-11fe-4270-a8f2-625e94a9b747", "comment": "Malware payload", "value": "f2930c61288bc55dfdf9c8b42e321006", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675089, "uuid": "af03e8dd-45b4-40b5-a7c3-b4f0282c8d86", "comment": "Malware payload", "value": "d3a53533949862449edb69c1916bf56681e3f2ec3a1c803043b1f3b876698603", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675089, "uuid": "139aff78-3933-4411-85a4-4dabf19f69f8", "value": "T10E46F14BBCA508B5D0AA97318A6A91427A71BC050F3217D73E90F77C2FB3BD09A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675089, "uuid": "b9373177-22e7-40c3-8e48-7bc34c0e757f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675089, "uuid": "d3af3b79-b14f-43f3-b91f-857c94115879", "value": "98304:lDFAOtlPsTyojuPwkcbTj+xNTW7HlGrGMMCg/0xdb5+pUF:lD3jZojuPwVmW7srWCl1+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675089, "uuid": "f570f6eb-b171-49d5-9b2a-8aaa715678d5", "value": 5818880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675089, "uuid": "ef53ecde-8c6c-4823-a877-b61ead960f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66ad424-5ef1-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675090, "uuid": "7d1a3c8c-24e7-4796-aacb-caea3bfe3fb2", "comment": "Malware payload", "value": "2ecb08bc874649148c0b23e832f522f7", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675090, "uuid": "892fd46a-6c89-4958-a904-5630e658a5c8", "comment": "Malware payload", "value": "17f256015c257cd0b73d14d0d908ccbc317b7e1d8f5ceab2f855c277d7f97e6d", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "431cb90f-0473-4ce0-82ca-0312495c40d5", "value": "T10E867C7B72B59269C26EC13FC5A38F02E433B4791B37C6E7929002595F129C4AD3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "9c1979b5-bf57-48ab-a501-62d1a16c6bd8", "value": "73c7e572536ce3b598c7740cf9a09ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "3e325347-5070-4d8a-b659-b49cebf2b77f", "value": "49152:sExHcWioiCm3XEyP3605RYCXXLwsSXLJK3quO6xVzsoeoe17qRhm6PpdTTCWZ4ib:cNtfmToeoeKSWew5OkKX3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675090, "uuid": "66f76450-e2f2-446a-bb13-56e36b1c6eb6", "value": 8350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "83d2bd5d-180a-4b35-aee3-1f0d0a7639a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41b3175-5720-11ef-ac1d-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675090, "uuid": "2a93a961-93f7-4f6e-8842-fe430e9dfe60", "comment": "Malware payload", "value": "2f208b17f8bda673f6b4f0dacf43d1bf", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675090, "uuid": "5cd8683b-ded5-4a99-9e86-6e90c3ba2543", "comment": "Malware payload", "value": "1fc3e92f7f30f4f68861d3ceb8284853ae30c11cbd0ed3e46ea9eb698b3ec348", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "9d4bfa7c-345c-495d-98ea-3c622403ade4", "value": "T1A9E66B7F76A58A6CC25DC13FC0A79F00E83370B90733C2E792A512686E599D49E3F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "f56a011b-ff60-4330-a565-1c88432925d5", "value": "c346eaddb975f381aa1bae852c6a8010", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "3b03e61d-7ddb-4104-9d68-7834fe2e7472", "value": "98304:IdEOTQvv8toqK+tO985QWRDXpFviNkYDdQI:GEOFtoqK+898jRDZ8kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675090, "uuid": "85a5ecd6-a48a-4c28-b542-56bdcd12fad0", "value": 15064064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "60ad918f-4be5-4ae6-a3d2-a4defbbf5b50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5f36c1-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675090, "uuid": "79f5a705-748f-425c-8407-94c4118be6a9", "comment": "Malware payload", "value": "1c6b522d985b2e60890a098e3d5e78b8", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675090, "uuid": "fcc867f1-9bc1-4885-a0e6-bc469196bfb8", "comment": "Malware payload", "value": "35005932465ca51b1bffcd168dd6c9386dbdecb78efacfbe4877b9b1e65da8b4", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Sliver", "colour": "#EB6460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "7530204f-0e70-472e-98d0-a37656c38d82", "value": "T14C076C61FA8740F6D943157580AB636F67385D018B3ACB9BEB10BE69FC376921C3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "77d58aa5-0d95-4db2-b8eb-45613bc4d8d5", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "ea715606-9e22-4647-80fa-b4d3a42a3c6e", "value": "98304:D5MCdYwJ/6LV6oJBgsJDVUN81bIe3Ev9kaxS0i8J2LAAvbW54jSEUb5HwXQiUacn:uqm6ABmN81bH0VSpO2sGb905QX5ccC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675090, "uuid": "13909e75-7973-4335-b83e-358a45cee713", "value": 16819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675090, "uuid": "66b5c21e-2fcc-4778-b7f7-3693853e01c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a10a7a-8a6c-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675094, "uuid": "0318b1b1-74c0-4322-a45a-f8e4ff28291a", "comment": "Malware payload", "value": "5f08961671234960517cefb9df7a8c41", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675094, "uuid": "26814e85-75e2-464a-a6db-d2e80600391a", "comment": "Malware payload", "value": "d5008a50f2867a9ec72e557977f54f9867b861dd184149016e98c4ee0b02806a", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675094, "uuid": "83e50306-87df-4f07-82c5-7fe5ac136a0d", "value": "T15C172274830B6A5EE32354B04B2467D7271122A6D943B87D237178DF566B063FAE3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675094, "uuid": "cf36db7f-bcc1-414b-9bf6-b4a06381f0e2", "value": "72c4e339b7af8ab1ed2eb3821c98713a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675094, "uuid": "0233e170-c795-41d4-9463-459c3c9bfb89", "value": "393216:wEkQc5SEaB1+TtIiFxcijMOGEt0V8IPSbLYY60XlimptqqSRVd:w9Sd1QtI4jMOi8IkLYY/5Sh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675094, "uuid": "a06acb9e-f8e2-4630-b415-587816a73f08", "value": 19957929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675094, "uuid": "fb0b9ed9-6209-4cee-b789-cf63bd166fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2565c35c-77fa-11ef-afe5-82aee05be84a", "comment": "Malware payload (LummaStealer)", "timestamp": 1745675094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675094, "uuid": "c52c38ef-ad7b-4dca-b4bc-b3ff59393a61", "comment": "Malware payload (LummaStealer)", "value": "42c824664b958e0e9ceb5ff44836df48", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675094, "uuid": "c92e3571-71b8-4cfc-a372-427b5a683009", "comment": "Malware payload (LummaStealer)", "value": "9edbe8d6aee72e51c4d49d259faf757c71470e2036cb72d151d19512fbb0ddce", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675094, "uuid": "115d75bd-aad8-444f-9a4c-d0ce6a3f42ba", "value": "T194B62323B2CBA53AF46D0B371573A69498FB7A61A923BD52D7F484ACCF250141D3E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675094, "uuid": "b9373a7c-1b0d-4dad-9f12-483c9779c27a", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675094, "uuid": "0914510a-2eeb-4457-bf9f-81d815753d34", "value": "196608:J7lmzQjq23ZLuxKSoE7y8t6GzcCn9D7DLOjjLPH+N1tEwalOGVnNJLzgDqQ7poZ:JkQjrpLdbZCn5DvNJMRVnTLzgOQ7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675094, "uuid": "62da7211-c6dc-4b39-9902-d10e1ab8a975", "value": 11226751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675094, "uuid": "1b71b6ef-d904-42c0-a46f-9bb6c591b1c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2a1c94-7374-11ef-afe5-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675098, "uuid": "50f5baff-f6ac-490c-9cd7-786ec8044c9c", "comment": "Malware payload", "value": "304a5a222857d412cdd4effbb1ec170e", "object_relation": "md5", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675098, "uuid": "103f00f1-36b3-4ae7-919f-b6db0b351f4d", "comment": "Malware payload", "value": "d67fb52973c445a3488a9d6a9a9ff3ebebb05b1c0e853cebfa8bba1a5953f0d6", "object_relation": "sha256", "Tag": [ { "name": "185.215.113.16", "colour": "#a42381", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675098, "uuid": "f6021427-af0d-4e89-9d26-9e4fdddcdc92", "value": "T1CAB68CBB73E18268C16EC63AC0A78F05D833B4760737C2E702901A599F669E55D3EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675098, "uuid": "d49223e4-7bbb-4445-aca1-471b7b64a813", "value": "566b19b5ac294f4a1afe5e76da03206c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675098, "uuid": "0804b739-4038-41a6-81fd-495a0301c70d", "value": "98304:Zk8Moeo9VZ4odf8Fn8U/J1vD3NSPUv3KWQSy+Bk:e8Moeo9VZLf8hvRlfKkhBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675098, "uuid": "efa4cfb3-b8a0-407a-b9d8-285055df767e", "value": 10481152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675098, "uuid": "c91283bc-3479-4f39-b59d-bf3a1d184957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac458203-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675110, "uuid": "937253f5-7f34-46bb-8c0f-364825e2aef0", "comment": "Malware payload (Gafgyt)", "value": "b9c5827bf64d6e138f7b3b23aee3a291", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675110, "uuid": "b7cb756f-612e-4c57-869d-a80498584a96", "comment": "Malware payload (Gafgyt)", "value": "c04951f115d196be74defb3e95657527055f4c74ec288cc2edca3f25d54ffb79", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675110, "uuid": "abe85689-460c-471d-806f-a3edea8c342d", "value": "T1B3932B05F8454B13C1C327BAB6CF47493B266BB95BEB3302A6346EF02FC5B991D259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675110, "uuid": "750e037a-c6fb-41f3-a2af-f433049eaa6b", "value": "1536:yu5sWiQ5ftEesFfw/DrRTOsM5hOkKxX86I0mRxqQEqn/lJXfPe:jiMsGry5hOkKO6/mRxqQEqn9JXfPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675110, "uuid": "2b077db9-801c-4745-841b-d40692b60232", "value": 96196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675110, "uuid": "3508cd07-be76-416d-b29f-61760d6cc4f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6e6f26-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675111, "uuid": "eec5cf42-9ab8-46c4-9564-a32ee1cfd54f", "comment": "Malware payload (Gafgyt)", "value": "b60e2d5503377f16ae1e610908fbad69", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675111, "uuid": "33a25967-68c4-4288-845c-c3b4f2085937", "comment": "Malware payload (Gafgyt)", "value": "c6ef0b4aad5a272cbbb6e1f305dfa66860b12f3bdb659f9a3aba4d17d98d444f", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675111, "uuid": "df2b09ea-d73e-4a8b-9fad-6ab191316c0d", "value": "T1B003E18AF352E48FD769E87703FD13404AB2AFDAE787CD0474506553CB099C96862E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675111, "uuid": "7bd039f4-6074-4ee6-984b-93f7d710a0a7", "value": "768:k3MuudSy5ofXiua60i4W90KWnHMtcdGqB7ZuPjJgGlzDpuWyc8CEYrQC:k3MuudSR3WfdGy4PZVEWX82QC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675111, "uuid": "442af03b-1915-4446-9b0d-4a9f190b1044", "value": 39084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675111, "uuid": "95acdddb-b6da-4c13-bab2-74e856798682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca2496a-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675111, "uuid": "4bb789ed-8251-4440-8634-7f3d2780a73c", "comment": "Malware payload (Gafgyt)", "value": "6acc686328378a3044541e280c892fb4", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675111, "uuid": "0e671615-0b03-43c9-adbf-8f266a2fba75", "comment": "Malware payload (Gafgyt)", "value": "ba78ada87493f978d8a0f4634122d9ffcbb680f6d72b9927a242c49aa6903c18", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675111, "uuid": "7ba01b18-5b72-4a49-a912-b6fb35bdf0ee", "value": "T103A32B05F9114763C1C327BAF68F474D3B2267A957DB3302A6357EB02FC27991E25A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675111, "uuid": "3c233ca2-6482-4eae-b40c-3fd25a043d47", "value": "3072:IG8es2aOtK5haG4uKtvmCyrQ0Knm4XnTe:oeKOtK5h6uKBmCyrQ0Knm4XnTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675111, "uuid": "cc64cbfc-dc2e-497f-8584-57057799f133", "value": 103742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675111, "uuid": "0cdf6667-67f5-4fbc-b471-e105879d2799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3750f65-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675122, "uuid": "f33dae6a-48f7-4494-aa12-da07ef83d0de", "comment": "Malware payload (Gafgyt)", "value": "f618251be06646d80ba40a2661db844c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675122, "uuid": "f50d0d27-df20-4f3e-8077-a05b94f4ecf2", "comment": "Malware payload (Gafgyt)", "value": "35d5d0a593697ce0c5100cd15f04eebe6d8eff4254c9e0644f35b46c8a290358", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675122, "uuid": "3b994d62-c166-4338-8ab9-c3208a65b1ea", "value": "T1F5932A03771D0F83C1CB59B129FB27F19769B9E502A36181A91BBE905B33A782523F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675122, "uuid": "914b6348-a109-4e87-ad77-5593b87bd3a5", "value": "1536:a347i0UzozNrQ35XeaaV8x6IfoSIhKh+w95hiWXTL9mQmV6qDjjoflee:aom0GozKuDe6IAS9N5hiWXTL9mQmV6qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675122, "uuid": "39b71d86-247c-4db9-a339-8afacce78e8f", "value": 89920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675122, "uuid": "a0697180-d4b4-4c8f-801d-8b64f5f14fa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38aadb1-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675123, "uuid": "e03105cd-30d5-46db-92c5-6b3c2b59341f", "comment": "Malware payload (Gafgyt)", "value": "a95d68e036157b1bb863c45e55401649", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675123, "uuid": "461a6d9d-4ac9-44b3-a2ba-50129ec641d2", "comment": "Malware payload (Gafgyt)", "value": "296c8daa54ebbc3be0fa2232dcb997a852efc825930b3ffcec132a65050e87e1", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675123, "uuid": "319d40e3-341d-49b2-b6b1-2675caae9f3c", "value": "T1CE03F17AF0610EA0DB7BFBE68D548798FF764E433106976230D2F6426813602AEB5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675123, "uuid": "077f71c6-8bb0-4e89-873c-2e2d9e8c4e6a", "value": "768:WTPN5ww6nt8+tVA1v+A4s6Gn1in7Gqr9V/jqt4uVcqgw09sZ7jAct6z:oV5/M41vWxGngGqr9Vc4u+qgw09sZ7ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675123, "uuid": "fa495ebe-5951-496b-a642-448d28609e4c", "value": 41196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675123, "uuid": "539e4191-e807-47ef-a9c9-baa42091747b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e6fcef-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675123, "uuid": "7cbbc7e8-65db-46f7-a68c-986682e674ce", "comment": "Malware payload", "value": "6196bb1a4d17ace6ae1b213949e5747d", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675123, "uuid": "4e9c1ddb-3a5a-4d36-91dd-6ec01e34863c", "comment": "Malware payload", "value": "1e0974f79a3c2faf8bb093c6465dc6dde0d2ffba0af3c7208485e8789a697fde", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675123, "uuid": "9cf0ab66-6c75-4e4f-888a-5b806988faf4", "value": "T173F2E19AE0905EE9EBBF2C3B1776FFC61BA105D637D647C27484AA200A54B3359006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675123, "uuid": "5f4a7050-f254-4b24-b092-0313defbe4e5", "value": "768:qUlctgo3ekTdcFCcoeE9AoT3v5bBBqpRqAZH0R3plJEyYJ+1+4uVcqgw0X7JkmW3:YWo5TdmL2AonKlUR3plJEG+4u+qgw09C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675123, "uuid": "3539bbd7-608a-48e2-a24e-cb742fbfa6c4", "value": 35932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675123, "uuid": "7f76dec4-2963-4b60-a22c-58208393d166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f9f32b-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675130, "uuid": "1f731122-e295-4419-9d2f-f1ec4dd0abef", "comment": "Malware payload (Gafgyt)", "value": "fb4252eb45614b88ef0aed7147859a97", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675130, "uuid": "da8b32c5-ca9f-4f1c-b32e-0b770a46c869", "comment": "Malware payload (Gafgyt)", "value": "9909130bafd82ebfa359da02df7921cef4a56938dbaa655275bc5c27b6032ed7", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675130, "uuid": "d123854d-ae6c-4e29-8261-967cce25ff53", "value": "T13B13F26C1B1649DBE402FCB90FCB1B002DE74E872523FC766286F99847946BC1997B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675130, "uuid": "8d0e93e4-21f5-4b27-8ba1-cc7006938edd", "value": "768:uK8ue35qUcDmWPHBvr3YtuD+4tlad1DYQjNMuDJgGlzDpbuR1JFgjNnZVPI:uKZSWZvr3YtuDXtlarMaNMEVJu6tI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675130, "uuid": "e771eac3-a38c-4484-aaf0-6ceed3031cfe", "value": 45564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675130, "uuid": "cc412953-db04-44eb-b945-eec20324a316", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd11aeb1-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675139, "uuid": "ea75d8be-8e2a-4d71-99d7-553ee7ead7d0", "comment": "Malware payload (Gafgyt)", "value": "dce2e724cb9a1cd229dbea9d4299f68f", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675139, "uuid": "4728c622-6d9c-4a21-a641-8ae7670ebb8b", "comment": "Malware payload (Gafgyt)", "value": "ab369a66b229282cde3c403eb2dfe7e086c1db209c06fafffa40b135f82c2add", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675139, "uuid": "3fbf1634-2853-4c9d-94e1-9be7662bc688", "value": "T18CB3D96A3A21AFFFD06986310BF7AF2087D522D626915383F15CD7585E3128D2C5FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675139, "uuid": "77b39e1d-16f5-4e60-838e-9b1f2517f37a", "value": "3072:0VW0fIHznlZC5h50qBkxmkizF9GhsRiAe:0APT3C5h50ZxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675139, "uuid": "75762611-38a7-4c2b-a835-653909e023b6", "value": 115243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675139, "uuid": "a2a3d9d8-d3f9-4303-bdf0-435550689aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd881dc-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675140, "uuid": "2f36b9c0-3e75-4d52-8232-39a24f6bb19a", "comment": "Malware payload (Gafgyt)", "value": "bccc0d2434171c0285540e8166056668", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675140, "uuid": "09e033fa-14f3-46ed-abb6-f5b5828ce2ac", "comment": "Malware payload (Gafgyt)", "value": "9a5ba03d1ebefd585836a591674db613e6ab3647ea288b1c002a96c9280bc337", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675140, "uuid": "67827d7b-5dca-4eb6-a6c0-0e36038e2bf1", "value": "T190F2F1101455B268E632183154DCC682E3EE9B7AE7CB6067078CD0FABB958835AFB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675140, "uuid": "1b063099-f06b-4741-882d-fd73771f542d", "value": "768:KzxQKKqdDkDBcpUtGFYQimeObt3UFENoonpXDZOv8b:StYDB/twalSpF+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675140, "uuid": "5f63730f-10db-4148-a806-210466a20c64", "value": 36828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675140, "uuid": "a13571e8-635a-4d01-aebd-ebdf9d66a4e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf53434c-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675142, "uuid": "da64f073-74ed-43f0-b96d-ec32c8f85d45", "comment": "Malware payload (Gafgyt)", "value": "60ca45f7413a0fe73dad3f09702da8c6", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675142, "uuid": "44ffbad9-19f6-4da4-bf0f-0188e373f088", "comment": "Malware payload (Gafgyt)", "value": "9871f430ea86c08b2a4ae8952f892579684858f2fbcd6d6922a5c8b349a5444c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675142, "uuid": "50ff5d10-e1e7-4c19-afa8-a5206f911cd6", "value": "T14F13F243BA08F42385A0BC7EDCBC0CC6A9EAFFACD76A814674D016A4F75525352E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675142, "uuid": "38b64e72-1072-494a-8c9b-a69cafe82fb4", "value": "768:uPHNiBA+E767/D7FT//b2RVbj3Mdpsyq3UirTiLnqELEdq0vhC1:uPp+is/D7Frb2RVbj3Mdpso/LEdzvM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675142, "uuid": "8f10a764-0a2f-4920-b13a-1c86ed97545f", "value": 45136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675142, "uuid": "b5fb1832-ea54-46e2-b754-980deea1a916", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf840e93-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675143, "uuid": "dead0616-3c0a-4dfe-8d3c-1ee28f18e771", "comment": "Malware payload (Gafgyt)", "value": "df91fd1cfa7269ae8913016d5f33d62c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675143, "uuid": "23761ef1-4a0f-4b1b-ae17-5cef4d222e5c", "comment": "Malware payload (Gafgyt)", "value": "2b9a413dd90e4e84ad97cd67f03c4f64e77f24537cbf2364169e1877320056bc", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675143, "uuid": "42ec6b4b-7674-47d4-bbb3-98e2a6e2c42a", "value": "T1A543011C0DF82B32EBFE9479897E40D65BBFB79582EAE6430C557AC912410911BBFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675143, "uuid": "7f37e511-85cc-4239-a770-451a4396df04", "value": "768:JuagAYgCNuljVFR/s9VixwJvprDD6lQGpoej3ByvH/Yuq3UirIFHv2kWVSfTvAJs:JDFYVN2jvNs9VNLaQGpoezByHxGc5iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675143, "uuid": "2c01aa48-7c8a-4b54-a004-66fb0fac3d0d", "value": 58384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675143, "uuid": "131faecb-8c41-4beb-a99c-0500a8cfc745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c891fafe-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675158, "uuid": "19171693-6525-4947-9f6d-2b1e5542c44b", "comment": "Malware payload (Gafgyt)", "value": "7b566062d0442e55183497227761480e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675158, "uuid": "0897cd60-a5bc-4a23-b50d-c29c3392af67", "comment": "Malware payload (Gafgyt)", "value": "448497005a8e29b62b13a948a0a380e2c7f729fddb1f5b2b3d20ca36b0da940c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675158, "uuid": "0d495b39-b5ae-4962-b0e6-1acc4a3f91b6", "value": "T19103E04CB1803EA9EEACED3E62AD5E2328946888F1EF865D97014D54C7C1EDF34D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675158, "uuid": "b8540a37-0190-4a7b-91fb-709b08944c7d", "value": "768:15MObrpmLTNYi8nM89k3XqeryFAGPf+cP+WTN/nVRArav4:1aO3ELTNsnVCaeryxD3N/VRAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675158, "uuid": "7daff403-3551-471d-872f-3561c6d6e452", "value": 39528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675158, "uuid": "b8e2c89f-880b-4b6a-98f7-71b87480aa54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb65b9f7-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Ladvix)", "timestamp": 1745675163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675163, "uuid": "618662e5-73ff-43f0-be2f-a2dacdc88406", "comment": "Malware payload (Ladvix)", "value": "9c0890b57d156eb129485a8f512fcd8a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ladvix", "colour": "#c4644d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675163, "uuid": "b88b9177-f4d8-4b27-9cc0-d85509bfc773", "comment": "Malware payload (Ladvix)", "value": "20ac4542f8084f31bf327f53eb77cf3bf62c13a4f81896d41c8f4d9d0f243ad3", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ladvix", "colour": "#c4644d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675163, "uuid": "eeda299c-3d0d-423f-ab9d-ac642cc7a193", "value": "T1B343E19AD672D73DCCCD8F7045238AB81571E2B1FB138735AB9C94392D40B684A19A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675163, "uuid": "57a3d2b2-085c-4129-a8f7-bb5b6e7a2420", "value": "768:AFTaLRRodDcREeTvfiFzozlFhxNQRJmN2yiTMZGSgPEN6fA0RSPtjrab6ccO:GTqRR4DcREeT3ipAlFh/ajAZGjx9FGzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675163, "uuid": "59ce9cb2-618b-411f-8f27-84780b33867b", "value": 56047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675163, "uuid": "00c61788-b742-4e76-8aa4-65ba6c152bd2", "value": "application/x-pie-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfc5717c-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675170, "uuid": "3bb3b434-15be-41fe-8c1e-9180d98b12aa", "comment": "Malware payload", "value": "24bbaab2d34a3903feb28d2f29a15c38", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675170, "uuid": "82244517-e827-4df6-abb8-4a6c7362bb3e", "comment": "Malware payload", "value": "7658c4f7d5b708cb7345f1cfb4d26c50c3ef70a75ab25b1bf1bddafea47cc184", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675170, "uuid": "321d4ec9-9ab3-4cd8-8550-74a68dd11742", "value": "T1CB415B4B73DBA625EEE7E472749060202383C489D0ED9B4CF6E935CDD0A9CA4736A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675170, "uuid": "e090d1de-8c9b-4d4a-a7ee-040586f83b8e", "value": "48:UufgNA5bKzATNd4tC5SLc5yJ6TERdS1f1A1V1a1hUBaXevwFqxgTfvYNI:UufgNA5uzATNd4tC5SLc5yJ6TERc1f1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675170, "uuid": "cbadd93a-775d-4174-93ec-94ba4b964519", "value": 2035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675170, "uuid": "4eb07570-a0d4-4304-9cc7-f40eeb90b6b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8884e8f-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745675185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675185, "uuid": "936eaf85-dcd7-4346-9650-eb36c9a0ebbe", "comment": "Malware payload (Mirai)", "value": "9857ff303341509c4d1819f7b088498c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675185, "uuid": "3b58ce4f-165b-4acc-801c-61be24aafe9b", "comment": "Malware payload (Mirai)", "value": "5253c1d263e3690f26f0615fcbfc39c3945f00ad0b418996ca3a1ab79fde4d3c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675185, "uuid": "abc9fb1e-e466-4bcc-a5d9-5aadcbe1ff23", "value": "T185531219E57173E0C024EFAAA5335E0573F60EAC98E8226E0B0B5DD9C9C418971F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675185, "uuid": "3865f389-498c-4af8-b5d4-73e65d8fe5db", "value": "1536:8Vez7VErY2l0LphMrX94aBLMoULdU5i9V5sH2:8VoVu/QphMrtHBLMTLiIVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675185, "uuid": "f48a731a-232a-4a31-bbac-01a6746be013", "value": 63996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675185, "uuid": "b58767d2-0651-407d-a003-fd7d359fb2f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29d587b-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675202, "uuid": "48b34f1d-f2be-4875-ab09-cc6d353e64b8", "comment": "Malware payload (Gafgyt)", "value": "4ae595c3cad6eae4ef2a425d8d622b9a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675202, "uuid": "57a5da04-67c7-4b65-b7df-4117c2d4e0e7", "comment": "Malware payload (Gafgyt)", "value": "cd3e2e4fd40d987fd551ec0f6dcb2523beac652bc1e15322b3c2cc1b1d5b7bc4", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675202, "uuid": "3171054e-2a66-472e-a086-af111e5074de", "value": "T1E913F164EEF4947089419C33CA2E8946B7930BEC7BD17275881446EC678B0DC7A7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675202, "uuid": "da4983c1-04d2-4f37-8f07-1643699f3f35", "value": "768:TF8v/Dcp2Une+BTjwHZ3ZZhsSBrqs3Uozu/mID7LqFF9vX:TYDZUvE3ZZpxzueIH2zvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675202, "uuid": "9023df0e-fae2-48ba-be2b-182a91073568", "value": 42824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675202, "uuid": "74dd4f83-20fd-4363-aded-00d856674964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e689608f-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675208, "uuid": "3864bd88-707c-477f-ab85-4aee54a7bf97", "comment": "Malware payload", "value": "b3d3ae231cfd6f1ca429e428c7da12bf", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675208, "uuid": "daaf14ce-0e6d-4c53-b78f-7b7d1ce2434f", "comment": "Malware payload", "value": "480ea65d5b48fd90b5ed6c93071812ba87fc5d68d88cf795396cb0ddb4a2df06", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675208, "uuid": "32e98258-06f1-40ac-b27d-418a2d51131f", "value": "T11FB30792F901DFB6F40AD7B604D34725B230FF660E931662721739ABAE362D42827F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675208, "uuid": "71e6e26b-42b8-4819-be47-d73a62b1a883", "value": "3072:im1C+zCZhLiJ+ZgMBpHZRULyjcCTorzmgoFsq5X4niQQZ:imAo+iMfHcyjP8PmgoFsq5oniQQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675208, "uuid": "52972a56-b43f-4c7b-a650-114578669843", "value": 115004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675208, "uuid": "ceea57b3-704c-49f0-8abb-c06303b4ea28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab596af-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745675215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675215, "uuid": "e993a147-0ba2-464b-9a14-a0188ae4a8d4", "comment": "Malware payload (Mirai)", "value": "cad5995b3efd1dc0e1a36ec70311ec21", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675215, "uuid": "3f445bb3-cfef-48b9-ae53-6d955a78fc67", "comment": "Malware payload (Mirai)", "value": "98a2d71b278c5a53608e0dbd3acc37625c2de754f273b703d2c54de7afaaa050", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675215, "uuid": "39c5a607-4fac-49fe-a4b2-df3a2a4ef8ec", "value": "T1B213F1A362D58516C8AD793E01CD16C70CA1CBBD464619A69AF032BF40A5FD23C7CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675215, "uuid": "27ddcc94-f288-4f22-8875-8a969e32559c", "value": "768:avx7d56KOCA6sU2MaC/S2Zla9czPrGnbcuyD7UGQRjbinT72LW:KTI5VMaYS2ZE9qGnouy8GyPin7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675215, "uuid": "47a97fde-a5c4-427b-b341-4185bcc76b41", "value": 42120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675215, "uuid": "58bd1357-0c41-4d62-963b-a52c1e7cb0fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f260c708-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675228, "uuid": "ee82ba39-6a92-4408-b669-8afdeeed6a88", "comment": "Malware payload (Gafgyt)", "value": "87ee9be93be3afc996a5628e692e808c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675228, "uuid": "f273a141-7096-4ff3-bf66-131f3f9b9a3d", "comment": "Malware payload (Gafgyt)", "value": "fbf5cf4fd4d2ba1ddebb9ea2da38a1369d5f2142f049ef5b7dd5b4ed4dfaa2c7", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675228, "uuid": "5f6c4c28-2105-4c23-975d-c2499b713691", "value": "T12DA34C17A652C67BC087A2F417CB9921AC23B8BD1F23A30673D4BCF82B159D61D99F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675228, "uuid": "cabc493a-4408-49ff-a387-180822424e65", "value": "3072:62RuRkQT3v9EbYBo7Aphanvn000mr5um2XFYZA0e:6ISVv9csphanvn000mr5um2XFYZA0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675228, "uuid": "2f6c9c61-d996-4a92-929b-bb9f95e9b267", "value": 101339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675228, "uuid": "ec306a14-d765-4cbd-ae30-b2b3895d167f", "value": "application/x-pie-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe85fc8-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675244, "uuid": "809d509e-11f2-4bb7-9bd9-7f1312593a80", "comment": "Malware payload (Gafgyt)", "value": "5518fcf08734bb290e03e2da98305c7d", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675244, "uuid": "2dd1aa51-e00e-4628-b64e-9fc0e2f5c4ce", "comment": "Malware payload (Gafgyt)", "value": "2e541c4073eaf386fe0523877a47b02ef092cf9bbf41b028ce3e24c069063dc8", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675244, "uuid": "8ccc0d03-75d9-4b78-a85f-010bac534779", "value": "T1EBA33A377B130E23C0CA947111E31731BBB5D2DA39FA5243B9A16DE86F266843562F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675244, "uuid": "7f0dc6f7-505d-4846-a010-1458c32b2139", "value": "1536:XBJ2MNM5oqtkUtnaphaK6igkvmQmF6OXj6ufeuTe:KMN8vQphaK62vmQmF6OXGufhTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675244, "uuid": "ee3a5a2f-438e-4490-b47d-30cda9af7139", "value": 101398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675244, "uuid": "5afdcdc9-0e7c-4541-a0ea-792d775d0235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd0b92c-22a4-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675247, "uuid": "799e6fcf-0550-4b42-ac14-a91d88d2ed9b", "comment": "Malware payload (Gafgyt)", "value": "225a3abb2252c0a3af51f252109f58a1", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675247, "uuid": "f9f592d4-c9b7-4468-992c-64a7ebc6f4f9", "comment": "Malware payload (Gafgyt)", "value": "107a7be3e5f2771bd6e7e649cd9db20ab9c5bbd8f1cb0a891989b7dfdd64db06", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675247, "uuid": "2702a5f4-8f1b-4b82-9b72-9208469976dc", "value": "T1CFA33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675247, "uuid": "3e18b94d-0be8-45e8-ad05-3ecf338be864", "value": "1536:xfRuqNM5h7t/RiRt4nxphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRSphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675247, "uuid": "d09bbc1a-cc21-4640-9db8-6e29ff809868", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675247, "uuid": "536a372a-68e2-4d75-bc7e-dcc0043c9a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040c4f3b-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675258, "uuid": "e7c577ea-77ec-4278-a3bb-4cccb0a2d517", "comment": "Malware payload", "value": "eeb0a635f35ccb9e3d42084859fb0cbd", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675258, "uuid": "a6e68082-50be-46f5-8573-dfad62a1d519", "comment": "Malware payload", "value": "2ddb59e2b1ee01d1ecf05d0caff3e7df6d6725aeb534fd9285a729d9430cba91", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675258, "uuid": "2d809ad5-1640-4636-9269-ead571e37548", "value": "T10D21608A21B6C934ADE2BF1371A4864875D2D0A620E7EF35EDFE34D644CDD183441E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675258, "uuid": "49b000f6-801d-4116-b928-8d822a1bb0b4", "value": "24:16mchF6mohue6uw6tntgU6bFbWq36uS6Df6fNIlT:16mchF6mohue6uw6tntgU6ZbJ36uS6Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675258, "uuid": "9c8fc13b-035a-4248-84cc-0fbdc06498cc", "value": 1179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675258, "uuid": "ed6dc7e2-f136-45b7-9110-7bfef92151be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f2fa2f-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675259, "uuid": "abd23bcb-2a20-4881-b221-666798cfc225", "comment": "Malware payload", "value": "24672c0c32b9ea6bd60ca89e9f97686e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675259, "uuid": "623f67ef-c37b-4eb2-836f-099b194c455c", "comment": "Malware payload", "value": "0f241b8952e3eee26badf4a1aec93744ac6faa26759f7cf87a3c58a2079109c0", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675259, "uuid": "f960345a-0f07-4c69-8e2b-9774c79205b4", "value": "T149518F84B3EB4518D9C95106E3B9C0D673DFF04B28A3DEA6C1A728F79478D8437886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675259, "uuid": "aaab7be4-71b2-42c8-80e6-1e181c5b426c", "value": "24:yCiRMecCiRMTcCiRM6cCiRMZ9cCiRM9vcCiRMOcCiRMLCcCiRMDcCiRM9cCiRMsZ:JAr0b9fQLc7FsINFVgpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675259, "uuid": "20c94497-59d8-40bc-bbf1-dd550869a223", "value": 2610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675259, "uuid": "8680eabb-faa2-440e-8b29-26e4a09d1a84", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0510b4c7-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675259, "uuid": "eac798b9-aab3-4da4-8649-e880eaf0618b", "comment": "Malware payload", "value": "d051fc682116646d9663feae20431beb", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675259, "uuid": "3ea96644-1542-4b53-b7dd-f5f53236ed91", "comment": "Malware payload", "value": "2347b9fde358e0d3a05c8cd98a422153c4792d8f3d206a3da86fec8825fc3772", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675259, "uuid": "6f5a9d00-b640-4af3-ad97-61323c172d66", "value": "T1B6C3083B7B270E23C0C9507111E30332A6B9DE5938B95397A9D03E9C6F3AAC835567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675259, "uuid": "7ba06d23-6ec6-4ef3-aeba-d4894ee17b78", "value": "1536:zOot+P70tv67YEi0phNtDcN95j9vtjEi1D0EboOqBst9hmEFo9sMkwX4nisHhZ:HtqNDZcNPB+Ezt9hm6o9sM5X4ni8hZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675259, "uuid": "de39c3a6-b557-4c5a-980f-300c3cbecead", "value": 123922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675259, "uuid": "300648c0-afea-4b7d-b35d-89456e010361", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0527be1b-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675259, "uuid": "1151144f-80ab-4b39-87f1-28f04cfe034e", "comment": "Malware payload", "value": "cb3da7c2c3de707a2fda8f63010289db", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675259, "uuid": "8cd5303c-6c92-4c38-849f-4ef42142f663", "comment": "Malware payload", "value": "823c38c9e4b20afbb589f5019d43890096fa19f751a302998dc765fdc68e2f83", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675259, "uuid": "4fdcea43-be4b-495c-82da-49fb1ed39414", "value": "T109A3184789654FB7C086AAB52AA75670071BAC120F5F1B897139BAF4033F5DEB40F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675259, "uuid": "fd7994f9-6675-47e8-9dd5-c877868371fb", "value": "1536:2RqLUFerFPfNG+CKsTCsemV5BVCgPpzGpE8f+EF880HFXFsZcw44BiQr1:rrXDsjZVPVIdf+EFr0lXFsZB44BiQr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675259, "uuid": "e745be37-0280-4b16-9e70-264cc97e4701", "value": 105174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675259, "uuid": "8af930e1-24f4-4dc9-a8f0-3048eeb8ad3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da6c5b0-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675274, "uuid": "79075438-de01-40b9-8f1b-d983462b448d", "comment": "Malware payload (Gafgyt)", "value": "ebfe08c89f157e2025c9c222613a7408", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675274, "uuid": "8426e3a4-5a32-4a89-bff8-cbdb53c56892", "comment": "Malware payload (Gafgyt)", "value": "b4acbae17c3a2027bbaf181b9584d3ab633dfd6feab84a720d0d636c1ed98e59", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675274, "uuid": "73846c37-cceb-4c22-9558-db3dde07e256", "value": "T161B3E867BB11CEB7C85FCD730AAA8615108DA99716D47B6BB3B4C95CE70694F08E3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675274, "uuid": "e1042f40-89ea-41aa-8c43-bc997a9d02e1", "value": "3072:RdbrMMuPEqcr5h1znqQxmkizF9GhsRiAe:R1uMNr5h1znqQxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675274, "uuid": "819ee6d8-2cda-4587-96ea-404ea8d735c9", "value": 115387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675274, "uuid": "778fd738-1faf-474b-b7a2-a255e8c6183c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b9a6d2-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675282, "uuid": "cf6539f0-44d7-427f-bf73-1d76a2d93b08", "comment": "Malware payload (Gafgyt)", "value": "e5ca447b8366efa000a020663039648e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675282, "uuid": "5caa44c8-360b-4e74-a0fe-6c7b0705a537", "comment": "Malware payload (Gafgyt)", "value": "0eb16b397a67c923efc382619e927e7f7bd9062150fbd46f4b82d06a00d58dd9", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675282, "uuid": "f29a0ae3-49f6-45c8-9791-63b636063b4d", "value": "T114C33B06F5514B53C1C3177AB69F521977232BB897CB33229A24BFB42BC179A0E3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675282, "uuid": "c7b94ce9-0d0f-4960-b21e-a94691821d8c", "value": "3072:Yd5adFfNQamBJl1O15hudKRvF2/bBbmOQUJ1UXpTn:E5adFf4O15hudK9FabBbmOQUJ1apTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675282, "uuid": "7b89ee03-bc4c-495c-a6a0-bf5072635d63", "value": 118812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675282, "uuid": "deb016ba-0409-4c42-8e64-4512a0b9670c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1429da2a-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745675285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675285, "uuid": "cd022951-af64-4297-9b0a-f3fd07d1b9e0", "comment": "Malware payload (Gafgyt)", "value": "0a7adc360cdbd681794c878d333145a9", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675285, "uuid": "ce67f7ec-0f4e-488a-8728-53f7dae44e28", "comment": "Malware payload (Gafgyt)", "value": "33a296d63d4960fa1e4cfdd8ab442b1c12a05aa291a10bc66262f69e3b292c5d", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675285, "uuid": "fee5611f-1a7c-4606-b130-5c772cc8c1b5", "value": "T1FF03F17242C75711D164EC78F82EDBBE678A54B4F13930E796018A4421E4A252FFA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675285, "uuid": "b923edb5-fd18-4b9d-8e0e-9253d77d1c9d", "value": "768:Kvf80RqOwV/xN3hqMI2BsokIbW+CAh2i7HBqR1iU3UdzWby8jYSwNpEo:Kvf8EwhxxJsVIbUAD7Y1MwjYhpEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675285, "uuid": "408baf05-6902-49a1-b787-2d569dd29227", "value": 39080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675285, "uuid": "1e9babdd-c514-4e90-a7fc-3dca446f2ad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1913c9a1-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745675293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675293, "uuid": "f510f538-e68e-4332-8dad-c755c79a6dd8", "comment": "Malware payload (Mirai)", "value": "09eeceb1ca909fce404141593b824e5d", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675293, "uuid": "6f428d7f-29e7-4b23-96a5-efe38f200362", "comment": "Malware payload (Mirai)", "value": "5fb8bd41a49f00e2ca9177b3142a3eb9a6f9cca5c577e7598ca99de56ee112a9", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675293, "uuid": "d40fef30-7116-4ddf-ad66-6727db9b671c", "value": "T15123F275076B94BA84B55C32E4B2668FFB9647FB4CD63852516D032CACD78C227ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675293, "uuid": "7f7a3b25-4cf0-47e8-959a-7b70afddb1a7", "value": "768:HCRI9XDWdv7iJsF0R7t3Cgd8D7gwGovzioAV9AYjbs9q3UELqJf5/XTc2JXAdF6O:iiRktFWdKfgwFrifV9Vb1Lef5/aNM3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675293, "uuid": "4d76dbf2-449f-45a4-adf7-ae3dd6de4be4", "value": 50020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675293, "uuid": "f2a6d50b-d229-45b2-9c02-c822d26cf5b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204665d8-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745675305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675305, "uuid": "5db788f2-e678-4cdb-a848-5fa441ad48fc", "comment": "Malware payload (Mirai)", "value": "4c78128757c4180195e4f0d42f84337a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675305, "uuid": "277ff2e8-3758-4068-9c20-c81d81386ce7", "comment": "Malware payload (Mirai)", "value": "678db44c8f76ea1207e5f14235c6ec0700caca324ba9751581d0ca7fb6c0a0e0", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675305, "uuid": "eb5d1ebc-30c3-494c-938b-cd73fd17f3a3", "value": "T1F613E1B50D55F976D5B181716C3C06C7339B1FB0E5BEB12122E052208B6A94BAFFA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675305, "uuid": "a2c0c95b-ad47-47dd-b5d8-37d6161e02bd", "value": "768:kd9kXLANjUti/Mowyk2piEcHXdOhWn3DJiKPovCtRliTNQxs3UozB3qyPvWJtxtx:kbiojQuMPEc3dOADJiGWOczB6ynutxUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675305, "uuid": "bfd842ba-2b66-49b1-8d3e-49b11ad1f341", "value": 45116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675305, "uuid": "ea29b34c-4b67-4c15-8183-1fb8fe67fd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221a47b8-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745675308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675308, "uuid": "5cc67f49-5f5d-4fe9-bc4e-5f39064740e3", "comment": "Malware payload (Mirai)", "value": "26136446c2d318c83f30798836e3c818", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675308, "uuid": "8d2634d1-3e44-4349-9b51-694415b50f25", "comment": "Malware payload (Mirai)", "value": "710c915f9801ecdf779d08feb73068f105d59984449f9f67560d2ab133f22407", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675308, "uuid": "3ad0ecbd-46ef-49b0-a119-b5eb0dfc1311", "value": "T1E823F27D0CD2EC8FC9DEDD39E06543448C2980C1B797AB26971728D5E22A5D771DA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675308, "uuid": "18e9bf47-89a9-44a8-aa64-0304f25fc731", "value": "768:0YxZlghZjmrHbrTww/g0MPYcZspWNCK5FVl1v4:02gP4HnTFsZP7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675308, "uuid": "bb6e6f32-e1b6-4187-8e54-075254982c0c", "value": 46184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675308, "uuid": "8ac3c8a7-da38-4f80-9cbf-ecdbb657b5cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a969796-22a3-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745675343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675343, "uuid": "9875f174-24d5-4eee-a32e-d146f87ce889", "comment": "Malware payload (Amadey)", "value": "7474cb550a8b63175a99cb328315db4f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675343, "uuid": "5aa2b78c-c972-49e5-9da7-de53ac4705f6", "comment": "Malware payload (Amadey)", "value": "8baeef6ffd311ec981593d1ac892d6fba2d12f86b8b2b2aea1cea3305b7ab4b7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675343, "uuid": "f856761f-9a3c-461f-b040-a22f2c6f3b42", "value": "T159159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675343, "uuid": "350893bb-fb2a-4fea-9edf-13e20969c7b2", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675343, "uuid": "4ba52869-fcc4-40df-8661-be568a6a8876", "value": "24576:RqDEvCTbMWu7rQYlBQcBiT6rprG8aehV:RTvC/MTQYxsWR7aeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675343, "uuid": "d1341b2c-8dc2-4a60-a415-23ac90651605", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675343, "uuid": "30dcd88d-27b0-4c8a-b6dc-341bb509aef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be8efe9-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745675405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675405, "uuid": "bc20b276-be6f-476d-8877-b3d08fbaefb1", "comment": "Malware payload (Mirai)", "value": "65f9f577eaeb50667f21e1c7d8d7645a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675405, "uuid": "cb9736d8-6bfb-4579-af9c-b58957e4fbf7", "comment": "Malware payload (Mirai)", "value": "e1ea837b498ed596be48ac6f192305bb80dc48c154b42e40e154299c837e9c7c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675405, "uuid": "c05e1120-352f-4f75-9014-db3e61e173ca", "value": "T17013E005C48C855CF52F9231E69F3F1F5EAC994DE58A88FF4CC428B24D2AA306E1D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675405, "uuid": "a830bb6e-9ff0-441a-9684-afbc58b0aef9", "value": "768:dS5AD31GSGFqHM3ERMGGp/m0ZPjedP0bmEQx8WuZhCnbcuyD7UGQRj6UEalQvdW6:dS83fMtdm0ZPCdsqEQkZInouy8GyGUTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675405, "uuid": "ace0f328-da3c-41f6-bc2f-78a2e4c72d09", "value": 41836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675405, "uuid": "47c755ec-7874-4b42-9104-9856d02cc009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70320591-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745675439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675439, "uuid": "16eece87-c6a4-4162-a172-638868583fe9", "comment": "Malware payload (Mirai)", "value": "b1fe654f7857229bf6dfe9004bb98488", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675439, "uuid": "8ec84b82-4134-440d-84ec-72467e728a2c", "comment": "Malware payload (Mirai)", "value": "fe260b674466cb0d3e7c0e240f10878b4648c19f0b60569ffafbb5402887f140", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675439, "uuid": "af3afd27-bac4-46d7-bd2b-716cbbb7e63c", "value": "T1B782CF20164165B2E661903ABD6E82C779670FB4F0EB37FA160C89E43D9660B25F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675439, "uuid": "9f4c2c49-e013-4f7d-8c68-a72f6bb2db8e", "value": "384:zIykwRHKSa0svP9TLS1KggGaQ4GUEQvlhcw5chhymdGUop5huv8:0y1RqisX5ukgFBAdNchs3UozMv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675439, "uuid": "11343dc3-79e0-459f-93b4-2d556b6c63bb", "value": 18512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675439, "uuid": "f2eac64e-242c-40df-9cf9-469fd053be6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9601c9-22a5-11f0-82df-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1745675539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675539, "uuid": "033f9bad-808c-43da-97f9-25da91d1f016", "comment": "Malware payload (AsyncRAT)", "value": "ef6c90b300bcfdbb1ddb1645a7702e39", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675539, "uuid": "3dac876a-4be0-48d3-9483-1eaa887b5f61", "comment": "Malware payload (AsyncRAT)", "value": "47df6745dadac5d8ecb9c264fc93304916ea5f3be98d6fac73e24c1149cb49a8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675539, "uuid": "b24981dc-88a2-4b86-8aed-17b94e65e77c", "value": "T177C36D5773A530F8E2778239C8915A05E7B2B8350720AFEF07A4465A2F236D0DD3EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675539, "uuid": "d1bc2304-0ad1-428d-b4b4-e920c52e7c73", "value": "ea98ed386bf0ae14f8c2637a49d11098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675539, "uuid": "e228b806-9802-4163-a3bc-7d7753c6b49e", "value": "3072:kyqjhEk0Im4XYyiryYBTMVGutdnKWe1eUm/VHQkJS:kv1ELI1XYyirycWhtdKWY2/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675539, "uuid": "f4ab922c-912f-4029-97c3-eac701279670", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675539, "uuid": "d7dbaa35-2daa-4404-88ba-b2d05e2ee11a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ce8fc8-22a6-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675905, "uuid": "42b69be0-fbfc-4831-ba03-07e39690b04e", "comment": "Malware payload", "value": "79b432357bf5a4cf8a59681c4a9c2b41", "object_relation": "md5", "Tag": [ { "name": "DeerStealer", "colour": "#8F0CD0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#978c67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675905, "uuid": "2a79d5d3-087f-46a4-b9d2-9334c37cedea", "comment": "Malware payload", "value": "0b72180bb6ed5989c7e6419c0721f9565dafeb74758a361602d549c6c9ea3b29", "object_relation": "sha256", "Tag": [ { "name": "DeerStealer", "colour": "#8F0CD0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#978c67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675905, "uuid": "fe695f34-e7e5-4241-9088-d0310caa5319", "value": "T18A96F101B7C5C832D3DE0231496AE36486BABD799B3281E7B7943B4D3D712C19B31B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675905, "uuid": "f755aea8-c104-4f26-b7ea-372c1b3fcaab", "value": "196608:vQLaJtSYh1yf/UBkAdGfvohPxuveulVRaZuLLd5S6R4cnxnDw4gQ5:02tD7YAdbuveulVfV4lQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675905, "uuid": "6bbdfd1b-735f-4255-ba92-a89c6bf4deaa", "value": 9131484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675905, "uuid": "a8c0cdb3-c81d-49f6-98b1-779ef40802dc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05f6e12-22a6-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745675949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675949, "uuid": "18edf88c-3c82-4bdd-83a5-edd18a278943", "comment": "Malware payload", "value": "b1714697c89fdea1015d45238e3b00e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675949, "uuid": "6f2051be-e77f-4549-a062-9e3cb7fd10c8", "comment": "Malware payload", "value": "7068e47ec18fedbce462495a3eb5a13e685e240addbff8904b9936f8b239d82c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675949, "uuid": "04e920a2-3db7-4e9c-a45c-a2d56c53e5ea", "value": "T1409533262B566E3BE88F56F295F3E31D2B189A6C34D4097D73A0ACF22E11524F5B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675949, "uuid": "517a42f7-5939-47be-bc37-1e622068abe3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675949, "uuid": "3160f415-997c-472b-b66d-2cef3233ee71", "value": "49152:aZS5HoFFdxFDXkhPVSyqRY7Vb4JZTK9clV/wCS:qS5aPPDUhPjX14JtK9cz/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745675949, "uuid": "b335be0f-d867-40eb-bf0e-2de8116e4d5b", "value": 2037248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745675949, "uuid": "626fc537-c9fe-4b16-a085-2bf920a7e077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d449ba07-22a6-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745676037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745676037, "uuid": "6c286da3-63fa-48b4-a791-c361e8d5b730", "comment": "Malware payload (Mirai)", "value": "0616fca4bdcdd8e45c6681b839ff586f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745676037, "uuid": "f150ad50-be57-4301-9566-ac0ad67658f9", "comment": "Malware payload (Mirai)", "value": "9d803cf5fbb7f7111174570fa9dc675e6fe36ab0a0fad38712eafb5a18f6d95d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745676037, "uuid": "33f97e6e-5d93-4c0e-b5ff-1ca79b25d452", "value": "T118531AA7F801AD7CFC6FEABD40160E09F921722059630F2B9BA7FDC35C721A55D16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745676037, "uuid": "61be7b5f-4bc1-4bed-8233-b3811f785a7d", "value": "768:P/e+xEBdj4tIyJuNmlTTAtIfQDeT2rhuQ8mX+NCRqXxCAcFX91+6:P/VKF4tImuNm1ctGQ3rwQ8mXxRqcA+K6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745676037, "uuid": "03aaea31-d163-4bf0-b588-2ba041371dd4", "value": 62604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745676037, "uuid": "d8dc9e04-81fb-476f-aa58-3550dce1ae41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a85307d-22aa-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745677443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677443, "uuid": "463b3054-79da-4757-95c6-3c94179d31a0", "comment": "Malware payload (Mirai)", "value": "4facf6e176db7d7efe68e718ab215553", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677443, "uuid": "b5b5a4db-5427-42dd-bd7c-dca76374c16c", "comment": "Malware payload (Mirai)", "value": "0716509d74f7914306ab4c60e778d75a3c98acd9a710fcc4333fec9a3d8afcf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677443, "uuid": "46ea9d7f-a59b-47ac-b5e2-2c12432e2920", "value": "T1EED3F745F8414B23C6D612BFFB5E428D3B2917E8D2EEF20399216F6537C685B0E365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677443, "uuid": "10081ce6-4e4b-4bb5-b754-43a61d3e17b6", "value": "1536:0Ka11fG5qiPB/RMCunNxRskwXWjAEHA4Vl6uTq3mRkAZN8vUrBHVWrKlj+wyw0RG:0Kag5knPh+Wj04WuWmRkCmUlHcoaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745677443, "uuid": "d3bf30b4-e075-43c6-b7a7-9d575299ab28", "value": 135712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677443, "uuid": "24932a80-8dbb-491c-82b2-2bb99634f39a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33846b7b-22aa-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745677485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677485, "uuid": "ea44c02e-5722-40c9-83dc-1c8dda0dba8d", "comment": "Malware payload (Mirai)", "value": "50ac268e24f90ef5aae13f1227ca5bab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677485, "uuid": "8d7a1091-6baa-487c-8461-1fa48b3b8efc", "comment": "Malware payload (Mirai)", "value": "ec16fba7d93a8c43dfc40ed439d228301f82a975f4150521004550d1b2603fae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677485, "uuid": "7fdb8ef4-6b9f-45df-9737-1f149d91d266", "value": "T174A2D127F2A07FA6CBBE5EF09E59D3C177F84D59A277C8435244AF0026234AA50249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677485, "uuid": "845ebbe2-be6a-4943-8c20-3e0b1bd9d982", "value": "384:oTeJRdgogCPInIJ217NheUVY+BcmopOjQbm84DlyFKe0DCjS5M4uVcqgw05VxJt:sSKogCAnvHkUO+BPbk6pIFD0OjSW4uVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745677485, "uuid": "ce3ebfc8-60a8-4aeb-81ec-3d47c59f8118", "value": 22432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677485, "uuid": "ecac9fd2-a147-4d97-b9fc-e7a6da4fc4dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0155411-22aa-11f0-82df-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1745677667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677667, "uuid": "37d6de09-7428-4475-86d3-a022bad13fdb", "comment": "Malware payload (ConnectWise)", "value": "62f16ae2b3d0abb1c86d7412b1529a3b", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677667, "uuid": "3f901dda-1f9f-4495-b7ac-b66925d48b38", "comment": "Malware payload (ConnectWise)", "value": "2348803c3227fe59dfaa5f0ce7ecd6f29926b6cf6201a9fbfa51b69b241a0b0e", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677667, "uuid": "26d8f6c2-d0a3-4b0b-82a3-454760ebdd22", "value": "T1E8646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677667, "uuid": "3f82a24d-82dc-4d33-ad69-a5ffd075f397", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677667, "uuid": "a094a255-8f86-4a58-b8b8-f2353638829b", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:A1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745677667, "uuid": "4311f4e1-a4e4-4c3b-9803-d56887dc23be", "value": 312576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677667, "uuid": "e29996ac-53aa-462c-89f9-75ae1c5e0c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d640ca-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745677910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677910, "uuid": "d407cd96-a025-4fba-bbe2-528d0738fe5a", "comment": "Malware payload (Mirai)", "value": "7ff0097590c6a79b248d6e5c05d3c03a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677910, "uuid": "140fffd7-4732-40e1-810b-26e9b1832591", "comment": "Malware payload (Mirai)", "value": "41efd9c9a4516d3332b1ca6454e70a890b70f61768d8d777639cf3239948599a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677910, "uuid": "4de9aedd-e652-40d1-8c20-be3edd00c3ed", "value": "T1F2D32A06F31C0A47D1632EBC3A3F27E193AF9A8121E4F640255F9B8A91F1D365585E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677910, "uuid": "5a0b19dd-e32a-4e99-9d66-abd825ed8a45", "value": "1536:yR0Sa/Idm20d2kbxc33xfuNiN2l2kFc7su7QQ21FF2avAc2cAkyGahtqL78x4XKq:p/a2xM3xVNp3Qb1FycAKXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745677910, "uuid": "10fc4345-ed29-4758-ba9d-ccb3eda3b866", "value": 139220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677910, "uuid": "56fc29db-6cc9-4785-9874-4f4ef6ba8bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5232c70e-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745677966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677966, "uuid": "15b13c69-8d88-4e9e-a710-05ccf159907f", "comment": "Malware payload (Mirai)", "value": "1d248fbba6d3aa8c23373434a436fc57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745677966, "uuid": "ee20f7ea-f329-43d7-8ab5-45fc42d66cd9", "comment": "Malware payload (Mirai)", "value": "0e5f6a92e4f4d7e3fb2a64139de5da4c3c943e8ba231446c73ad5d95cfe48695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677966, "uuid": "5312a948-165b-44a6-82f9-f2df4deb268e", "value": "T10CD31945F8505B23C6D612BFFB5E428D3B2A17E8D2EEF20399215F2137C685B0E366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677966, "uuid": "fb8b4060-4524-4c52-a8fb-f10f06d2bc3d", "value": "1536:ZKKqra2P60q/p1OJ8AXg3XFYa8uARK84VhLGwThQVuQc+Nlce6nE8Lly+wywVRun:ZK7ee8yy78uU4rZ2VuQpctEkhma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745677966, "uuid": "e2f360af-c53d-411f-99e6-49493d201545", "value": 138784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745677966, "uuid": "ec725106-877e-4f2c-b5d2-f138bce30c6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf9104a-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678227, "uuid": "3f0b6994-6598-4e22-97bb-7adb544d8086", "comment": "Malware payload (Mirai)", "value": "de8ef5d0f09ef0ca7ab19fbe6d0da422", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678227, "uuid": "048dc32b-4f28-4963-96b9-e22d7b0aa8ab", "comment": "Malware payload (Mirai)", "value": "634a07a67974b15543ae20182f856f17e33af25765a47bbce1c57c5153009f02", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678227, "uuid": "99e98469-495a-4d00-931a-34d1e81e00b8", "value": "T16B43A40E2E619FADF76D833457B78E21665833C632E1C2C5E26CD6001F6024E646FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678227, "uuid": "32f4326e-2b16-4571-84ed-387f17cbf8e9", "value": "1536:rutoewa0/ViPVOvVON7O2JMYnAn/9W622:rCga09ioYAn/4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678227, "uuid": "7a67486f-712a-4b15-ae4c-00cac4efae0a", "value": 60216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678227, "uuid": "a50cdb4b-af31-4b2b-8029-757e29286a22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfd7d3c-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678227, "uuid": "c7dc6646-f008-446b-8f57-f8e64cab58d4", "comment": "Malware payload", "value": "5f15076eedf7345fde8c4b1d03c7cf7a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678227, "uuid": "d7e0f14d-36a1-42fa-917e-8c53a7e95968", "comment": "Malware payload", "value": "52500fe5bbd8a4a210012e4d9cb5198300ee72dd0ba74cc6fa506cd0b8529fab", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678227, "uuid": "fa256dfc-3efd-4215-ae95-17013d62f440", "value": "T1F743D819BB654EB7DCAFCD3745A9070135DD951B26F92B367834D828F10B21B0AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678227, "uuid": "348367b5-9735-4b7d-a958-dd787065eeef", "value": "1536:Q/UGi4rl5SD/bM3yOXlEu584klZo6JPj:iUGzrqYY5lF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678227, "uuid": "7d164dd0-1c1f-4a16-9824-d4e0c1414237", "value": 60296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678227, "uuid": "328d34ba-3bbe-4d67-be32-302ee1d0a538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7da91cce-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678227, "uuid": "566d65b2-62e3-40ec-b9d9-1cd86e4097ff", "comment": "Malware payload", "value": "12493a4834e518fd5d60f02709cd1af4", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678227, "uuid": "d626af5e-5ef2-43ca-9984-f4bff30b15db", "comment": "Malware payload", "value": "4942ccaeed175c46d5863c62c62f7564afe33b8e71cd4f2cab00aebcdd2e16a8", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678227, "uuid": "4a1fa54b-78d8-4141-a042-32c4965c0e36", "value": "T14F43B619BB654EB7EC6FCC3705A9070535DC952B22F96B367934D828F10B20B4AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678227, "uuid": "c49ffc70-77c8-4377-9573-ee08cb2916c2", "value": "1536:OveKwb98RvATOHw7UoX6LufHw8BZIXUvK:OveTbUvjQFpBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678227, "uuid": "c7093b12-0139-4561-a499-72beece2bf2e", "value": 60292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678227, "uuid": "77f162a4-22b0-4497-89c9-3e5a9dbd082c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0d0e06-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "0f49fd0f-4a54-487a-8d3c-0be30200997e", "comment": "Malware payload (Mirai)", "value": "af928bf1f1fe779b382ae866f6234ada", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "ae0ccaa3-f0ff-4a95-855f-4fa3f46f570d", "comment": "Malware payload (Mirai)", "value": "4d452c4e5d44b93d1b58fab021c792f49de027d6cbb892e221a7a0fae65f1c7d", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "a6dfb514-44e2-4258-b863-893b00e05fb9", "value": "T18C639C73CCB62D68C59886F0B4658EB41763E58081574FFB589AC63A8043EECF6663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "654d55ee-8191-4a16-a1b0-503245d8f8de", "value": "1536:sarnDs7Xyg1c3d4Mf7AKp6PoC7QpY4aCfsS3+OjF:swAD/cNFDp2IY4a1KtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "e08023b2-b20e-4eef-a443-2977054ab01d", "value": 66872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "b317edf6-f421-4799-90d4-bc716ef6ac08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd003352-21cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "ed9269af-7f56-4178-99df-0f148f4ebed1", "comment": "Malware payload (Mirai)", "value": "244fee57f87b9a31d0f6c71fd3ffa47e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "0e4b33e3-44c1-45ae-a948-489779efee34", "comment": "Malware payload (Mirai)", "value": "4db20e28703aefb852e4b3e6de0db31095f19c83dc09b2556c619647bf24855e", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "a9b710d5-d1f1-4346-82f6-2f4f1e98f228", "value": "T1D4A3960E6E619FBDF768C33447B78E31A75923D626E0C685E26CD6101E6034E542FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "3cc15419-f59e-4e92-a303-6f26903d3227", "value": "1536:tNJ2MymOwUEgnxway/ayivyvCZldYeBtqfje4Nzki1V21e:tHimOw8nVldYeqfGiP6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "e55e77d6-002f-44b3-a541-199650191dc2", "value": 97972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "bf920163-aa0f-4bad-870c-cad191767a54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1319de-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "f7e66a63-db87-4d64-95a2-479d79024ce2", "comment": "Malware payload (Mirai)", "value": "1f47609ca081adacb9eba55b838163f6", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "5b5817fa-7244-4ba5-b315-dd996d5481c4", "comment": "Malware payload (Mirai)", "value": "b6290f746e1ed0a81595231f7e35ee800498ca297bfa6a2792fea13f8ef115f2", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "01d112cb-91d6-43c5-8edb-68e49c9ee74f", "value": "T1CB633981BD815613C6D112B7FB5E42CC7B2613A8E2EE7207DE25AF21378781B0E7B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "a88bbadc-a45f-4fe5-a08b-a33aa9d266b2", "value": "1536:lkNySoqx6TvKcj07Wv7G6sHzM44l+3YqPLBODKvX:lkNySoGkpj0gipHzM413JRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "990619c9-aa11-4da1-88e0-ee278e8b1f5a", "value": 70968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "01f94647-2f4b-466a-add3-e4fbba8e6983", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd251425-21cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "245965a5-7fc5-42b5-816f-aca4fe21f67b", "comment": "Malware payload (Mirai)", "value": "3c0920ae315c3e854ef467a38a269b75", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "041ede0c-3acb-413f-9081-9e29408a4195", "comment": "Malware payload (Mirai)", "value": "c8486bee71381117c6ac3d925b5bddf2f86fcb9e5d428140c4c9aa1b0001c968", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "9e38e99f-f2f0-483c-a956-8132aac8d7d1", "value": "T1AE633A85FC819A12CAD122B7FB6E428D37265368D3EE7203DD25AF21378781B0E7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "940db370-51c2-47a9-85f9-6c844d7489e1", "value": "1536:wbPakhqCzqJq5uEkPm9SJVsZ8ej7wHsfikryYMC:wbPakh1ncEk/VsZ8q3i0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "32dbaf98-e2e5-4917-8086-f01b20bdff14", "value": 73220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "18ba149a-2375-455f-a604-a6d190c0704f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4f04b4-21cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "681f72f4-9b04-4426-8d8b-c2025b057ac6", "comment": "Malware payload (Mirai)", "value": "f7590a23147d6529e48d2ead3527657c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "2d0b7fde-773c-4964-813f-2fe5a020a1ff", "comment": "Malware payload (Mirai)", "value": "2cecf382d90634a980c0d851a89a07372ee63858ee4750d066e242d17836c023", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "cf54f24b-dc03-4832-b853-8a95230d8a76", "value": "T19D733981FD819A13CAD112B7FB6E428D772613A8E2EE7203DD256F21378781B0E7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "5603785a-ea9f-4b77-bfb1-d98323da4f42", "value": "1536:QpjOABX3vUfPuQWD5TaYaqKlHkDYEWwE4WQhelRnyvaC:QpjOAVfgGLBaYa/EYEWwXt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "078769fa-fc7e-43c6-90fc-5efbda42e607", "value": 76748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "534c5f77-ffc0-4d5f-88ae-6f983deb7def", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0c9dc8-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "e09460a9-2185-43b9-9eb3-bfdc6380b1d7", "comment": "Malware payload (Mirai)", "value": "6bea83cfa4930fab21068d18ce1f413e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "bc7e8217-3a47-47e8-8c0c-35035aa451b0", "comment": "Malware payload (Mirai)", "value": "c04793bc372f59b6a075d97c6580b632bec7adb0baacfa76cae6dc02e1fde4b1", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "554ee309-17e2-436e-bbb6-efa04ae195bd", "value": "T1B943B519BF614EB7ECABCD3745B9170124DCA91B22F93B367934D828F14B14B06E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "8c1ae28b-1eb8-408c-86d9-229201d91ffc", "value": "1536:Xmfy1kRdt+00rIm4rtE9Tk815ZLYLIRP:XmfSkP2W8DZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "8bc91f50-c365-42ae-8531-fce81476228b", "value": 60264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "8e626c13-8f5f-4760-9746-e8ec97fd41ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0d453a-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "75115e3a-72d0-43ee-aa2e-81cbdee67687", "comment": "Malware payload (Mirai)", "value": "268679dbc80a5e7d85c8bf9effd05af1", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "f78d5018-a859-459c-9270-26ae1197a81a", "comment": "Malware payload (Mirai)", "value": "0fb348a94d09bf87933db195dabab709ce0575f993e98f21dd671b1672e88368", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "11346f93-e41c-429d-86ac-4fca8b913ee8", "value": "T105734B42B30C0947C5A35EF0263F27D193BFA99021E4EB84691FEB4992B5E335586E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "522b9ad4-219b-4179-88e7-4886faece8ae", "value": "1536:aMAjmWJndBGRr9jlFR8CC8FI+yUTzYxqp6t4/No:arvG5P2wFIKz9Zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "56273ccd-5aba-415a-bc18-c8bac1d8e1bb", "value": 75168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "2926dfdd-37e1-4220-afae-79d27af6be2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd11c96f-21cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "e790b9a7-f0e0-41ae-b42d-3a2936147fb0", "comment": "Malware payload (Mirai)", "value": "f88891d880cd022e71af3f297e05351a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "95dcb6c7-c9a5-41ec-9855-31fee8a4741d", "comment": "Malware payload (Mirai)", "value": "4e5104f9e5b922366f6fab21ebaac7dcbddbae80cbc9349e5fa4c859e721302b", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "a931b123-fbca-4655-9c2e-2c8c455ed083", "value": "T17EA3D60ABF614FB7D86FCD3706A9070635CC591722F92B367534D928B65B60B0AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "bb160c19-6369-4230-9b58-f7c3d9b9fd09", "value": "1536:w+XF4zsztraPdkFyzkOfGb5P2nTB1/+hvL3qZ1ufgwJ8G6biqFXWmj:TXFqs5c4ARD/+hD3qYx6JXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "646c8aec-a052-4b63-990e-9991042b798f", "value": 101332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "bdd5c98c-d9ee-4fa1-adae-d6e2ed1e55d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcb9ec2-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "bef1d55f-d263-43aa-b48e-0e0662d8a60a", "comment": "Malware payload (Mirai)", "value": "c5bbd5bacc0a48ddb6a13df983b831a4", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "59161f52-78e4-4be6-8d2d-4d41cb1a0ca4", "comment": "Malware payload (Mirai)", "value": "d3133fc819907723afaab93393c64bcbfe8a9125f8d77dc330b0579fd545e372", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "6a157e8b-e9bf-4ca3-969f-4e6bd4052d7b", "value": "T140833B22BA752D3BC4D4A47A62F34375F2F6478624FCCA1A3DB10E8DBF2464021576", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "0e890641-d19e-4d07-9fb3-a64e1f8952b8", "value": "1536:1RCPblMDNxVEQe78fuNjJ1UPOYp7ySt3gP5o+5lJRUuhMtAj1:1RChqLrI1clgP5omPRZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "0471f611-bd31-4900-838a-532c6622aa3e", "value": 83272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "a86163b0-1500-47d9-9536-0605dc869754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebacb4e-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "fcb4abd3-fd6b-42a3-b60d-b344c7f2df52", "comment": "Malware payload (Mirai)", "value": "4c339e3ca8889d46dc9de61e6f2f2d7c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "1d1f6f79-c956-456f-80ac-7236e89b7e6c", "comment": "Malware payload (Mirai)", "value": "3c15e3ce55328c4422b564a66e84cbd93e5addd4aae1c6dc55aea83b3d5a0d6c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "934a335d-fe63-4cef-b052-07aac6ba7767", "value": "T1E9632A51B8815B13C6D1127BFB6E42CD772617A8E2EE7207ED256F21378B82B0E7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "fe3c499c-2f4a-4d5e-ad08-a970cbfaa8a7", "value": "1536:CSMx7eAwi17awGQbCDJcphRnBP2dOr8am43UCRmvf:CSM4E7awGzVcphRVYQgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "2a674ba7-6407-4e95-8dad-c5b7f6e850c6", "value": 72120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "ff6e4d60-8f8c-47a2-befb-32cf689f716c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebd14f9-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "300a63e9-68bd-4759-a917-7e79cabf4766", "comment": "Malware payload", "value": "4ad3661e5dd8d625803e51d0a65af2f8", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678228, "uuid": "07be4790-d1d7-4daf-8c93-ecc43e35a95e", "comment": "Malware payload", "value": "ec42472566690995b5897bd262b420d5555a6d56c4b07ca460379671f54ce3dc", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "77a1cdce-4eef-4b14-bf5f-bc3deb201404", "value": "T19773C51ABF610FBBD86BDD3706B9070535CC551A22A93B3A3974D92CF54B10B4AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "452e6c5f-29d8-4420-8040-0006c5fd934c", "value": "1536:hasuUJ8Y2vvQsV7c2v4s6vkX09HMUGON+DowZMkWU13JePL:hNuUJ8YKr7hXcMUGbowp3oPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678228, "uuid": "a7d34054-2fab-4e31-81ba-8224de1d5dc7", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678228, "uuid": "1faa255c-183b-46d2-8b1b-1b75875b2bec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef09250d-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "246a8943-55e7-4196-bd65-89fe46c0f313", "comment": "Malware payload (Mirai)", "value": "e671d6e7a02bbfb42214a65e136a03f4", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "30b3a895-6aa1-4b1e-a6fa-02a6bf2056a2", "comment": "Malware payload (Mirai)", "value": "d05c9e3fb4b08ba0d813fcf8aff9efea09c5b7d69a9c07e178b75d92e5de0df9", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "dff75f3a-ebaa-4a2d-8452-0def3935f620", "value": "T1A873C70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "fcbcc5a2-d653-45da-8b7f-d9a942897e0b", "value": "1536:bpxe5qoct9fdlQBI6roEnUFndlBotYG9CJa101Dv:Fx3oANd/rndvomgC4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678229, "uuid": "045ecf59-c5e7-448c-94bb-47eff02e7ff3", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "d8dc9c71-1042-4602-af51-fd51d32d188b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef09dd7c-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "020b30a5-0c99-4275-a1a7-60fe258b0af1", "comment": "Malware payload (Mirai)", "value": "6bbb1d8fafcde6178cfd239cfc063d82", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "6ab3694d-8223-4f23-b6a7-5162f084d03c", "comment": "Malware payload (Mirai)", "value": "56554578b5fce427817fb175c64d4dfc1d193183bf7c41c07b590533af1260f5", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "42dadee8-e9b7-421a-b624-0ab810d66661", "value": "T103834B22BDB61D2BC4C4A47A61F34321F2F6978A24FCCA1A3DB10D8DBF6564031576", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "18e29ee0-b4c6-4194-b2e4-7d16918bb64c", "value": "1536:ct8KLrZ5+K8G9gYyHItRGKo+5kxQFhktnXS:cf55jnGKomkjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678229, "uuid": "1c327687-2e7d-4526-840f-1b6dbd6f8dd3", "value": 83272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "a4a21235-43da-4e63-b010-41c5fb23d2e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef14285f-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "5e88aa73-6b3d-4f1d-9ad7-e36fa1fcc28c", "comment": "Malware payload (Mirai)", "value": "9cd87527ca56a6b8c55756ae3bf3039e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "1db10408-309b-4dd0-bbd2-76b2a22f463b", "comment": "Malware payload (Mirai)", "value": "79c1e1c77e753ca29939285aaacf4c51505aafb6cc12d5bfe019454720e79c5c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "c5d0d266-b86d-411e-8fcb-c38f02f57858", "value": "T1E3735B02B70C0A47D1735EB03A3F27E093AFA99021F4F685755FEA4A9271E325586E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "1e69c0d5-649a-40fa-81c8-b6cfa709b485", "value": "1536:Y97arI5RQ/vW+0odGIuct5RdzhI+eCjsIV1b5eD9e:YObn4/WdhI+Dsyie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678229, "uuid": "36546f8a-16b6-453a-ae40-35bd0232cf42", "value": 76080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "37ca1496-12ea-45cf-bf94-ddfde1042e1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1441c5-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "a8682708-eee4-4823-9dd3-eb6e46b08c5f", "comment": "Malware payload (Mirai)", "value": "11e9d1bdd240ecbc9055db74c5833ecf", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "a6243754-6933-4bc7-b489-6097abf4c1a2", "comment": "Malware payload (Mirai)", "value": "9b58ae1550884090e21edab3fce403b5fcd9fd13f7a359b074a17eb793fb1a45", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "2b5fab00-a112-407a-9711-65ef9e1280ac", "value": "T1C3733A81BC819A12C6D1127BFF6E42CD772653A8D2EE73139D256F24378B81B0E776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "8a32d7de-5924-410b-85c2-8bcfb86b79d6", "value": "1536:TPU28OREursd5b9uQo7+8Z6VzhF1GDlWOgfmD23mBI9SMq:TPUHRR9uQ8IVzhFQGmyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678229, "uuid": "54523624-703a-4b10-9a6d-5fcd25857e66", "value": 75068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "c85c2490-619e-44b8-93db-346b4dcf24bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef281717-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "8ad4f199-965b-4d06-a018-a2e9be1e26a0", "comment": "Malware payload (Gafgyt)", "value": "cce4b88247d441007bf7b3f3af781c22", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "45266612-1658-4708-aacd-53c4ae01343d", "comment": "Malware payload (Gafgyt)", "value": "724bba833107deb55d224792a26f75c3dfa1e694ee17f7e711d6abfe48376e38", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "71960db5-7513-4c72-b447-56f8df175e61", "value": "T105934B0399615FB3C04569B125FB1A340B67BA220F1F1F9A752C9AF4474F8CEB51EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "17905fb6-a4dd-4cd3-887a-3ef64ac5351c", "value": "1536:IwxPk8B9FT0jiWnKzbqr1K1ill8e6xkVCPE05h8NSijm8mMnhR090jUeQfXm:D7QuWKzP1il7Vl05h8NRWMhR090QeQfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678229, "uuid": "fa238ee3-1aba-46a7-bef6-75e623dd30b2", "value": 97141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "8eb40cce-fc36-4a2a-8871-c68aa4ce1463", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef348a3d-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "321c6524-4d7e-4841-b3af-51ec54b6fa7c", "comment": "Malware payload (Gafgyt)", "value": "55052b27678f991c031b622b2fcce111", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "43a70967-baaf-4da5-8b9b-26f196d51ea4", "comment": "Malware payload (Gafgyt)", "value": "1ed67d50bccbab7c6d53fb8dbb3a1b100598a788971eacc8f868e4080478e3c8", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "0c6243f9-f1e6-479c-ac7d-9a58a4cafa20", "value": "T155933C86D642CAF3C4430AF612AF6A1A0631FE2A5E2B8FB6F71C7DF49B115C431157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "e6644aa4-aebe-472c-88f5-89fb5db75107", "value": "1536:rtBTtkjQCUOJ6WW0MRqXM9CjJke3iHJER5hhZlkOJsFWshe0QzUzJYQ2Wk:boQCUMWjRqXM9CjuT2R5hhZl0WUe0QzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678229, "uuid": "8a438fdd-efca-401c-9ecb-3aeec1ca4a7f", "value": 91636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "d02efb45-d12d-42e3-9a92-3ffcd7772bc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4887d2-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "66ffe4ee-ba07-4991-917b-24cd1e24c9ab", "comment": "Malware payload (Mirai)", "value": "5d2b75df63c35e68d31991d950fb0a7b", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "ef649b41-bfca-4606-b64d-1aed553052c6", "comment": "Malware payload (Mirai)", "value": "46563af0c01e06ee2888a0d0c910a8e80d4eec3bebbfb72189780e1d71030032", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "e8b51b87-b085-446c-bb53-db1057ba7a17", "value": "T1C8831856B8819B11C5D112BAFE1E128E33131B7CE3DE73129E246F2467CB96B0E7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "db6fe536-e707-444b-bc52-3c393a4eaf79", "value": "1536:uhn3bY/w+g8AfRN35NFOTacdw9xaU+jbdbQFMEi/3l5wpt87Un5KYSf:uY/7g8A/bFiZw9xaUm3zwpt8onEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678229, "uuid": "24471b99-1a5b-4216-a2fd-59166ed8dd81", "value": 84540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "b0157c3a-3ef1-4c0f-a7d6-8f775d72151b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4a37c4-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "c2d2591d-99c7-4b10-af08-430366e5f596", "comment": "Malware payload (Gafgyt)", "value": "640b2e8fcaca3c1f291d6e47590c7d04", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "f6d0d174-10b5-4910-866b-6e8c00cca084", "comment": "Malware payload (Gafgyt)", "value": "c196ca51524cc3693225ddc26b094f1b556c32fb34fa27180e95fd4927233b08", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "31d3a299-48cd-4a64-9c71-fb7680e441d2", "value": "T167A34B57671D0B43C15B5AF12CB733F18799FE7116E22280A40EBF841F72AB42526F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "2b48c22f-519c-4c53-8f0e-bfe1c01c06a9", "value": "3072:WSgto8dDMgpPZ9N5mD5hnQNYkNUZ09DRDWQfgm:WSIdDMU65hnQ2kNUZ09DRDWQfgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678229, "uuid": "fef8777e-b241-48ff-a90a-2c77fda4e028", "value": 104892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "64d06426-7907-40aa-92ca-c8a60403f502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef610bdb-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "d475efa1-b766-489c-b4e5-0471847f5e98", "comment": "Malware payload (Mirai)", "value": "5b9c456ac769ceb5c903b330eaeda743", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678229, "uuid": "06a25ac9-596f-477b-bda7-543a1444df91", "comment": "Malware payload (Mirai)", "value": "3a885751239f10096f0fe92fea8d3b74621c678b448b5e609a782c902c2c4069", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "8478a4e0-fd6d-41b8-ac14-3b1af82d53f8", "value": "T197A3D60AAB614FFBDC6FDD3706A9070535CC554B22B93B363534D928B64B24B4AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "bc407c30-fd1a-465e-bfde-4a8eb935b2da", "value": "1536:Xw3EOX+zsbkTCgDUt4J2I8Izcio2Zep933tOF8IQQGW1:X6EOuzPMI8Io20YuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678229, "uuid": "e500db45-a689-4026-ba66-3d1bc3fd73a7", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678229, "uuid": "63188828-ee6f-4bfd-917a-3f92a462cd9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6ebb30-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "1c1a0e92-8bf0-4149-8486-56c113bc5f77", "comment": "Malware payload (Gafgyt)", "value": "ee89a4b1ff3ae1ce333eed8d011531ca", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "e5b3704e-12b4-4cff-be2f-65a8d447b517", "comment": "Malware payload (Gafgyt)", "value": "f8898325fb042231998e7ccfef2b6b81be3d03655cc4e09cc15ca17792664564", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "559c7a98-6adc-4ed2-8ceb-9f2e61496f24", "value": "T19CA38D1B6651C5FBC08346B62BDFA6515823F83A0B32710673D5BCA83F22DC95E6EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "4396d561-8565-45c8-bb37-308843217e41", "value": "3072:da2n7c1XuoToHGsIvv8yF1fywyEXOvCphaCrcirqmHyVQX5A+u+cm:U2UEyF1IgphaCrciGmHyVQX5A+u+cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678230, "uuid": "ce4b5ea2-5e71-47b9-82d4-458dc5b982b4", "value": 103798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "682dc88c-086a-475c-8be2-ae1e25d22b72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6f68d3-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "44646584-f638-46ca-9cae-cb6487ed7502", "comment": "Malware payload (Gafgyt)", "value": "7cf19174983214d9bb68272b26f1ddfb", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "4ab09574-54ee-401d-b235-c046b0e55bcb", "comment": "Malware payload (Gafgyt)", "value": "f819daf33826032cc709e67f23d79f58c95843a52796df32379df7df98f4577c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "f15997cc-8090-455e-9f02-b7ad0aa1db5f", "value": "T119B30905F9404B23C6D27BBBF79A43CD77366658ABD7330166297EB02BC17982E391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "0fa3f38a-89d8-4e85-9b19-119b81a67636", "value": "3072:HqDpOulvQ+nozmICK98BRPP+Di5h8nbXJifdIUK7YHQQ/hVOmAD3m:198z++5h8nbT7YHQQ/hVOmAD3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678230, "uuid": "c63ba6bd-5fc7-4cba-82e2-3df724fe5843", "value": 117304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "7a31802c-5171-4618-8523-af47a8c8e140", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef748f11-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "40f96b01-a6e5-4b7c-9108-a8e7166a9734", "comment": "Malware payload (Mirai)", "value": "8c074c855004fce8f3c10c92dd12e0ba", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "1afa5cf7-af80-4223-8e3a-a262607c0c8d", "comment": "Malware payload (Mirai)", "value": "4f25db9c05a7486c1273a6e0a9012fae1263f15dbf5b9ef4b2fe72b58cef2210", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "f800ae0d-0ae9-4d0f-ba13-310668970bfd", "value": "T13F83A74E6E229FEDF26CC33047B74A31A76923D622E1D685E2ACD1141F7034D585FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "1c6c48e8-761d-4876-b5bd-9383f10204bd", "value": "1536:n+yzcvFm9Sm9ux9b5KBXCR8crtUResMGLIL1Dt:n+yoviBXCRRtU+Ltt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678230, "uuid": "ac9422a9-ee1c-4ff4-bd2a-c74eda3e0b51", "value": 81424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "a549d546-a48f-47b9-afe7-2f84d637c452", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef837d1f-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "a041983e-623f-4a3a-b1be-42289e1702e8", "comment": "Malware payload (Mirai)", "value": "f88e4185c56ac7ad6244097c6a414212", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "e123e9b1-f3e4-4636-92c2-4e78b353246b", "comment": "Malware payload (Mirai)", "value": "94e66eeab426aa4b2c7ae8da05dbe444d07b81a0a774e3466c89b4f486542cd4", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "8d12dae0-ed71-4433-a534-12e3bade3e73", "value": "T14B732B81BC819A13C6D1127BFB6E428D372613A8D2EF7203DD256F25378B81B0E7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "05e4b33c-5dfd-4789-b427-be40b227091f", "value": "1536:/5OEWyYb9EY2EFHie53b2gAvTmAsplMeIGjlwOEWYdYPQGFhvuq:/5ONBEYP7Rb25AplMe15Zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678230, "uuid": "597a8b3f-e019-486f-9ddb-57c6435bed22", "value": 79164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "081fb4da-a586-4120-a568-272a243d290e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef853952-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "008d3db1-e4e4-4947-ab7d-f2d02207689d", "comment": "Malware payload (Gafgyt)", "value": "67e53acdbc2a1237e264f921e36d9918", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "9591bd17-a320-4adc-af0c-a5f80575b927", "comment": "Malware payload (Gafgyt)", "value": "5dd7cfaec9e9ce8ef78cbb1bdfc22d724e10af7599944baf7f45a778feb7c7f1", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "a22bf69a-d7cd-4286-bbc3-94a67b485af2", "value": "T1A3D32906D9408B23C6D2277AF79F528E77232BA8A7DB331156286EF42FC179D1E395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "9b2ae4a0-05ac-4d99-8464-a010c62e2e04", "value": "3072:lmfoWmd6pUeQKbkDaBCKWM2HqjN+6a45hAvuq7Xm4my/QsYJ0Yj/:hDaBCKN+Q5hAGqbmy/QsYJ0Yj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678230, "uuid": "257d8fa5-a982-4588-ae02-2e1ed0e3fb87", "value": 130538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "a81af400-4ba1-489b-883b-a29f3b2eafb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef9f6617-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "fbf12996-640f-4099-b777-6e4b43522a0f", "comment": "Malware payload (Gafgyt)", "value": "98645811f2dd4254810700f517aa0662", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "f6ef10a8-2731-4aa3-abd3-9a4a9d5ca8a4", "comment": "Malware payload (Gafgyt)", "value": "178c5ed018cc340cf75ea13cdc15b8aa2e03dd38a8db64c5a8da16b7022272d5", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "b97294b4-ae81-4df7-a9f9-a6990acdc2b1", "value": "T16FD3C6176B508FB7C81FCD3706DA4601208DE55A56E87B6FB2B4C96CE78A94F09E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "d1fa98cd-f699-47bd-8ff8-7ebc1920b112", "value": "3072:4v9+aIxki8BtqEu5hsfDF3xemqY1fuBmvm:q988Dq15hsfDF3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678230, "uuid": "211c38df-6417-4850-8ea4-524c9e901c6d", "value": 137997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "9b4e0712-155a-4809-a3ff-b50f1753cf74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb1e172-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "ba0ba1eb-7420-49d0-8911-4b9afe943b73", "comment": "Malware payload (Gafgyt)", "value": "ad5e6f6486259e1739129dcaf158eabe", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "59ed1433-6fa5-4f24-8fad-1fff284c76b6", "comment": "Malware payload (Gafgyt)", "value": "a822615b1a5bea374060fbe7f754edb5ea73a9d16e623570cc1d220c5f17db47", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "e5ebd359-1497-4f10-b4b1-532ef97cce9c", "value": "T1B6B31905FC404B23C7D267BBF79A838D77366658ABD7331266296EF02BC57982E391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "d66b6c89-29f0-4303-919c-04a2f75189e0", "value": "3072:NqDpOulvQ+nozmUCK6gOdSNhWi5h89bZOhW/7MCB7HoDQHDVpZAlvm:H6gDvT5h89bZh7HoDQHDVpZAlvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678230, "uuid": "bc25ced3-3a7b-4a97-9ded-c7069b1e74eb", "value": 112662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "20bfe36b-0a99-475f-b88f-88b295d23bca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbc89f8-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "e97bee94-c9ff-4a72-97d8-66ecb31aabb6", "comment": "Malware payload (Mirai)", "value": "8a9d33a969353bc6d23d5f43d9188d1b", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678230, "uuid": "421e3c5e-a1fe-4791-818d-921a76bc1211", "comment": "Malware payload (Mirai)", "value": "5d4c15efa9afdd1a41c94f9941fc1868f99a18e69e26dffc394e1fc8adf83ad0", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "88c37b59-93c6-4a92-8d84-4c7a32702b8f", "value": "T16AA3C80E6E219FADF668C73447B74E31A79833D626E1D685E26CD6001F6034E581FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "c0a23afd-4d9b-488a-b78a-78c76b8aa3d1", "value": "1536:vLbElg/s14KXO1WFHWFEeFd7nXnWZuBjAuYle7T94mNrGWT:DbES014SOfXWZuauYrmNiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678230, "uuid": "e37c65ed-6481-43fa-aac8-271c30ca84d2", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678230, "uuid": "b44f9018-ba96-47b6-9229-bc3db6356038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d684b39-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678232, "uuid": "b9aa540b-191a-4cc8-aa2b-182acb625b6e", "comment": "Malware payload (Mirai)", "value": "3b023362e7f2e765449f13acd14c8862", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678232, "uuid": "94ccc89e-54f5-4e82-bc52-da8fdcdaa1d7", "comment": "Malware payload (Mirai)", "value": "fac1336c367ff4de8553de906943579d02fad4203b13f1e2320d9d2a3dbce2b2", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678232, "uuid": "08c28a07-8a54-48f2-b2c4-ca347db1c2a3", "value": "T104635C03B581D0FCC899C1344B6EB63AE573757D1238B27A27D4FA23AE9AD206F5D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678232, "uuid": "4ae3dd5c-4fa2-41c2-bf1f-fc77d92f2265", "value": "1536:cddqeClAv8wSnmTaP1yV6cnAIz43NfDT7zl88Fyyyyyyyyyyyyyyyy:cddqeCcumE1yVjfz43NfDTdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678232, "uuid": "a3e9f7d7-fc14-41fc-bfff-a9d3831a967a", "value": 67376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678232, "uuid": "ec6e80c6-701c-4cf1-a144-fb8edeffcc21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0d040c-21cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678232, "uuid": "adecbdbe-fdcd-44aa-8ad8-aacf1f35988f", "comment": "Malware payload (Mirai)", "value": "782f3438db423ecf0102afa82d1059d4", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678232, "uuid": "5bddfaa3-dfa7-44ad-a94b-15fc30497d35", "comment": "Malware payload (Mirai)", "value": "2e1a5de8bfb638992290a97c176243e9f8b5885f3f0c49bb8ce12e68587bdb86", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678232, "uuid": "99471b8e-09cc-4187-a425-b3a3c80faaf9", "value": "T10B833A56B9818B21C9D512BAFE1E118E3313177CE3EEB3129D206F24778B56B0E7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678232, "uuid": "383d2ed4-59b1-4cd1-abff-78627c2a7d5e", "value": "1536:stnivd4FXNO35SLb5iUDFMTjacyPKIQy7M4iDqca9uB7715vYPX:/d4DKwLFXxMTjachqca9uBn1Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678232, "uuid": "e65d382c-a9e0-4d80-baaa-62b6cd3e5c58", "value": 83252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678232, "uuid": "9b682398-6061-471b-adb9-b1f356a6259f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33345bff-21db-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678232, "uuid": "474d340e-aaae-4fbf-aa5f-c7d2c8c49d6e", "comment": "Malware payload (Mirai)", "value": "12e6be219aef0b5a20021a71f775d91e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678232, "uuid": "25872e75-bd3a-4522-8e78-80c28ec33435", "comment": "Malware payload (Mirai)", "value": "d89014f6161f9de1f96ca2e6c832896c8ecdf6a4e9488f555c1a8d7e4ccbd9f2", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678232, "uuid": "7d49d164-1087-4812-9fbf-955c1d500349", "value": "T1AF43954E5E258FEDF769C73847B78A326259338636E0C6C5E26CE6001F6024E545FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678232, "uuid": "cb4a1c7e-53d1-4ae9-af2d-7df9d4cc8d7b", "value": "768:VyFBupZClCMjcFZfEMTXSsMNRzduYA4BKu/SptTitT8OTb9S7bDfzGlFFQNS+Ryi:6qkEfzpg/SptTitT8OTb9S7CyjTN2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678232, "uuid": "d8ae95ad-805d-47e9-b8da-7288124e7d7f", "value": 56936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678232, "uuid": "62defc3d-0c00-4d3e-a18b-263548f0b8cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14aefcf-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "4fd04904-c232-41e8-9c06-90e5d322caad", "comment": "Malware payload", "value": "75cdfc88c47a03db9270ecb2ece75f21", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "34693a4f-54dd-48fb-8893-1ec00bd2925b", "comment": "Malware payload", "value": "1112076e5d41b3ca9c9e81a43b26792d6e8f5dff51fbda27db69d00d8af1115f", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "c6cdb8b6-ee0e-4eaa-8d81-57f592aa83ec", "value": "T110830946A9819F02D4D621FAFF9F414933136FB8E3EA7211D920AF5027C69DB0E776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "4d3a81fa-4dd1-4b41-bf09-7bc7a88d01e9", "value": "1536:6unWRwOsKNOIwEitsXNaaXdCFWTV9cCU9lH+ihY9I+XY7dQRO:CwODNOIviuXNa8dkWTV9chY9I+XCQRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678233, "uuid": "8dbbf35e-9e4c-4dc1-ac70-5dd577bb13cc", "value": 83672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "663a81ac-9b82-4b61-9705-8b310eb80690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14badc4-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "1cada1e6-7cb8-48ce-9078-28fe8d4e950d", "comment": "Malware payload (Mirai)", "value": "c53c0c6a6b69aceacc4605041a17853c", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "e0f95020-bc31-40b0-ba82-91a7e1606a2e", "comment": "Malware payload (Mirai)", "value": "4475cc1ed11f02f44ce9ad4353c135c2ecb5bc3f8e2a61fcb9f56cfd58a4bebf", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "0fa3ce33-ace4-4d05-84f0-195ac3a93a74", "value": "T14C637D73C8266D18C064AAF0B4B0CE7867A3B540825B4EFF655AC6799043EECF9463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "f60c47bc-f5e9-48da-a7e7-c0787ed0a4ba", "value": "1536:CPuKEtu1PUdTlKskW37mygbkgCo2MJ24gLN:CPuKKuZ0IsvJgbkg3c5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678233, "uuid": "b8e3fe62-a903-4598-a391-94fb5c8ec8a1", "value": 67228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "2a565a78-bb6a-4e30-a09a-ffd656cb611b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa63095d-21d5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "8f9cb728-33f6-49fc-88a2-cd1f81f91c9b", "comment": "Malware payload (Mirai)", "value": "df03156ec7f5d1a3e6f057228b5b9a76", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "a03258e6-c75b-44d8-b6a5-31cda4acbaee", "comment": "Malware payload (Mirai)", "value": "48435dbe00dc88d447da49eff2d7bd8964cc68b0f38bdc82e99539abc6812d37", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "9f34e134-ffff-4a2b-8899-99631cf52280", "value": "T11563E846F9419F12D4D631F9FB9E41493313BFA8E3FE7102D920AF9027869DB0E666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "a3645c1b-7968-4e11-9f0e-472139d86f3f", "value": "1536:vsn8OHD4jjsMMj12bl0js6TfYYc5NlwUiHOoIcRaeOH5:yHDSsMMR2bl0Y6TfYGtOo5aeS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678233, "uuid": "b68629b3-9af6-448e-ba69-50cf2dfb7eec", "value": 66756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "adc95106-e9cc-4652-b936-620e535fc65a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1af717b-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "df1175ed-5753-4db9-84ad-daedef025b57", "comment": "Malware payload", "value": "c8284b5f135451497214d9165a218b33", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "a0d4d938-924f-415d-8380-0e89c59bfad7", "comment": "Malware payload", "value": "b0179edf1a46c64ea616b8b737a07413750a5c6d5595cd3f86e99d60924fd147", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "c0abccb6-54b3-40a4-8318-c786f1048595", "value": "T19773C70E6E219FEDF759C33547B74A31A69833C626E0D685E26CE2011F6024E645FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "87eba324-c6d0-4a6d-a74b-63898e182c7a", "value": "1536:uBelHhpuW0U1ORLOR3UR/w7x7casCePhceK3C1:eelLuNUXxAasCePhWC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678233, "uuid": "37d48f2b-3a11-4df0-81af-57e38772442d", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "f65e652d-8696-4340-a348-59048579c222", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c80532-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "f7390ee8-84c2-4baf-b9ea-1bd8a85ba526", "comment": "Malware payload (Mirai)", "value": "981c6a4de42adc7fdb03ea666112f43d", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678233, "uuid": "e4acee21-a7b0-418d-879b-e07796cea351", "comment": "Malware payload (Mirai)", "value": "67164dd07f2333ba4ef3c4145e6340db26684114c5e8d84f9ce948cad8e7c508", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "350574a1-e9fc-47da-bd4c-01a88946e1db", "value": "T1B7635D17B48090FDC489C2745B6FB63AE573707D1238B6AA37D4FE226E9AD105F5E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "0f006026-59cc-41f9-8c31-f89594887830", "value": "1536:Oyo+UGgAP1B0LdHTCjVoszur4hOPl1VCpPE9ynxin7amsdV:OyXXP1B0LIjVoZEhw1VCpyynxiOxdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678233, "uuid": "570fd306-02e6-4b39-88f5-7ce6d00dcf78", "value": 67376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678233, "uuid": "2d98929d-02da-4a48-b7bc-a037933fb46e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e2268a-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "b4060196-97f0-4726-840d-26ec58e4cc80", "comment": "Malware payload (Mirai)", "value": "4cf7024f617a82dce57c0caaeb4ba871", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "88291aa3-27be-4159-853e-941c3ae331ae", "comment": "Malware payload (Mirai)", "value": "f5019363d1df200c2b5a054b1419fc1296af69488a76ae5b977bd36c6c050228", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "986b5752-8a1c-4734-be44-0e181d02c714", "value": "T107533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F413BCA82F1D67A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "93f32d56-f001-4d81-a773-d658b7680e8e", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyVgGhd2G4NMiplImpcvwJZY10UPZvBqJ:0aHuAzgjjfUKU0NONyVgG+7XtJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678234, "uuid": "93bdd762-5b7d-47c2-beb9-87ed4e7e3465", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "a73662b3-43c9-4172-b920-93ae6ee7f14e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e3d02b-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "b210b05f-9a51-4bc5-ba13-5023976ac540", "comment": "Malware payload (Mirai)", "value": "180669b84b6c8da030a12f6ab01dc2ce", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "c26101e8-fe59-4c16-bc95-804b4926ea69", "comment": "Malware payload (Mirai)", "value": "398e7aae27ebcc92c6ee0e18a8ba874944561f65685013fe3fbd7319ea0cb828", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "915851d1-b7be-4512-b7f3-722171eeaee1", "value": "T175434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "68b33b42-d4c0-4356-94d8-6ffc5da3da85", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmcRDj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6amqlWnU4GH+dNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678234, "uuid": "b66619c2-4a62-4d1c-9c43-48d719ed368c", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "b17e0dd8-8d0e-4e8c-ae59-9d30c70a5c18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e51446-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "e6c4642e-2eb3-426c-803d-c5f2b3f7ba8b", "comment": "Malware payload (Gafgyt)", "value": "e13a8cb1cc712693d442d1ffcc40cabc", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "7cf260f1-ddf0-46fd-a6e1-bc757fd750f0", "comment": "Malware payload (Gafgyt)", "value": "233929e664a9097e8e29d35e63742b2bbfde2a26dd22a9fa2b8dceaf4b892c68", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "1e6214fc-df89-48de-aa96-f0e4dffcac87", "value": "T190F34C09EA408B53C5E22B7AF79B428A33239B58B7D733055528ABF03FC279D5E365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "a8896f16-3cd8-46be-b637-bac745af636b", "value": "3072:kw/utadtpkeQ5u99NaaNKNplONG135ACIKora45hhlP44mM/9kk4pBImQw9B1i1Q:RNaaNKNaNG0CIKI5hhlP4RM/9kkSqmQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678234, "uuid": "b5bf83ce-46fa-4c20-8c21-4650f6fe8e33", "value": 172221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "9369045c-227d-4465-8825-de368ab146a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e6ab51-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "ca68bcfc-7b96-4ff7-a79c-9c1b5f1bb2f8", "comment": "Malware payload (Gafgyt)", "value": "8180f0d780a0ea789efde59536a8ce7e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "0b45e78e-f719-423e-b266-6943f1f4845f", "comment": "Malware payload (Gafgyt)", "value": "ac7128ad01514801751fe4e29028b61c6d4f557a1f79de18468a9115fb3b0241", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "26d3f016-aba6-4b01-8c10-c94d82ff0804", "value": "T1EBB31993F900EEA2F40EEA7605D74725B630FBA60E431A7273173966AE362D53427F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "bd1e2592-8020-46b2-bf48-adc918a3528a", "value": "3072:JpEJn4V6Hqit07bFNyj1VrJ3PS5smFZ09DRAoQfgm:JpEB4V6Htt0Pyj3J3PS5smFZ09DRAoQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678234, "uuid": "346af0db-aca1-450d-b614-d80cf8b6ed6d", "value": 110569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "23566296-3ef3-427e-8b89-e03e3750e18b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2120a62-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745678234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "162d9cf3-6f87-46e2-9911-581e4eefe76e", "comment": "Malware payload (Gafgyt)", "value": "0e5bdee91cb38b85740ed5dff7588d7e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678234, "uuid": "0f2f5fce-a755-4e2d-9464-b9b9a2da3d00", "comment": "Malware payload (Gafgyt)", "value": "538eeca2c602438079e12fbbb27c969b10990f78ff0a9cc9e063dbb52e33b011", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "bf1e9b2f-1446-4203-86e2-0b12e39bad53", "value": "T187D3A62A3E11AFFEE268863007F75F70939525D32AA19746E26CDB085F7128D1C5F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "b5a66b45-d41d-4a4d-9fda-fa8d499a0f10", "value": "3072:5GU3N+k0n4Ax+ZHPlaVWKXWMFQDDeU21y8nu2az5KoMddu5hYB3WjjLXF3xemqYK:MktKvg5hYB3oXF3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678234, "uuid": "51c9fdce-4dd8-4f82-81f2-3a819fa87e20", "value": 137997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678234, "uuid": "2ff73082-b413-4054-b1a0-1fd766da22bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb794218-22ab-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678250, "uuid": "0179c5b8-338b-4cdd-bf1f-14dca0c6370b", "comment": "Malware payload (Mirai)", "value": "8aca044141e73d7f58d8e23e16a3ca50", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678250, "uuid": "df020578-5a12-4449-867a-484303bb45c9", "comment": "Malware payload (Mirai)", "value": "e723135d3f6ddf3bd8073b413fe00c619f77b7511d3130ce7aa5f5e636885f6d", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678250, "uuid": "1e75a7b8-717e-42ae-9a08-1c8ac61f0df5", "value": "T179767C43F85055A4C6E9D2308A768253B670BC895B3163D73F60F3B86E72BD8AB793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678250, "uuid": "14e229b7-1b7e-475e-8055-fa256cebd2c1", "value": "98304:3KPV4pjF+WrIEHuXGemuCbarhMiZl3IXJlYJ:R+UOXlEarhMilYXJuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678250, "uuid": "b14d7094-33d2-431d-a515-8eb3c7979867", "value": 7288824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678250, "uuid": "c85f02b8-07d9-4a85-9fea-f553a2f034e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10064390-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "9ef41d65-da25-4a37-b4c1-83c6aa69fefa", "comment": "Malware payload", "value": "2e012a09ab2a67b8f8a0078279500765", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "c742a332-8f0e-4879-94dd-5fe4d0e9bea0", "comment": "Malware payload", "value": "4cba70db43e2da4d0e697a44868063859f8c5d68b47a6d9bdebeb53859aed241", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "074dafa0-7816-48bf-9f50-3d3c2cf5f896", "value": "T156414CD751A147F32C90D83B72AA8490F6D0A19A94DA5F466EDC3CE488BFDEC68446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "861053b8-cb15-4550-9ab9-edaad50f5384", "value": "48:vVd8j0ttQdMzYMRg7JT6JCbI+L105NbIWxXT:vVd8j0ttQdMzYMRg7JT6JCbI+B05NbIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678284, "uuid": "7a9abef0-021a-4671-9da6-4e21fa60908a", "value": 2111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "2454eed0-e123-41a0-9d05-a8be15b348f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100aa396-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "16097a93-03ef-4425-84e5-5722b633194c", "comment": "Malware payload", "value": "ccbf66fc18f7bcad98484d6388f0dd87", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "771cc690-8274-472a-b1a9-c68913df4734", "comment": "Malware payload", "value": "9ca1cf136cde36ffe3f0154c648d75a4acecf6a7e22ee9d94752d1d62dc8f359", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "8ba14600-cb34-4d36-864e-824728efcbbc", "value": "T10DC08CCF5D2225802F429D4C2423EA92B403C2C830C086080CC83A3CA0B4AA0B430E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "a023aa2a-d038-49eb-8011-10776e47a426", "value": "3:LMFFVjF9YFbFjBDKzSHX7F0QPzmVMFFVjFoYhFjBDKzSHX7F0QPw:LMFFVzobRB9LF9rmVMFFVeYhRB9LF9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678284, "uuid": "76947144-72df-4631-a056-db7b3657d479", "value": 156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "4d70be3e-f29b-4860-b0c0-0cbcafffdaf9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1014424e-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "b8520388-b57b-4f65-b4d5-980653d20dfc", "comment": "Malware payload", "value": "666afc43cfae3de609570c97580433ca", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "bee28d1f-610e-4291-a337-e9ee3e81a6f5", "comment": "Malware payload", "value": "8e8ea5c02d336749dcb706a4ddcdb46751e4a064ffbcd9e575528df364bd215f", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "5b729370-673b-4515-affa-29c8df4b49b8", "value": "T1E731A598BE92DFE26F4ADF48F033D646F043DA9320908B156CA91079CCBDD482435E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "214fd9a9-ec80-4a7d-88ab-c242fcfc2aec", "value": "48:j+ifJNnABw4RHfWCn1BxZ2k3nBbFnXuYhqJ:yihNABw4RHuC1BdFnXucqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678284, "uuid": "69a30175-1830-4056-a3d1-c867a224f3f5", "value": 1609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "5a5151f7-2c42-4990-b709-0c890888e58d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1021f510-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "9d1266e1-0c4b-41b2-b698-c65d049ad909", "comment": "Malware payload", "value": "972739fe54bc31534a7417faf376818e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "a270c61b-fe96-47c8-8ff9-8773a8dcd9af", "comment": "Malware payload", "value": "8ec1cfd65377f63a9d098552dd64509f8c935db3b459fb8235f3ace15e3ecdcc", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "89eba0f4-e4f0-45f9-b1e7-114178b4ca13", "value": "T15EE02B2ED503C0FF754488C9FEFDB9D8BA0F229A038E020CA97D411B9CE4C98A0545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "0f0f8272-a8e9-426e-a9a8-7c8beaa962b3", "value": "6:/VJqaN4f/lsGVYBY3F5kJVKE6LsVKE6NiVVNDV2uVf6vC5:/VJnwtNGg5sguThb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678284, "uuid": "c29374a4-dbc6-470b-8c1c-87c68f927e23", "value": 292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "37166d78-6406-49d6-bb46-35859b74c3a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102bb2c2-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "b0b2955b-9b3e-48a2-93f5-1db7fee3b5c3", "comment": "Malware payload", "value": "0a1075a3e6dfe4ccf892898e998c0396", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678284, "uuid": "77d53554-6511-4357-8532-ab42a43250a8", "comment": "Malware payload", "value": "4e08c8462c7bf4df1885caf3018e840f4511ef14e7c00658705f34179502bfdb", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "700ed479-2de4-4ab6-82e7-b6e452f83b38", "value": "T13531A598BE91DFB21742DF42F0328125D06BDAC914948A15BCAB507EDDBCF093835E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "7bb7f19d-068f-4507-9ef9-ea193a7c5ea4", "value": "24:GIbTt2joHzyKXK79ts20ow0FKX2D7SiI+rTvKX1DxRKI+jjSnKXw:jTtSoTyOXoFFeoTFeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678284, "uuid": "6b9d61f2-93ec-4bae-b946-351ef506b7e2", "value": 1615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678284, "uuid": "9868b186-68dd-4a67-86ab-0a0e076f016f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105a6a35-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678285, "uuid": "8bc0a8d0-7907-4be5-ac8b-60007ea761f8", "comment": "Malware payload", "value": "1910d86e67d290ccf30a63e9faede230", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678285, "uuid": "d02e6790-c46a-4f64-b849-7c7b13e1db12", "comment": "Malware payload", "value": "81b16e7eda72eaab3486c806248c949db5d7df6e501085040bbe233c4bfc2b24", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678285, "uuid": "41a8f603-beaa-4e86-adf0-3b4cecf5599d", "value": "T170C08CCF6C0012604D0258483727C831E432C0CC10C0860CFCCB383AAAA86007838E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678285, "uuid": "aa94d72f-4a47-413b-881a-fa0783dc4e7c", "value": "3:LMFPMqQpIPFYFbFjBDKzSHX7F0QYFcMFPMqQpI8JFYhFjBDKzSHX7F0QYC:LMFPeIPFobRB9LF9VMFPeIYFYhRB9LFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678285, "uuid": "5b928aaf-6bc8-4b32-ba8d-38ca7533885e", "value": 158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678285, "uuid": "d1928799-5c4f-4cb1-8ebd-6242d29cdc1f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386c9594-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678352, "uuid": "cc0caebe-2cf0-4709-9ac0-abcd40343381", "comment": "Malware payload (Mirai)", "value": "207c9e28cd4eead69a5a7c9deda87e74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678352, "uuid": "b2fb4cbb-93cc-4b9b-8bb8-bb4c43b5d362", "comment": "Malware payload (Mirai)", "value": "c6e96f26013c5d4942613cc89603dacfb052283825d5e15bd5647f20cbd2a5c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678352, "uuid": "2d927917-8fd0-4ab3-817d-1a9c994fa307", "value": "T1E2630986B9814B22C5D413BEFA2E118E3313177CE3DE73129D206F24778A96B0E779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678352, "uuid": "53426ff1-44f3-468f-8c9b-d23df79c4a5a", "value": "1536:/AnOxkwGnn32MUeRIkxD+YYpL1FadB+nzsIpib3BGAW5zE:XkD32WRItzL1FadD3BGAWRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678352, "uuid": "587422ac-de0e-43a9-8c24-90b6bfaac674", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678352, "uuid": "faa139ab-58e9-4e07-9232-dd5a49a2b7db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386d7665-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678352, "uuid": "6dfe61bb-f5ed-4714-ba32-1b06d7124ca7", "comment": "Malware payload (Mirai)", "value": "495d07031813eb14060634a51a536eb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678352, "uuid": "a0e0e745-552c-4ad7-9dc4-d55c41a7f76d", "comment": "Malware payload (Mirai)", "value": "39af9c82cff576189131478dc0270b42a80902862b1aed49c2b3c4f9ffe213d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678352, "uuid": "6c9a8c90-75ca-4217-bbc3-9bc48e72b69b", "value": "T19363B61E6E118FEDFB68C73507F78921A398338A36A1D685D16CD7105E6028E641FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678352, "uuid": "02327518-f040-46af-8c77-bb0e0a78fc41", "value": "768:qeXr/3SwGEbwC1DEsl0d5P6HVGt/reJLDhlol0ANCxa1M8kX0Hw94RyBFMPQ10yC:pls61Are5Dh6nkXg/ReTaewe5ND7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678352, "uuid": "0bded363-38b2-4266-83d2-348564987e49", "value": 68704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678352, "uuid": "4096afc8-3cce-4734-9768-7b15782ba755", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be9eb16-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678412, "uuid": "16771d8a-c478-49a0-b259-66b5d31072d4", "comment": "Malware payload (Mirai)", "value": "8c20185a2181b27654913ad04fae125b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678412, "uuid": "5b15fecb-63f9-4ad8-8e7c-10b3496eee61", "comment": "Malware payload (Mirai)", "value": "87e4e7cf5f29ff40085ec65396933727860be0faebae4e2eab1804f6f3dfe710", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678412, "uuid": "44f2baf5-6e63-4f64-acc6-fc6ff6ff0bc0", "value": "T153337D35E06A9ED4C5964134A05C8F750F13F1C893131FBB16E686B6A893DA8FA09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678412, "uuid": "1ee2e2e5-36a2-4197-b097-5d4f085cda70", "value": "768:0aRCe4Doq2eltlLrFaIfyatXwvU/FQb895GgCaoQAvCRC0Rvw:0aw6PcthXfHOc9VGgqQ/RCu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678412, "uuid": "44171466-6ad0-4832-883d-b720e9280011", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678412, "uuid": "7f7dd41a-864f-460d-b29b-c3d03278d217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9813e54e-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678512, "uuid": "bcfbf967-5bf7-4ce2-9b2e-9b042c404dfc", "comment": "Malware payload (Mirai)", "value": "d204bf5f54f3adb34bb481817c439c2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678512, "uuid": "ede25a23-256c-45a2-818b-b00967e25029", "comment": "Malware payload (Mirai)", "value": "bcde48951cbcc4a6fb0329972d7ef337c6f58e03f076f9492caca2411ccd35e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678512, "uuid": "160dadb8-579d-42d5-b362-fe0449b63f94", "value": "T138E33A46EA818B13C0D6177AF6DF424533239B64D3DB73069928AFB43F8679E0E636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678512, "uuid": "c491d8da-d0c3-48cb-8297-2852d6067ef0", "value": "3072:uqMtU0/2P6ufa6yCSeMlqbCiNrJWqjfBi/6C2M/99i1bn69z+:uqM+02iufaJCSeMlMCIWuZi/6bM/994V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678512, "uuid": "c27a23d3-7a6b-424a-91b8-3e6da3497613", "value": 157298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678512, "uuid": "10bbd3a3-1905-4e8a-b0ff-ed04d4a55f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd06654e-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678574, "uuid": "b9e34b17-85d5-42af-bb45-01d19dea531b", "comment": "Malware payload (Mirai)", "value": "8ed4d01d21cabb4978015b3061064c9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678574, "uuid": "eba15b71-8534-44cb-ace1-999a2b317314", "comment": "Malware payload (Mirai)", "value": "e620579e155db89df9cccc04428bf51741647b7701c0baa372e8bd246c1c95aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678574, "uuid": "c4d6ac30-6dd6-4006-9243-b21313647429", "value": "T179832996B8818B11C6D512BBFA1E118D3313177CE3EE72229D246F2477CB96B0E379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678574, "uuid": "76de15f0-5aa4-41fc-8e8a-5452a3d14b74", "value": "1536:A0nEuqMaFivPl338hLQRIYIPHINia5Nr74Q0MyigRfaIl1R7OV5ySiRM:EzFGpWFHI0a5SRfaIl1R6Vq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678574, "uuid": "5289a9f6-243a-4f2a-b5ee-b39a8d57d26b", "value": 83448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678574, "uuid": "6f818e86-bb2e-4d7d-8701-8a84c9e3017b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb005e54-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745678598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678598, "uuid": "bbe7a21c-e828-43e9-83af-c7a0b963a6bc", "comment": "Malware payload (CredentialFlusher)", "value": "dbb77957f58561356ed5dd97c10ba29c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678598, "uuid": "5ace61fe-1326-4f84-b73a-b767a99a8701", "comment": "Malware payload (CredentialFlusher)", "value": "afcf99661fabb10b57f7e969a942be41a35915445ac0f8f886628fb5be4a0e44", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678598, "uuid": "2a44f9b0-b81c-4c79-930f-c3528029aa7c", "value": "T1CFA52307E2ED943BD864677004E603CB0731BD901AB4666B420F9F5A19F2265FA7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678598, "uuid": "25e18a91-75ce-4f70-a37e-2c581221f091", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678598, "uuid": "814870b9-4975-49ea-b768-3069a1539f93", "value": "49152:PC75CYg7nfPkOEUbiVPL2ZXJ3qHPic76I78kLWy0YBZjeiKDqCpD:F7nfPIxPL2ZZaHPH76sWyz8i3CpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678598, "uuid": "e19f9b70-f1ed-48cd-97b6-ee8d6f4c9d44", "value": 2192384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678598, "uuid": "92490bb7-ca40-4656-aec1-066830116b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd86194-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745678603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678603, "uuid": "01f0abbf-3d13-416c-a113-4c071d804f5b", "comment": "Malware payload (Healer)", "value": "d2e73764bba81edd3f0762bed1df7179", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678603, "uuid": "3bad07ba-d78e-46b0-8e63-93488d35d7ee", "comment": "Malware payload (Healer)", "value": "d825cd17c4450ee5ac449e83e778533d8bd8bd4c21f30fb52da5638e9ff4e7c5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678603, "uuid": "9b94e65f-4a7a-4ea2-80b1-8cb69121fa7f", "value": "T17785331D8B2D8DBECA5AB7B0948FC3077F6966A1DA33C65DAA102133C503745E2B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678603, "uuid": "f28aa8b0-b128-421b-8803-bea94404eadb", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678603, "uuid": "9f1f8f3e-2d6e-44b3-a2dd-c26547ad359a", "value": "49152:Uw0RjafMGy4yI0fi+CiXAO7GzR+zT2GaCo0ehw5:m+yfi+CiXAO7mR+2GaC0ho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678603, "uuid": "4cda31b4-05eb-40ed-a518-07bad7d6511a", "value": 1839104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678603, "uuid": "88a6248e-612c-4219-a5b9-fa7632f6483b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5aa2c17-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678643, "uuid": "e1a84a60-2642-4c72-bb03-92e343580e3e", "comment": "Malware payload", "value": "d8ce0ead10acf8dadd8014c9707901f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678643, "uuid": "8df98063-6b18-4652-84b9-8a6c59af5194", "comment": "Malware payload", "value": "92f9adf0c1aa8fc56a60dac81456221ed4945480789f195cd9d2def78f3a5a52", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678643, "uuid": "0ff03bed-7d39-4478-a8ce-247bdac681fb", "value": "T18C9533947C210708C5CE003399A7B62C62DC9F86214AA157568C6DFF9DA2FAE3ED3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678643, "uuid": "38c67850-4745-4624-83e7-a65980eeb66b", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678643, "uuid": "d07d18f4-9e46-4e36-97fb-6eb8f8e190a1", "value": "49152:ZXkAzWRnBgXwmBd+ky9z77t1a/1gtBy5y:phqUStF7OdYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678643, "uuid": "0dea93cd-ce54-4cd0-b9e4-c716d302e692", "value": 1885696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678643, "uuid": "7147e6c4-3a8f-44cd-81d8-6fe56a7d60f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa79aa30-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678678, "uuid": "c2bd5939-bc79-499b-b037-3608a8ad923b", "comment": "Malware payload (Mirai)", "value": "77b74cd2b944329ee7d221ac48eae285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678678, "uuid": "f8dd9863-0c9e-4657-b22c-cc1c43187fb0", "comment": "Malware payload (Mirai)", "value": "87a01f51f57ce77f040639436da59e57d91796816e0e365b20e0386e965a527b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678678, "uuid": "a1fc0c29-9332-46a6-9e78-0f7efa090091", "value": "T1E1432BD6F801DD7CF80FD67F4463490AF270A75151830B3A63ABFE936D722A40966E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678678, "uuid": "123a0dd5-2c8b-48cd-bdce-5d7e17248c06", "value": "768:F8e0pHIIShTkyBnnH2laI8bDvzVAv/+98qZIeD3mFDjgMjIfU:iFpHwkyBnW183BAv/s8qeeD3mFDsUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678678, "uuid": "c9793184-ddf9-404d-b1cc-a7dc48f13bb6", "value": 56288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678678, "uuid": "7bd7fd24-1fb8-4fe2-9e06-5434694a40c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfbbdf3-22ac-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745678680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678680, "uuid": "07e02854-af26-48a9-bdba-9f49297b6f20", "comment": "Malware payload", "value": "589ac3fa65da391a48e4f5a1f0967b0d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678680, "uuid": "65b05542-779c-43d5-a388-743a97c0c44c", "comment": "Malware payload", "value": "2e8b35952321d2a3e9c1c4ddef7c256f89d1411313e3847b508ab9556a2adc50", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678680, "uuid": "697ba04b-2c44-4561-8aac-481ebb32f17f", "value": "T19FE57C1A239801E8DCAAD038C5566A17D775BC09033EDBEB13B0097B6F6B7E05E7A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678680, "uuid": "682e55fe-c82c-4b17-bac4-75a72b8e4dcd", "value": "62c94c0d897a2320e5bb0e760e76f216", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678680, "uuid": "97b2dd42-251c-495b-a7cf-fe5957734963", "value": "49152:A0DSSFD6UK5SVwkXV5iQMiZ8y672Mf74a9xTxmhvo690sBnY2o:jDFD1K5SHXtM39xlkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678680, "uuid": "e83917b4-6441-444d-893f-2b490de421b6", "value": 3156992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678680, "uuid": "53769cee-a898-4412-9c9f-00667f379d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ced519-22ad-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678804, "uuid": "b1cd79df-2592-4fcb-830f-2bab80cf07a4", "comment": "Malware payload (Mirai)", "value": "85d4ab58f1815c2b297368ae7e53155f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678804, "uuid": "39d817e8-50b0-4650-a48f-5aaf1a924950", "comment": "Malware payload (Mirai)", "value": "eb88100a6bb80ef11e54c1f44d07b526e7e2041b2036a986688ce23f671aba8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678804, "uuid": "b8780799-6016-4399-863b-1881039c4dd3", "value": "T1BC63F806BB550FF7DCABCD330AB9171134CD691A22F96B3A7534D82CB44B24B56E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678804, "uuid": "3fa2880d-7e69-4b31-ac6e-768b27c60b5b", "value": "768:KEz1/oJ0Y5vTAImEeUXe8vJYEubIw3u004bIDPZZ7pXiEL3e+SLIVskdIr:KEz1QJ0Y5vTAwZXNvCTtMZZ7BL3BSkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678804, "uuid": "bd7e3441-aa9f-4bc6-9692-75ea13b9dbeb", "value": 69072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678804, "uuid": "77a79fbf-6dff-4678-bb6d-8b670506f358", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed2aa33-22ad-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745678819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678819, "uuid": "055994ce-4b63-4f73-9b67-79fe0b48a30b", "comment": "Malware payload (Mirai)", "value": "82ff42a0d5c7bde7b0348d4cda65601c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745678819, "uuid": "52b5628f-bf91-4a7f-b276-3fba4cbd5bea", "comment": "Malware payload (Mirai)", "value": "b2e10a46ef6316eb49217fa73759645119c04bc042c91a60abaec0fcfa4cbd70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678819, "uuid": "aa1e0482-1e9a-4899-9149-492244ecfc10", "value": "T1FC434A57B98080FCC18DC2745B3FA636E672F07D4335B26917E8E9226E95F704E2E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678819, "uuid": "1c317a52-1e32-417a-b8d8-d9bb1e263e61", "value": "1536:K4wD2cRvuJvf7f0PLvjU+kPXiYDrNFtzd40vf35OfRh:pwD2cRvuJvzf0PLLMviYDnty0vBOfRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745678819, "uuid": "03b9d3ed-9336-4e45-9bc9-7bcb5fa5c193", "value": 59264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745678819, "uuid": "82108fd1-b22a-40d0-ac98-7be1b7148471", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cacc42-22ad-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679012, "uuid": "cfad7269-256e-4638-850f-2f3a09566efb", "comment": "Malware payload (Mirai)", "value": "a4084bb8569a699a8e16f1d6558a9d66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679012, "uuid": "b1f2d4cc-e315-48fb-9436-fa85e146f47b", "comment": "Malware payload (Mirai)", "value": "43ca6623db7575409188dcc8eed1e4b0621941db05041529db59e100e63caa24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679012, "uuid": "77fcf1ee-6400-4dbe-9409-ee4127baaf20", "value": "T15C238D77C929AE88C1498674B8354F741B63E049D2A31FFF1A99C2698087DBCF6053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679012, "uuid": "a70b3343-13fe-4d59-9fc3-bdcab3a2ea1c", "value": "768:+aRwt9bwXmQceyEm0U1BL1mqIHuUaJC42lKxYY4EaR1o8cFwuC7+QtJfrJzPI:+aRwt9icFo4Bp7mu/uKxYY4XA8ruC7Bh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679012, "uuid": "44a632f2-bfe4-4f70-b4d9-28dcdb923005", "value": 46528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679012, "uuid": "f2c4179d-e0a3-455d-a9d5-778109ef42b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d255d01e-22ad-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679040, "uuid": "0949992b-84af-4d13-9815-92bdd6676d6a", "comment": "Malware payload (Mirai)", "value": "b73f9e665a3f1f8b2c70941a36dbbbf4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679040, "uuid": "4e0af98f-62ae-4bfa-9649-a7c14b60ce48", "comment": "Malware payload (Mirai)", "value": "fde6d95afd01432ae5d5919cbeb451f1a1ebb0b0d3dfe03db130aa0505e376b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679040, "uuid": "a633b9af-3679-479f-a1db-656ebe98a881", "value": "T184733A42730C0E47D0675DB02A3F17E1C3BFA99121F4FA89651EAB8692B1E375186E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679040, "uuid": "b4b0c30c-6520-4763-a337-b205d34b2143", "value": "1536:TrMvNNEh1xHHIR2YvkG4jPIFyJIgwDskDWcWUiSilt:EpR8TcFyJIFDmBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679040, "uuid": "1dbe241d-3b1a-43cf-9fa1-3c36163f469c", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679040, "uuid": "44c2aae6-d075-4b5f-b0c9-3069c795d978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92c3c85-22ad-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679051, "uuid": "4911c44b-e649-4dea-bf90-2148b74573d3", "comment": "Malware payload (Mirai)", "value": "0b520170e6e6cf16515c46a50f8e97e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679051, "uuid": "f4435fb4-60ec-49ea-978f-07c45c7c1ea7", "comment": "Malware payload (Mirai)", "value": "2cdc995f0895fb8d83bde5083d74364cf64e43e1a37cbf0f11a541698932ed9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679051, "uuid": "6b0d01d1-a0ef-4da0-9cda-94d013a2e1bb", "value": "T1AD433917F68180FCC29AC274572AB23AE57771BE0239B2F573D4FA176E86E614E2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679051, "uuid": "32183b34-8b9a-48d9-ae94-e02621877284", "value": "1536:KxKtFALhI11z7vFQu3l+6wGAY9L8XxnPIWRzfcMr+xmGYr:XtI211neY+6rAY9ynjRzl+xmGYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679051, "uuid": "6842eead-6949-4f10-a82e-a9a3aec83994", "value": 55168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679051, "uuid": "c93f01cc-3fea-43aa-881c-850c7178ebd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178f09c2-22ae-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679156, "uuid": "17dc23a8-1c5d-49c6-974f-55c238352a44", "comment": "Malware payload (Mirai)", "value": "d40d273a2986abc519d88bbd88be5e52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679156, "uuid": "ab6678e8-734c-4b39-8cff-53bcbaf277c1", "comment": "Malware payload (Mirai)", "value": "2a345efd21831425371ee14855ad2eb2e2fd02b5dfd0bd79a199c649f875a77c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679156, "uuid": "025e5ce3-e47a-46f2-b336-23a95a33e8a8", "value": "T15A83B426FF240FF7EC9ACC378AA91745288C651A21D57B797934C828F64B25F45E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679156, "uuid": "16b65b98-f8ba-48a9-ba07-366c0311307e", "value": "1536:47WwuDTuYFk1KQ42AIwjXrfDCfzbZvnHIhd42+:4ywu/Q1KQ42dxzb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679156, "uuid": "08e5616f-3ccf-4225-9477-d4947ebc96ff", "value": 84600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679156, "uuid": "cade03bc-31a4-4ba3-bf51-6e95ef5c3a01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c272b69-22ae-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679271, "uuid": "5119e28f-9f7f-4195-9272-ce486dee07ca", "comment": "Malware payload (Mirai)", "value": "f207a8a5dc1b3ce82735154f3e73505b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679271, "uuid": "b6e6420e-9a45-4dcb-88ca-272442255bec", "comment": "Malware payload (Mirai)", "value": "378ef97f06eca53b2e0341fc6528881361473148eae609cad5f83a5dddc406b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679271, "uuid": "7bb8e7a6-d99c-4b6c-918c-78fdef9e3131", "value": "T1E5535AC1A643D8F6F82A01719137E7365A73E439113DDA87C7B9E836ED52900EB163", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679271, "uuid": "cab65b0a-c068-4c16-97bd-60bdab2f8914", "value": "1536:MOf6FP7mQT9+CgAf92NJcJjTVUbPqadvPcifVd7c/4CSQn:ff6BaQT9+EMc1TaTqIPfn7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679271, "uuid": "b37cfbc4-ac03-4ceb-91df-dae602a247c4", "value": 62772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679271, "uuid": "ec9de891-a0b2-4620-aeb7-f3e7b20120e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6491505b-22ae-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679285, "uuid": "66ffab0c-997e-4ef8-89f8-823f60cce4a0", "comment": "Malware payload (Mirai)", "value": "792c984850b22037caca90fbd63866c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679285, "uuid": "7c19860e-d2a0-4bd4-99a1-7b6027ea90a1", "comment": "Malware payload (Mirai)", "value": "aa105f8eb33b83fe36921b9c71e3b6541a8c09235b50852d38682c716e8d0b9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679285, "uuid": "79162e1d-0f9c-467f-9f51-fa0a4205ddeb", "value": "T151A3C71E6E219FBDF769833007B34A21A79833D637E1D685E19CD6001E6078E641FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679285, "uuid": "e5c91bce-3879-4311-b315-dca40165f0fe", "value": "1536:F7EnxX/ZpiIvAuZrOVgpjEW5iIO24eFyZNI4oSiWN4Z:KnxX//iwhEWAIO2ok4zNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679285, "uuid": "5388b667-8584-4342-b7c2-4ae3ece13116", "value": 98356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679285, "uuid": "6f8783e0-4970-4a39-8dae-785e4981e439", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920c8fbb-22ae-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679361, "uuid": "9ec4a8f4-5bb6-4a03-a70d-684f914c28eb", "comment": "Malware payload (Mirai)", "value": "de1a1428a8c411660106ec570b97e25d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679361, "uuid": "dc590a9d-4ca9-42a7-a008-fd3d6ba4de7b", "comment": "Malware payload (Mirai)", "value": "40a3c986067f98f7f02aeb0099e0414b06d28213f2992bc78bae7275f3510235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679361, "uuid": "2c2312c2-d6c2-4574-8b69-3ab1f13ba641", "value": "T188D32B46E7404A13C4D6277AB6EF42453323AB6497DB73059928BFF43F8679E0E236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679361, "uuid": "76854715-afa1-458b-bdbe-6b4fd3af3d5f", "value": "3072:1QoLGpOWGmaqQj2KlNAER1JOLql7/huZM/9u/q3p:1QoLG8/maqQj2KsE0W7/hoM/9u/qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679361, "uuid": "b7389e12-e3bf-40cc-92dd-09ebdff6907b", "value": 137335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679361, "uuid": "d1ab3e8a-dff3-47d1-beba-27e634ecf5bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31d376b-20fb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679365, "uuid": "6d59c13f-e17b-4680-8132-f6e5b81429ef", "comment": "Malware payload (Mirai)", "value": "4cad4d7483f7f88cfc3c336041bf0fb9", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679365, "uuid": "fa1c150b-323b-48a3-a455-9ed09944fb66", "comment": "Malware payload (Mirai)", "value": "95c5f6787c366ef1fb048efc9a4352e3d2733158431f1070cecd8ee62b626f7e", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679365, "uuid": "c57ed2eb-bc52-4441-b81e-d57d876fd28b", "value": "T198935CC5F683D4F6EA5705B15137A7329733E43A602AEF42C329AD36DC62910DA1B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679365, "uuid": "5e5c2afa-2be2-49f2-8b00-330f8125a70c", "value": "1536:WWmseUZNsbbI+ge96KUXUouggIyB2PRf1SwRXXr:VOUZcbIVM5qUHgSBu8wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679365, "uuid": "c79a3008-0d11-4e61-862a-8407884e8874", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679365, "uuid": "458123ff-7940-4514-81e7-3263441f2f20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b344d81d-20fb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679365, "uuid": "9e60ca0c-5298-4787-a540-ff229d250e1f", "comment": "Malware payload (Mirai)", "value": "e99a0542ac57bb7562870287691e21c0", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679365, "uuid": "1af0128c-60f1-41ef-beb1-0c9087ea4163", "comment": "Malware payload (Mirai)", "value": "b581a154c7c9c6cd741146335ccb89e0e58ff0853ca2ee950bad95679cbf0ee9", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679365, "uuid": "4adede08-a814-4707-a9a5-36a9aa07a360", "value": "T11F04C80AAF560FBBDCAFDD3706E9070135CCA50722A53B753674D528F54A90B4AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679365, "uuid": "c6daa7f1-1fe4-4050-a45b-a9c6b437a1f3", "value": "3072:Ty3lPiy+z7HQdFD6d7vAW1DL+vsu2uftZ:Ty3My+zAFD6ZnRSkRut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679365, "uuid": "4ef2c073-4b53-4402-ab41-b050d30db936", "value": 173700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679365, "uuid": "dc276320-03de-4e79-96a0-14320256a931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3278c43-20fb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679366, "uuid": "e8567d1b-5b9b-40de-9e57-c9e1d12db45d", "comment": "Malware payload (Mirai)", "value": "368660c826003485fa0016f340e506a0", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679366, "uuid": "235b3721-e529-4494-9019-fed992d7a342", "comment": "Malware payload (Mirai)", "value": "cdb67d650692c6ca92fd916f9185eed7ecbe697c5ce7e7281d69193bf78568b3", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "13b7abbb-07bc-4f76-9215-3519395f3d46", "value": "T139D32A06B30C0D47D2632EF43B3B67E1D3EF9A8121E4F640655FAA899271E321586E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "5f93f9e7-8bdc-460d-a851-a9d723b0671e", "value": "1536:T+pzqUXe5ZHtxBVvZzpZqxucJ+w6CfDDowpMvA8vBEVYhLAMsZqKCdYoz:TPZHtxDRF04cN6GDpx8goz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679366, "uuid": "ce442a3f-15d2-4be3-a113-d1ec74e8bf33", "value": 133636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "fa935ee4-5ab0-4bb3-9d4b-653f4c2ddaee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16176e2e-20de-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679366, "uuid": "fd79c2aa-a8c1-47d4-bd89-7ab308788425", "comment": "Malware payload (Mirai)", "value": "029a6aa73a2b93911eafad7a61573561", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679366, "uuid": "8acf3460-e775-47df-ba52-15991312d512", "comment": "Malware payload (Mirai)", "value": "ad5545dd5d11b840a9283904da705708f4af037e5830d9357a033bce08f172b3", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "3ba087b5-287f-4786-a70c-b681212a832a", "value": "T148042A46EA404B13C09627BAFA9F42453323DB58D7EB73059528AFB43F8779E4F225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "1b8173ba-dca9-4838-ab04-ed9ced7885d5", "value": "3072:pfs9sBn0yiKjlzaZAQimt6pbvmA1gGtK+XPSorM/RzXCptk:pfbn0B2NaZAQimtkSAqGtK+fTrM/RuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679366, "uuid": "3d43596c-75f2-4180-bdbe-e01ede7001b2", "value": 180479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "bc4e945a-6300-4e33-86f4-195dd73820da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160dcb33-20de-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679366, "uuid": "3c0c143e-20de-4e75-9fa7-c2ae84ff4d04", "comment": "Malware payload (Mirai)", "value": "6ff889a784e90903a40f0501c7f6274c", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679366, "uuid": "9fc94b6b-9175-454c-b904-d940ed5b8d4b", "comment": "Malware payload (Mirai)", "value": "bd0a87a41d34faa2ac1ac95d2da225c14cd1f13c87d610ff76142edb87ee19d0", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "52dec341-d5da-4275-bc23-e6cf6cd70e90", "value": "T189042A0B75C1C4FDC8D9C1744BAEB23BDA73B4291225B29B67D4AE225E4DE305F2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "425c7a8c-9e05-4621-ac18-422413e8840f", "value": "1536:fXwGUHO8voCHJwLSLA//uymm2MrHO4poQkfr0qbB8E75NRHsbJwj63e3XJMBs27i:fA1HtvoC4QvymapBkfr0qhRMOj6JRF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679366, "uuid": "679177f6-3b54-4a38-82ab-d119a5281988", "value": 186456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "e3ff72df-88f2-4a68-9363-5f902bbe360d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160dffb2-20de-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679366, "uuid": "717f51ac-e51e-4d0f-8c2e-c76bb215be65", "comment": "Malware payload (Mirai)", "value": "6d51c93637fc70ff63b82ed59e9f8ebe", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679366, "uuid": "27fe2719-fff2-4684-80b3-d8ac761cfcfd", "comment": "Malware payload (Mirai)", "value": "8901880a311752e5fbd35d4b4d49b3688c7ac11b8d1daac136ce521442aa43bd", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "5367fcdd-70a7-43b4-837e-c7e3d89b71f8", "value": "T1F3C3F845FC515B53C6C612BBFB5E428D7B2A17A8D3EE72039A256F20378785B0E3B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "b50479c5-8571-4fba-b958-5ce3970e834c", "value": "3072:nBg/DFIy4C6D6VC0uvNKaNvHEpNVoWNV:nBgLGy4Cw6VC0uvNH1EpNVoWNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679366, "uuid": "3d0a215b-8930-487c-a178-55554f379b71", "value": 129420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679366, "uuid": "a24b74b1-0128-4238-9e60-ddcdaea24f3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160dbb12-20de-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679367, "uuid": "d807c4a8-ea46-4f5d-ba63-cf5488f5ff80", "comment": "Malware payload (Mirai)", "value": "4475adf922e863c8d0429216ffcf9a6e", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679367, "uuid": "f193d971-d21f-4ff7-95f0-f953a95fcdb0", "comment": "Malware payload (Mirai)", "value": "d4513eec03a905618779d8b8c3a64fb74c64fb5b482e2f7753c8028dc3411163", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "03095cdd-0351-4a2c-bbcc-c0b12825fad3", "value": "T158D3F856F8819B11D5C151BAFE1E124E37231B7CE2DE72029D246B747B8B8BB0E3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "5a7c88d9-81be-4d35-9cf4-c6ad3121d271", "value": "3072:+iqz4USmy0oXegFOr62a08bUET0WynflCtxVZsNo:+iZdyoX/Fcta4vWytYxV2No", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679367, "uuid": "f8399fea-4e0b-450b-b9d2-40d22c243f2e", "value": 141776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "a42de5a2-b803-4e5a-a193-aaeeb1e8f808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34ac328-20fb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679367, "uuid": "ee360fef-72b0-416f-8440-a8da6cc090fd", "comment": "Malware payload (Mirai)", "value": "6596f38e0bc4c6fba048a44548c09dfc", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679367, "uuid": "677b87d1-3ebc-480e-8ad9-7ef95028e98a", "comment": "Malware payload (Mirai)", "value": "3985b967edfd76e2183023fbf6364ddc97aa1b425056f1d9b342b3ffb125c8d6", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "a446ba0c-946d-46b7-bd4d-ac9156c19194", "value": "T1F8A37D89E283DCF2E81604B1513793779B72D43B603AEE86C32DDD75E896900963B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "ddeb4c01-7188-475b-890d-e5f564aef4bd", "value": "1536:zlp3ZUevQgEHBp2LKpJBjWt2+po+jFX9TYIt50Sgfnve1iJX:zlp3ZUYQgET2LKpJFR+posFtTXhRMJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679367, "uuid": "907fa164-d520-4a99-bf40-5bdd6e077eaf", "value": 104396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "939f0ef8-92d2-401b-b92d-b53df3fae8d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1617ae35-20de-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679367, "uuid": "766b6c91-ca02-443c-82d8-38d4ac309eef", "comment": "Malware payload (Mirai)", "value": "ae9dcf36bd3d0237f6cd518f2d4895cd", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679367, "uuid": "c0ad5b9f-a629-4a55-8ee0-fcfaa001dd3b", "comment": "Malware payload (Mirai)", "value": "9a3a6949bfc0682dc83a4e62493490cc1da075b437cd3683ed62d2485334e9c7", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "da831514-ffce-4990-9eb5-a01e7e82017f", "value": "T1FCB34873CC29AE5CC668D5B4B0B18FB82B53A961814B1FBE15A6C2749043ECDF6453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "f2ad1c02-9b71-4a30-b66f-fb820d77441a", "value": "1536:ejKvZA12b3jrECx9KaVSF7QAqtyKUcCW+brXjHkDNNUf:eGg2/rEEkakKtpRCWiXjH+gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679367, "uuid": "f3f1d370-60e7-4ff9-b16c-d05bae1483d2", "value": 117164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "e402e1ef-8694-4d6c-92d5-397e8b406e1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160d5bf8-20de-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679367, "uuid": "cac0efb7-2a40-430b-a8ff-badd9a7f8401", "comment": "Malware payload (Mirai)", "value": "0f74149f48039bfc0279a8f161f5dc40", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679367, "uuid": "1b491460-f110-4db9-9460-bb9b73fc784d", "comment": "Malware payload (Mirai)", "value": "4a1d31ec9168bde507f91d1c0c027ef551b1c75c07b52435605a53d65e21df22", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "d3cbe0d8-b099-4d06-994f-f34fddff85d0", "value": "T12B04981E6E228FADF668873547F74A31A75D23D622E1D684D1ACC1106F2039E641FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "64311af1-8a77-422f-a468-e065d8f0615b", "value": "3072:vKqY/KL8THS6f+++e3eLgEfjYFtsG5VPk:vKqYi6+6EfKtsyVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679367, "uuid": "2bf71ba2-8c05-485a-95e1-795b7c7363d5", "value": 173316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679367, "uuid": "9a92849e-d9f3-47c0-871d-8e844325f615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b347fbc9-20fb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679368, "uuid": "5e52e82a-5305-463c-a9d0-8d7e8c086754", "comment": "Malware payload (Mirai)", "value": "95b3fdf56abf0d8f77b17bd05fe68639", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679368, "uuid": "c33db581-393c-4f10-bd67-66b9b83c1458", "comment": "Malware payload (Mirai)", "value": "a66018fc0b9dcd25613b5bf7f9a5a110202f40f319a17a0ea60b4255165a7ad8", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679368, "uuid": "5e72445c-1c21-4b01-92fb-022c75ad007e", "value": "T144E318C7F800DDFAF80AE73748530906B130BBA249925B376257356FED3A1990577E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679368, "uuid": "75454ba3-144b-4c38-8981-49476453ee6f", "value": "3072:BQ5uZC5bdyUR22z8knnuajh1FjVEjbisLjr0ipQIytc4b:vJU02gkH11F0Ljr9ytZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679368, "uuid": "fa579690-14bc-4857-9d8f-9191de1d3931", "value": 150892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679368, "uuid": "be3364f9-2bea-48a2-8675-f0e00b3c30cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964cfa5a-22ae-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679368, "uuid": "dae6575a-371e-4908-8e5c-db5fc556c9dd", "comment": "Malware payload (Mirai)", "value": "85361ed5ef4094aacc19123acfa35ae9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679368, "uuid": "3e0411ee-c479-4b7f-bf3a-9ceb005c3698", "comment": "Malware payload (Mirai)", "value": "6a02c33a0325a2b95e8f09e13e843bad152076ac08abdfaa77491ae03ca844e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679368, "uuid": "35d103cf-3450-4983-b561-4d821ef663fd", "value": "T164432921B63A1F17C0D4A47D21FA4B19B2B25ADE25A4C64E7D720F4FFF11A406A42D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679368, "uuid": "26d14785-000c-499e-9fc9-2063ee6a7052", "value": "768:UKoz/gv0JVowS/ngeAZTWUW43Zq6ISnkyTFOlQ/SwX++KdhO+LBUwR:UKW/gv0Jan/gvJWUW43Zq6RkyTFO3RrR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679368, "uuid": "c25a0e37-d9c8-48c3-b70e-a4a0d319faf5", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679368, "uuid": "967a143c-5c3d-4aac-9950-3e07a7a63a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153995dd-20de-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679425, "uuid": "ee15bb1b-3e73-438c-900d-297db14f1596", "comment": "Malware payload (Mirai)", "value": "8fd63a8aa793bd24d6690d7deee8c49b", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679425, "uuid": "f3d528f0-cdf3-4534-b198-e38d7b57092c", "comment": "Malware payload (Mirai)", "value": "f75e2ca9f1df6579aad4dffc021ea152ad18d7a85225035f12a7acba4e3ffec2", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679425, "uuid": "4bf493eb-d056-4c7e-9a69-0e020a18ec68", "value": "T123C2F996BCD29657C2D1537ABB6F478C339277A8C2CF3713E80427103A86A4F8D62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679425, "uuid": "8b5fbfe8-e2b4-40b6-a34d-75c57bec9d38", "value": "384:pJLwvKQKgXBIEEsoFDQCu48tG5rtl66jclxfIgcKbFJqbWp3aLfyb5qTLopW6v6S:pdnHcIEboFBEG5rtl6hbCbbzTLop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679425, "uuid": "827c9b32-fa7b-49e4-baeb-92c0a055f5e8", "value": 26492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679425, "uuid": "5ab6f686-905f-421f-86ad-3041652c99a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e768cb-20fb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679426, "uuid": "28811009-e9f7-4fb9-93ce-0d5f5900ad57", "comment": "Malware payload (Mirai)", "value": "28139da5172d0dca0196ce8cf567ff1b", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679426, "uuid": "0b46c030-8d8e-42ad-a914-919e55311f9a", "comment": "Malware payload (Mirai)", "value": "ccdaa817f8024c1c9dfd15d4f9657fcdb999385dd8be1e9d819e55c4cf37ab80", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679426, "uuid": "b9e5c886-5d1a-4adb-a0d4-029dc77bd387", "value": "T15AB09BCA10215754696746781356C60482D1816A10511F1D6CCD42A518465181526E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679426, "uuid": "06210309-e33f-4026-add9-e20b5269990e", "value": "3:hPUmiqLGle5LGleFSeMhnq70ia3zSDaLzRLn:1iqMe5MeEFRq7za3qA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679426, "uuid": "89b28896-6fe2-4b92-9373-e441e3ca7a96", "value": 121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679426, "uuid": "5bd58f28-ea07-4126-b97e-657cc5326392", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e35f09-20fb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679427, "uuid": "32ce1305-5d94-4896-9d6c-fea655d38e0b", "comment": "Malware payload (Mirai)", "value": "556f03dacbca79a48a68d9ac2c1264d0", "object_relation": "md5", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679427, "uuid": "92b1ed7d-5a7c-41d2-9057-6d18a6041857", "comment": "Malware payload (Mirai)", "value": "0df55cf208409ad731139351cea1ca22a003fbad4092d9ba514529206f2642b2", "object_relation": "sha256", "Tag": [ { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679427, "uuid": "fe5ccd0d-00cb-46ef-bfcd-366d600ef629", "value": "T15201E1CE2166D6C21F0E8E1CF26A979CEA42EAC271708F21F01598F668EC5006568F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679427, "uuid": "99c0e716-da02-4dff-bb97-5d646b034213", "value": "24:3J34RhDKFNI7MNKhBtBo71RyZbwhtoqqR:WRhDKwMNaJo71IZ0htoqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679427, "uuid": "1171ad65-70dc-4a07-8289-4bbfb8be5b9d", "value": 793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679427, "uuid": "5b7254f7-abb8-49f1-b9f5-ebb30bed4283", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c649da44-22ae-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679449, "uuid": "544b96d6-4c9b-4f1f-9fd3-57724bd32c25", "comment": "Malware payload (Mirai)", "value": "ded8019adb16e67ac419b14182b842d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679449, "uuid": "177ea142-3507-4214-bf71-ccd6fbd3e69b", "comment": "Malware payload (Mirai)", "value": "a1c298eafad1b7af5dd4cfeb28b2d68cbcc38cb259fb65cef43a6afc1dd59949", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679449, "uuid": "e601553d-10cc-4465-90e7-612d7249dfb1", "value": "T17E83D90A2E258F7CFB5A833587F78A209748339626E1C549E15CFE025E7434E741BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679449, "uuid": "d77559c4-3b01-43d7-ba80-442ce722c95c", "value": "1536:0jZuX/TKBu5zX6Fke/HXViC4bEf74Alh5pU60p8nBCdEjrQ6DWWkIVmid42+s:KurKBBFkaH07EfU6c2CdEjrQ6iTIgWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679449, "uuid": "0ee568ba-fc31-4711-bb13-f6f8cb51b74c", "value": 84088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679449, "uuid": "9d6d494f-4966-4f57-902b-f503f2585458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe8a10f-22ae-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745679465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679465, "uuid": "6fed88f0-cb7f-446e-abe0-b2acb00ec8e0", "comment": "Malware payload (CredentialFlusher)", "value": "3d5cfd0c719ad194d57f658a4e2ec658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679465, "uuid": "d685087f-97ce-40f4-a02d-349dea3a6d28", "comment": "Malware payload (CredentialFlusher)", "value": "e1bca143c38c9f350cd888c543a69986d406f541d93b2070eb114ce892fa4061", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679465, "uuid": "494a3015-854a-475a-982c-9948f29f9040", "value": "T10C25AE0273D1C062FF9B92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679465, "uuid": "60fe9103-6262-447b-a753-109baa4bc3ce", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679465, "uuid": "cbf586ee-eee5-4cab-b5d8-98ca20f9d1ca", "value": "24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8aE8+NZ:ZTvC/MTQYxsWR7aEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679465, "uuid": "4ba0d112-1398-4d6c-8404-f9aaf1175cc3", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679465, "uuid": "0df88d79-671f-4b5d-8acf-38fb01112ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3284654-22ae-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679524, "uuid": "5ab8e771-e9c5-4744-96eb-a49d535172be", "comment": "Malware payload (Mirai)", "value": "6ef70dcce8c16ecefbeabe73b5983913", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679524, "uuid": "6af6b382-daa0-4243-b16c-36008261cc39", "comment": "Malware payload (Mirai)", "value": "97d63fd4508f50be0076872af932616127904d16657deccdc26fc1e470a383d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679524, "uuid": "581e6a95-5cc6-4e34-a57a-839d525ab771", "value": "T169A3D706FB550FFBDCAFCD374AE9070525CC690A12A93B367574D828B64B24B0AE3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679524, "uuid": "8e18175e-ba14-430b-9485-e29667a9f0d7", "value": "1536:kCTVNyBDWY+q3KbvE4v3pN7LJGlRVmxg+EgCAKZ61TcXyZ6Zn62r1g4Siu:k0VNyBjtlHmx9QAKustgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679524, "uuid": "43d5c74a-0c96-49ba-83e9-f75c04e7ab8b", "value": 101476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679524, "uuid": "03ebb488-1091-43fd-97ee-6e7e835c594e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18dbe717-22af-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745679588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679588, "uuid": "8cb32c15-1339-493c-825b-6979bcc7a94b", "comment": "Malware payload", "value": "634e1752ebfef58cbe63d3fe127f61fb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679588, "uuid": "8e6ec63d-04f8-435e-9edc-5cb80979a76a", "comment": "Malware payload", "value": "dd5974ff18f91f2bb63bab7389d5acb9285433bc18f61f5e06f5d02eef85b16c", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679588, "uuid": "4c592b95-3329-458f-ab21-09128f481fa2", "value": "T1A09533079CFE2ADCF4804AF4C3FB6BA8E995475849629B50126165BDC331BE3FE8C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679588, "uuid": "701072e1-9cbe-428f-81e6-56b00fa30ea5", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679588, "uuid": "e3410f0d-3518-44f4-af9e-09cb6ec052c0", "value": "49152:N5/elYejr0EJtNgsqI1YY+2rLBlYXAJg96K2:N5/SF0Kt1XYaWWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679588, "uuid": "b8156ba2-05ff-4471-a4e3-f327711cc103", "value": 1894400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679588, "uuid": "87b6fabd-8693-4c3e-a3a1-fc41638cd2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364d38ff-22af-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679637, "uuid": "148d1d1c-cae1-42b0-a0ba-9637c583420d", "comment": "Malware payload (Mirai)", "value": "d90d82fb949069dac253a2d8115382d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679637, "uuid": "37d6f62f-4ea1-4ca7-822f-bb30cd00cca2", "comment": "Malware payload (Mirai)", "value": "0d5ce0f399b82198d6615b9bf0a9504dce5d48e08e5206e8e362ddc99ba8d9bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679637, "uuid": "164e612f-bc29-4476-81e3-a29cee3ccf48", "value": "T180333B01731C0A47D5676AB42A3F17E093BFE99120E4F688250F9B9AA271E3645C6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679637, "uuid": "0c7c8daa-c6c5-47b6-bb15-3a2ccec39c97", "value": "768:2H4GDlIExeRqrURJM2CumdEVAAkxT9rB4zLZLK5s9cW4Fw+t/mcxIu5:27lBEDYbumeyB/rCzQ5s9v9+Zmcx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679637, "uuid": "24567f69-ffa4-4f21-a5eb-e1f4423ad79d", "value": 51736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679637, "uuid": "91e3bc0e-8f25-4277-9792-7d10a5120616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b49e929-22af-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679779, "uuid": "b2fff9f5-f88f-4c96-ab92-6630baa811e5", "comment": "Malware payload (Mirai)", "value": "8b86bec0000259458eacaa59b9efbb2f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679779, "uuid": "41edafed-df7d-4e9a-a4f1-95dde0d2f332", "comment": "Malware payload (Mirai)", "value": "6889e7dea81f16c81c47d593b49bf94f415f06bca70ffd93c0efb7ddf3619708", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679779, "uuid": "31a6c5cd-8d8a-40ea-aedc-e48c0601d554", "value": "T186735B17758080FCC29DC178576EA63BF6B3B17E1235B26D17E0ED222E99E205E2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679779, "uuid": "819a4ada-cc9c-4cc9-8070-361588240015", "value": "1536:KCy7rRwCMo01sMQ85CJiLBwIbuT48nFwVzMNAhwknl67mBnFkbrP:/y3RwCMZ1sMpKwBwIbkFweNAhD67mBF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679779, "uuid": "74f6bb65-27a2-464d-8a1f-04a3fdc1db0e", "value": 75920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679779, "uuid": "13d3a600-f6ec-49ad-ab3b-634f500b9d5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7925dfa-22af-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679854, "uuid": "01f90db6-5703-4f02-93ac-e8a4126c7285", "comment": "Malware payload (Mirai)", "value": "77dfb48c851a4fec21f959fda9d27259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679854, "uuid": "3baaab8a-b592-4c91-8cba-b02c514884b6", "comment": "Malware payload (Mirai)", "value": "860f0deb58287ad3343bad5099f924d4c89cf9ff36746f6a890c665208c5a0a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679854, "uuid": "8ad048c6-def6-4d8a-81a5-d29948f29da9", "value": "T1E2C2D19DA7D89D4BCDEE0C3E12C981AA5E44A1C0B39F3F54DB224CE29D3974AB54E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679854, "uuid": "688dd7c8-49bd-4526-b4fc-9fdb1e2eb99b", "value": "768:fCzVzNvrO4hrH9XcpaWojaaRJ49G/DXWl:fCzh1rO4dHRxEaRd/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679854, "uuid": "d7abae3d-4a6a-4715-94a4-16c8f6c10032", "value": 26988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679854, "uuid": "4ca7501b-1905-43f9-a6be-20dfef3dd616", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c5ef60-22af-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679854, "uuid": "95a3ed84-db1f-4ee3-b514-e2a681017e1c", "comment": "Malware payload (Mirai)", "value": "9b7cbcecc4e9c2dafb0256077bd1f586", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679854, "uuid": "ae43df20-98e8-4399-a095-d156d98317f7", "comment": "Malware payload (Mirai)", "value": "d872d23e758e35024b3a4e0f37a4cd1db29e8293ff4c3ac4ec7e3fe097e3d4e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679854, "uuid": "ca866b79-b144-442b-8b83-ae7e71863761", "value": "T12D639DA3C9396E98D1A991F0B4349F745F23A11082A71FFB0E55C1799087EACF6463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679854, "uuid": "7b71f5e1-c3b3-4004-b99b-f2d8093bfaae", "value": "1536:VatwtVAbFF/lAKfLOGp2KR58flmEuiCXMLeWPASiM:Vqhbn/ltTOGnRGmEuipikb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679854, "uuid": "03742605-e71b-46b8-94af-1584f6183edc", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679854, "uuid": "3d076d09-ba76-4b46-9b1f-cb2d94224d46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cece827d-22af-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745679893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679893, "uuid": "5028e4bb-9f1e-486e-b537-501cc5d350ac", "comment": "Malware payload (Mirai)", "value": "8121129d53f3331f2a4b89cd625425c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745679893, "uuid": "fdc7af99-3dcc-48b3-ae14-429321efb2a8", "comment": "Malware payload (Mirai)", "value": "009bec26896a428431dd64f13a5bde7f21e0280fa8e12c1e19f3c61d44399318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679893, "uuid": "c52d488d-7e19-4fb5-bc20-ea8446f69240", "value": "T116833BD7F400DD7DFC0ED77B4453490AB671A3A256831B3A2367B963AD321B44926F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679893, "uuid": "90bca0f8-51e8-4a19-b9a2-b6b3b6b53349", "value": "1536:b1zJjqi4pM8f8xiQ8Mypxkc9nCZ9Sg4TT7bpHvxylkU8CF:ZzJm1m8f8xiyypxk1ZAgGtxylvNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745679893, "uuid": "fde95218-8a54-46c2-839c-caef2a251b35", "value": 85244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745679893, "uuid": "4b49ee9b-c2b8-4365-ad40-f56943775b26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f23a378-22b0-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745680028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680028, "uuid": "1afe38c8-ee94-4dbc-b089-6ed777d6609f", "comment": "Malware payload (Amadey)", "value": "3f3d018ac405b8873195f089f6eb0a4a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680028, "uuid": "d7e81d6e-1d7b-4492-965b-be5ed7e7ee0b", "comment": "Malware payload (Amadey)", "value": "cd0008db1b3068800782bb9b5cd23017ebad600efc91182dad9d3f96a3dd33cc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680028, "uuid": "9908c4eb-8021-41c5-aa2a-b5147a2496b0", "value": "T155159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680028, "uuid": "70159c3b-4658-4f4f-8061-e35bc6ec4333", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680028, "uuid": "6979d1e7-f37d-4372-8745-2a586b64ba63", "value": "24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8aeXV:5TvC/MTQYxsWR7aeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680028, "uuid": "724a58a5-11b2-4dfd-82b5-be453acfef93", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680028, "uuid": "6174fca7-7cae-4def-a2e5-7edfa01d95bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400a774a-22b0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745680083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680083, "uuid": "772ee8ef-e32b-4f6b-8d99-a55c59ff1af3", "comment": "Malware payload (Mirai)", "value": "aa6d3819929a793b34413e998f0cd9c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680083, "uuid": "7d119a7c-2983-49af-9635-67f38deade99", "comment": "Malware payload (Mirai)", "value": "23958aaed3d0dcb28a155d850a3225a8efcde34933b93ae0e6ca706563e26e8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680083, "uuid": "648e4e11-9639-4c53-8341-ce6037514cb1", "value": "T1EC331981B9829613C6D412BBFB6E418D372617A8E2DF3307DD166F10379A92F0E776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680083, "uuid": "ec645b12-a410-4217-b633-e12bbd008cf2", "value": "768:398SGDG3qh2rey4ICxld0m0eRwhc1CAZURczMMgvzcEYanMXPhHO9vjVmqI:mSqG3o2Ad0maq+Rc0vjmXk9LEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680083, "uuid": "e5afdf99-e6da-4fe5-8fd0-7f35a1518698", "value": 54896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680083, "uuid": "5da5b3fa-4029-44fe-ace3-b1ffb9996e4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649a6a78-22b0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745680144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680144, "uuid": "f43ecf69-4fb6-4d4d-ab0e-45a60938fbb3", "comment": "Malware payload (Mirai)", "value": "ef5e31b18f73f638f083cab4a0b739ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680144, "uuid": "c03e603f-5e56-4d66-93d3-eed2792a5556", "comment": "Malware payload (Mirai)", "value": "714c4bfd21908c5a98d06d3011772e1e6919bdeb5e0dfc3da242f114d76ab47f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680144, "uuid": "5e92d5d7-71ee-41c3-821d-bb0b429a8848", "value": "T14C436C31BA361E17C4D1A8BA21F30724B2F1479E25A88A1A3D710E8EFF71A4075577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680144, "uuid": "1139c348-4850-422e-8aef-d1b96fdf3287", "value": "768:CPoKcq9VOUMwpHdQT0WFef2kMSHhyEHDO+75mT0AiR2cT1t5IVq:CPqSVBMwpHFWouklHhVX75k0Rt5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680144, "uuid": "9e3c74ad-a954-4605-b04b-8a08da966cc5", "value": 56340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680144, "uuid": "3c6b4281-dce4-4e88-8769-6df487fe919d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af8e19d-22b0-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745680155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680155, "uuid": "bfca9ec7-d4ea-482c-a99a-f96dc297a956", "comment": "Malware payload", "value": "55779473fc071e5d4f80aed9b3dd9a85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680155, "uuid": "49ac575c-79d1-4305-8e4b-5ec96654223e", "comment": "Malware payload", "value": "fffb0cb4f23a25c17e9cffd8281191caaafa2ae466bfa90e49ff308dc2a3524b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680155, "uuid": "d7aa65a1-8d57-423b-96cd-edc01bfb6650", "value": "T195A512EEB71B8E26FB004CF9E4EB11B8462660B1115D1DC8F6976EE45005BC8DDAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680155, "uuid": "7daa6c97-a7ba-48bd-9f0b-873137613704", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680155, "uuid": "00664c3e-c93b-4264-8c5e-f0d227e133fe", "value": "49152:kua673oiwQAcgWuLONIVaj23STadHObEs7R2QDM:1a63fwlWuBVamSTI+DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680155, "uuid": "cd857991-637d-44f6-a0ce-2e4b1e835cf3", "value": 2095616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680155, "uuid": "415d95d5-8757-4215-a6cf-c97a31a1b582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708dd2a9-22b0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745680164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680164, "uuid": "60c53e29-dde9-4c90-a95c-48c13eadca08", "comment": "Malware payload (Mirai)", "value": "82cedcbf94d87951457555ef0f02419e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680164, "uuid": "7978031d-aab2-4623-90b6-e7ff1bf875db", "comment": "Malware payload (Mirai)", "value": "724bfd506c66f1fa9d7464a4ce6b79b027dfae1a0c16dabc159d1404a67e029f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680164, "uuid": "32faeac9-9540-40ff-9b92-7f90888d6450", "value": "T164634A13B58190FCC29DC374476BB63AE93375BE1239F2AA37D8FA126D49E211E1E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680164, "uuid": "4b95aeb7-6b34-4738-b4de-1d0e94c3f48e", "value": "1536:GBEtqb9a7oY6uHhK0ygRZKbBqAdUFfP57atD9kuQTGJ0OGjnV:htYQsYFwERYVqAdUhPctD6TGOO+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680164, "uuid": "75198f76-1870-429b-838e-4f35a6c637e5", "value": 71824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680164, "uuid": "23661b93-a0c9-4dea-81a7-c2a1bac814cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dc3ad0-22b1-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745680604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680604, "uuid": "a4769842-6a61-4a96-9079-c6193213c5bd", "comment": "Malware payload (Mirai)", "value": "2accc7de2c64d8cdc827f01ad13fee3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680604, "uuid": "e32cc5cc-ad71-468c-979f-2ee88852664b", "comment": "Malware payload (Mirai)", "value": "1ecc53de6c6217059b06d8057286fd128136454847fa218a369462d98db8ed8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680604, "uuid": "4e0da216-585e-4cdf-8376-76294b04f897", "value": "T1F453F74178918A27C5E423BBF96E418D373563F8E1DE320ADD112F6476CA82F0DA77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680604, "uuid": "52499316-867b-44bd-8829-f93c9cefad7c", "value": "1536:6llF4vndEpu3ZYs5pa1rNlnYdjGneIt8TYNCjJTOd42+:6lK6ac1BlnIGeI9NoJT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680604, "uuid": "c5827cb4-45c0-4214-8df6-09efef36411c", "value": 66556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680604, "uuid": "8b2466f8-e3cc-49c2-8f59-f1e9db4fe474", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "defcffe1-22b1-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745680779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680779, "uuid": "d29caaa1-1032-49e4-8eb8-4e650c347149", "comment": "Malware payload", "value": "c92482f3c5e37f95c0d91820cf89441c", "object_relation": "md5", "Tag": [ { "name": "glupteba", "colour": "#89dacb", "exportable": true, "hide_tag": false }, { "name": "GOBackdoor", "colour": "#9A05D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680779, "uuid": "96f5e036-77a2-448c-9b16-20d8421fb91f", "comment": "Malware payload", "value": "b28ddd8205578cbf3a3c8f5347b2cb6967d9b0bf6b1bfb7b051b0bffbc2b5cb8", "object_relation": "sha256", "Tag": [ { "name": "glupteba", "colour": "#89dacb", "exportable": true, "hide_tag": false }, { "name": "GOBackdoor", "colour": "#9A05D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680779, "uuid": "8c3dbef4-8524-42bf-9f33-dc9ff7121941", "value": "T114E6E5B3524DD300D856F7778F2A66D3A0A7577287A74AFFB09949D0C620CD3A23A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680779, "uuid": "619d1866-b3ac-47cd-8476-83cb61fed80f", "value": "b928511264583b5ee93e0922c4262ebf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680779, "uuid": "a4fa44b7-3426-4d7a-a7ec-984aa0f182b4", "value": "98304:KUu10N+LKash8ScaKXiEp8ItyWisZ32kkgPsNWWPBU1TQeo1mRLA+g+pPQe8Xc:Ka+LKawU2Q1ogj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680779, "uuid": "c701840e-1498-418e-a6f4-1ab843d8da7c", "value": 13940736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680779, "uuid": "f079c175-1d34-4896-8a52-ebdec27cefe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04be4e7-22b1-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745680781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680781, "uuid": "679df5d6-9e1b-4991-96c6-14d0898b641a", "comment": "Malware payload (Mirai)", "value": "ab8ecc23d135be536e946a1c515bc22b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680781, "uuid": "3d4469cd-5dc8-46d0-9d28-af852378e440", "comment": "Malware payload (Mirai)", "value": "d800bf2dd66172c6ecf5ea812d1cb78d4ed127a172dc58a35cc9a2d9cca416b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680781, "uuid": "b9ad4543-8abd-44c6-9ce6-52038482d5bb", "value": "T1BB33288AB8019D7DF90BD7BA90174E09B921B7C112830B27677BFDE3AD331945902E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680781, "uuid": "3e31cbfb-3184-4f41-9a32-a150ffa9b954", "value": "768:hN5P4OxBDtve1aEkD4WtxMYJ7T68bWij5zRMiXqg8lkNkQMGILL:B3BDtveBkltxMYJP68bWixRMiX98mV0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680781, "uuid": "d2a7ca73-ceca-49e8-9c6a-de8a6e50d4fe", "value": 54644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680781, "uuid": "6ed147f5-bca0-4d6b-b5a7-56935976e66b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07fb02b9-22b2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745680848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680848, "uuid": "c2d80530-eea8-4539-9d92-92f96afa9c99", "comment": "Malware payload (Mirai)", "value": "4a2a58a1bc7a24c2a9e4e1fe8e0592c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680848, "uuid": "7b37b9ca-4b6c-44dc-81aa-df457a1476f4", "comment": "Malware payload (Mirai)", "value": "3c3c0c909d1e2e39cf291fa0e3942729d24f20282a04fc7c411d2abdddc4b112", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680848, "uuid": "bd944d7e-a338-455a-8be3-614c5030987f", "value": "T19C236BC8A583DAF8FC1601752137F7379B76F4B9011ECB87D358E532AC52A00DA1A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680848, "uuid": "b958f387-770d-404f-ba0f-929c7a3170f6", "value": "768:vb+4+2li4CLuSVhjnpgMcg9InW7X5nm5nZ9H5mHZP6t3VhbWmxH9XbAD8eXS2Vg1:vb+R2lVCSSVhjCC9z7X5nZPolFxHpbAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680848, "uuid": "499c0002-fddb-423a-bfce-31ded6f18f41", "value": 46256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680848, "uuid": "b7637f47-4876-4f67-ba33-8b36e4ef3317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c230bb-22b2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745680980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680980, "uuid": "e81a9002-e800-467e-b0b0-6f2cbabddb85", "comment": "Malware payload (Mirai)", "value": "9d22fc2dabd8b018176bdee8a2edb046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680980, "uuid": "1244d27e-5748-4b08-8bff-3a7f6ac9c97f", "comment": "Malware payload (Mirai)", "value": "daa8dacc858b55836e21df5a26db727f512d680006a0afd4c844edccac3de6a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680980, "uuid": "92783136-3705-48f5-adbc-dff62cef5988", "value": "T153834B22AA761E2BC5D4A8BA21F74325F2F2478A24ACC61E3D710D4DBF7064072577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680980, "uuid": "fbe71daa-cacd-4878-9ecb-3e4738dca307", "value": "1536:GhnqSK1qtlvpXO/7wBEAjDS6tcRNk5kXZwty2trciGiD:GJjTK/Q+RNUkpdiD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680980, "uuid": "07e899c1-6b2c-4e52-bcc3-8898946d4727", "value": 81108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680980, "uuid": "89cb6e30-7c0b-41a1-b682-7928fbc94fcd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7f34c8-22b2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745680995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680995, "uuid": "f960b0c5-5960-446e-9f1b-380128a7fb26", "comment": "Malware payload (Mirai)", "value": "40a2c46b7b1c7e01a2cb63f5bb43b5ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745680995, "uuid": "a8544f3d-3f6f-491c-8b0b-1dd5c94393a5", "comment": "Malware payload (Mirai)", "value": "85fd89bd1bc3145f1c9b32818da47079c9004375481afdeda07726d13bdb086f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680995, "uuid": "ec9fda43-595f-4711-9b2a-f6e644352711", "value": "T144632A81FA87C0F5D81B09304077F33FCB32E5294171DA6EEF69EE36DA63541A2162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680995, "uuid": "f108d10d-888d-4ed6-9f35-47cff74f6acc", "value": "1536:R+XkIsiWIGc8k1KDVmUJlXjHOCjWh8GNRaCrZqfCxCEEyh:R+XvsidGyKDVmUJlXrOVKGNRaCl+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745680995, "uuid": "571ca432-a16f-4563-bddf-01d0c1c5450f", "value": 67028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745680995, "uuid": "5bb0e2d0-a369-4cda-82c6-f8e13a03545e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee1acf2-22b2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745681155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681155, "uuid": "2a4f7c8f-a6d7-4bb2-9fc9-f55b1bd0ba58", "comment": "Malware payload (Mirai)", "value": "06dbfbc05df6ebbc79ae0927d7390f17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681155, "uuid": "f32b6382-8840-4818-b20e-97cac4a5a736", "comment": "Malware payload (Mirai)", "value": "214f93eccc9744a5af46fd14895234e4cefc652eb70b064eab91c1992967ed36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681155, "uuid": "0648290a-aa4c-4d96-9407-d90cf719b18d", "value": "T1D0733B91B8819A13C6D452BBFB5F428D73261368E3EE7203DD25AF21378781B0E7B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681155, "uuid": "7aa64a9b-d92f-481f-a42d-62366aedffb0", "value": "1536:Jw3rPc7K04lzRv1pvTitfDOd1swuOz7tiT25Th3pLCd4JRpSio+:Jw3gERfWfygSbd55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745681155, "uuid": "e1c52d89-babb-4464-aeab-845aa08f9f73", "value": 77636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681155, "uuid": "51c78cd3-0730-40de-ab9c-ba7bb39c1a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2013b1cb-22b3-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745681318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681318, "uuid": "4c018761-71b6-4eb7-a434-83bb46b740d1", "comment": "Malware payload (Mirai)", "value": "48e6858e8a47571339690cdf5d2c0901", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681318, "uuid": "3590cb62-21e2-4157-91c7-dca52a48f0e9", "comment": "Malware payload (Mirai)", "value": "fd18e4efca112d2787430b167a9d5f61e0ffbaa1f2a20e4292b4cd1ef7c3ed6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681318, "uuid": "a5532f4f-d534-4f5b-b323-9f291a05afdd", "value": "T1A2732A91FD829613C6D412BBFB5E418D332A13A8D2EE7307DE256F20378785B0E676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681318, "uuid": "0404761b-ed22-49f2-ba57-6dac3d97f353", "value": "1536:2GIE70bAkGaR90zLxJQnndwuO8Sszw4r61pLlSio+:2GINHufQndwkdrwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745681318, "uuid": "1183c956-11be-4b23-8c97-5094eee83859", "value": 75268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681318, "uuid": "2501aff3-c15e-4390-bd17-ca35a3aee0ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786dbe40-22b3-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745681466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681466, "uuid": "00c1fca1-f9ea-4279-8bd8-6cdf5f2936ce", "comment": "Malware payload (Mirai)", "value": "cb0fa9441dd90b00eb705bc8ffffe94f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681466, "uuid": "594cec0f-7e7e-411c-9225-680a7df58cdb", "comment": "Malware payload (Mirai)", "value": "ff5af4f19474665b449a2766c3f0f6e7baca4487f0456b9bf3fc5aa6e2d723ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681466, "uuid": "033221d7-a762-4f10-aba0-638cde57277e", "value": "T1E6332AC1F54F84F9D95B49304063F33FCF32E5294175CAAEEF99AE36DA23541821A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681466, "uuid": "4ab29022-fcba-4058-9f6f-b16837bd4656", "value": "1536:j7WsI7YXIRWH+MK+77QdfzV6jZWlw4gtbnPwC7FQE6c6:j7W37Y4RAK+77Qdfzowa4gtLPbRH6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745681466, "uuid": "4ca1c01f-f486-43a0-b0d9-2339bff71797", "value": 50352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681466, "uuid": "86ab8028-6a41-4252-9f56-10b4e0cca56c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b3b3536-22b4-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745681766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681766, "uuid": "36739861-510c-4237-9c2e-1b079a61ef8e", "comment": "Malware payload (Mirai)", "value": "5ccc5d1bf67710717fc366239780e39f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681766, "uuid": "d5bec06c-f6c3-413a-8d49-9826c482cf74", "comment": "Malware payload (Mirai)", "value": "c483ad56aa34244c24341ea88c5dc34b0219224e61d496437b48b2842af01871", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681766, "uuid": "6df4dda0-9e1f-46c5-bd75-56e36d6170b8", "value": "T138535AC1A643D8F6F82A01719137E7365A73E439113DDA87C7B9E836ED52900EB163", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681766, "uuid": "1bf49c32-a436-4796-a299-c6bac8d423d0", "value": "1536:MOf6FP7mQT9+CgAf92NJcJjTOUbPqadvPcifVd7c/4CSQy:ff6BaQT9+EMc1TPTqIPfn7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745681766, "uuid": "ea4d8ce6-d9c9-415e-8ce2-d88d5b6b09b3", "value": 62772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681766, "uuid": "de801afb-9ee0-4cce-be70-9cd873563980", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403e397d-22b4-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745681801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681801, "uuid": "124e6ffd-4c98-4d00-9f1a-2ad48d6577a8", "comment": "Malware payload (Mirai)", "value": "99f953826dd72afc226058e78ece1fa8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745681801, "uuid": "383b6af2-87be-4873-8a80-c2b59c9d2f78", "comment": "Malware payload (Mirai)", "value": "438155fc8421b112c56ca42e45482d31e54478afa3d6c983d4188784b3487259", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681801, "uuid": "15785bf8-b283-4f7a-b402-7e28c226c384", "value": "T1AF431AC0AD57D9F9DC1519782073EB328A76F13A212AEBD7E39D8613AC81701D5072", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681801, "uuid": "6237dd55-ed54-4a71-9e51-11a85a6b1143", "value": "1536:jUCrh0pZ8LPs38hD45c08VsfUd1v5sOmndhIL79nRFZ6mWRxhKV:gih0P8LP48h308VsMd1vgdh+R/6xj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745681801, "uuid": "cd8507af-752a-476a-b8e4-c3a0ff2184f2", "value": 58128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745681801, "uuid": "f5924873-3499-4611-b051-38a78b540e84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cab96d-22b4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745682050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682050, "uuid": "8c0e0cfe-ae7e-4b6d-a253-0605c6f8137c", "comment": "Malware payload", "value": "f85bdcdb68f91ffe0ab2a0d628c175cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682050, "uuid": "dd2d56a2-3f39-4b37-8823-1ddfa0c2e400", "comment": "Malware payload", "value": "2ac339671041062dae30c6f8e0a9507d3f26bb508d45bfa02cb23df85290ef63", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682050, "uuid": "5795aec2-5a5c-487c-92d1-1b93b790594e", "value": "T1939533D418E4C2DACE2B4A71D4A2B5C09E317515F2224FE79C1BB77C3F26258B0936", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682050, "uuid": "54fba3d7-47ec-44f5-ae48-be35454b5f7a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682050, "uuid": "466e71cc-1e61-4338-a79c-798230068448", "value": "49152:BZYX6M97eJTclFa2rmC+VEhLbpGx/vaOn:/ZMgJTcYpqHGxna4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682050, "uuid": "19903b1c-f98d-460b-9ace-510f852f2dbc", "value": 1911296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682050, "uuid": "9c3cf53d-033b-4c0a-8f03-0f659601ca5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddc2be2e-22b4-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745682065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682065, "uuid": "6522ac89-3b89-4258-9646-ce77843c72f7", "comment": "Malware payload (Healer)", "value": "cbb3efde84ef7016bb73b6b0856be930", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682065, "uuid": "757fed34-02c3-4e6e-8f8c-9e46b57dfd2e", "comment": "Malware payload (Healer)", "value": "fa979611e2532e2556656ce1fa445d93c92e4070bae114881b960955c9df04f0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682065, "uuid": "3d5c3ae5-420a-4573-a84a-3f205cc56c08", "value": "T16C8533464E87C824E49D02B589E7EA3D1D3DB0D8D0B6F13C2C66F578A93265AF114E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682065, "uuid": "078dab0f-fd83-462e-9684-7088672696e8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682065, "uuid": "37c3850d-ba1f-428e-97f3-488202be4b74", "value": "49152:bKl7vxT/rvnVli0If/T8XyV4R2j42Wh9/:C7h/rvn9If78+Ts2WhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682065, "uuid": "79d90c17-2930-431f-8dee-de8b3b1abf80", "value": 1756160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682065, "uuid": "d6f9775f-82d1-4dca-8155-e74c88e5e2e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb8c281-22b4-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682119, "uuid": "8cf78cb6-5c51-4da0-b0e7-029d49cbcaf8", "comment": "Malware payload (Mirai)", "value": "fd04b9d4c0e05a7575e1ca2b55dd93cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682119, "uuid": "48e814d7-1903-4a87-b252-8ad0a92b0f61", "comment": "Malware payload (Mirai)", "value": "a48bd2348a642a3adfaca78af85a6720eec687259972cd0167b19ba83af9a9de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682119, "uuid": "3f1803e7-c6c6-4cf7-b049-60a2ad0cf4d6", "value": "T12163F806BB550FF7DCABCD330AB9171124CD691A22F96B3A7534D82CB44B24B56E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682119, "uuid": "efa1ad3a-437e-435a-a005-5bb1daff8580", "value": "1536:KEz1QJ0Y5vTdwZXNvCTtMZZ7BL3BSkTk:/xg0Y5vTtTtMzbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682119, "uuid": "63d09250-41d5-4168-a5e1-d4efd0c22c1a", "value": 69072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682119, "uuid": "09692434-5bb0-46ad-afbf-0a808283a67b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b547ac-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682134, "uuid": "8ac9e091-af29-45bc-b70f-02582fb2330e", "comment": "Malware payload (Mirai)", "value": "3998b367ebc046f3911dbf8de8cdb70f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682134, "uuid": "a74d9614-507d-438e-b0ee-8124f7d2aa69", "comment": "Malware payload (Mirai)", "value": "bf7fb9905ad436a4d6a30940f5d4e83d9ccdecbf353482dd3c715172ddf198e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682134, "uuid": "1168fe3f-d5ac-445c-9bb2-23398dd55639", "value": "T11D634A13B58190FCC29DC374476BB63AE93375BE1239F2AA37D8FA126D49E211E1E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682134, "uuid": "8c551c64-6262-47b3-8482-1949d37b1f32", "value": "1536:GBEtqb9a7oY6uHhK0ygRZKbBqAdUFUP57atD9kuQTGJ0OGjnU:htYQsYFwERYVqAdUaPctD6TGOO+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682134, "uuid": "2003a8af-76b5-4ef5-b747-aeb183616e06", "value": 71824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682134, "uuid": "49cbe1e4-9a48-4d18-9066-754aca3bc91f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274a14a1-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682189, "uuid": "16c9f8ff-b41d-43cf-99c8-5b48500e47a7", "comment": "Malware payload (Mirai)", "value": "7482688d95f9ed6735e16cae2ea17317", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682189, "uuid": "59e46ad4-5e94-45ff-b0c2-20bbb3a49d2c", "comment": "Malware payload (Mirai)", "value": "5f483fb3524434c6880ea62bb59e6333b487b7d3253d234919068430dc07a2f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682189, "uuid": "b4ee5eb8-7d4f-46f3-a5c9-4173c54ddd9b", "value": "T146434A57B98080FCC18DC2745B3FA636E672F07D4335B26917E8E9226E95F704E2E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682189, "uuid": "c7f79945-1d9b-4900-a183-cdc722bd6d42", "value": "1536:K4wD2cRvuJvf7f0PLvjU+kPXiYDrNntzd40vf35OfRa:pwD2cRvuJvzf0PLLMviYD1ty0vBOfRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682189, "uuid": "0d4b4b8e-d839-4afc-be6a-2701f17501f1", "value": 59264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682189, "uuid": "1424ac0f-aeda-47ae-9b11-2b164c7f704f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2b41e2-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745682195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682195, "uuid": "d6545ee0-e206-4acb-bf62-153ac2032dd6", "comment": "Malware payload (Amadey)", "value": "9da25fd2b996f2f51f596c611d755fb8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682195, "uuid": "cff0a15b-5f13-4671-ad1d-19e3c3e2f909", "comment": "Malware payload (Amadey)", "value": "e7d2cabec41f3ef519534bb8e37c4436b36402f73f4efc891e26fdb544cb8717", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682195, "uuid": "a3731a34-c0ed-4ece-98f1-b132567284bb", "value": "T1FF159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682195, "uuid": "b1d7bc52-0be8-4fe9-b496-685dc5a79562", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682195, "uuid": "204ec6a1-6d52-44ea-8f13-c461997b8b51", "value": "24576:EqDEvCTbMWu7rQYlBQcBiT6rprG8aeGV:ETvC/MTQYxsWR7aeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682195, "uuid": "49aa13c5-d2e5-4af0-88e0-50f2f3f8382a", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682195, "uuid": "8b2a4a26-2f67-48a1-a542-9e7f6388f32a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b0c250-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682204, "uuid": "9944239a-6dea-465f-a067-8f5436d43f20", "comment": "Malware payload (Mirai)", "value": "d92ce7bc5ad100d50a814aad39864b62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682204, "uuid": "76c0f78d-b826-4a5c-8b89-59c9c8a1edc4", "comment": "Malware payload (Mirai)", "value": "cf99e5ad5ebb31a5b5d5232e59be44777e394fc8fc035aca152681f37d95c6e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682204, "uuid": "ddaa6af7-fd5f-4e58-9cd9-9ccc65204cd6", "value": "T19A432917F68180FCC29AC274572AB23AE57771BE0239B2F573D4FA176E86E614E2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682204, "uuid": "d6f8fb6b-bf3d-4a94-a231-63cd198737cf", "value": "1536:KxKtFALhI11z7vFQu3l+6wGAY9L8XonPIWRzfcMr+xmGYS:XtI211neY+6rAY9XnjRzl+xmGYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682204, "uuid": "5fb56056-6f2b-4381-9810-9f2441e3afcf", "value": 55168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682204, "uuid": "324bb7f3-6af2-4475-945b-ff8860ed7df0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3490411b-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682211, "uuid": "b99d3ef3-0be2-4696-90d3-97d85a295011", "comment": "Malware payload (Mirai)", "value": "1d1b536d79cb93e74cf7e7e68b26a6f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682211, "uuid": "ac6ea0c2-474a-409c-8579-ddc79279611f", "comment": "Malware payload (Mirai)", "value": "c0d4adeb8483cd01dcaa2261e6f18f5c652fcb80b7c8db3f6847a4471b150ea6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682211, "uuid": "604df7d7-3dcd-486a-a777-2e15fecd84a5", "value": "T178436C31BA361E17C4D1A8BA21F30724B2F1479E25A88A1A3D710E8EFF71A4075577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682211, "uuid": "65eea6d4-f827-48c4-a09e-14eb66e5b633", "value": "768:CPoKcq9VOUMwpHdQT0WFef2kMSChyEHDO+75mT0AiR2cT1tcIVq:CPqSVBMwpHFWouklChVX75k0RtcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682211, "uuid": "e02c3430-6331-4003-b684-819e10db8459", "value": 56340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682211, "uuid": "5ef813ab-d8d5-4be3-89bc-4441fb642baf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e010fd-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682264, "uuid": "458ea2f2-880c-4b07-9269-f182723bc23a", "comment": "Malware payload (Mirai)", "value": "1589f3055cf91790977a4d8494942d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682264, "uuid": "30bbcbfb-9dff-463f-95e0-adb0decd3f9b", "comment": "Malware payload (Mirai)", "value": "9e615f316c7b0f4188e0587f14035ff9a38d373949778a23b0b3e698fd875349", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682264, "uuid": "44c7cd0e-b32b-4b4e-b7b6-ec10f77a8e2c", "value": "T1C863B61E6E118FEDFB68C73507F78921A398338A36A1D685D16CD7105E6028E641FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682264, "uuid": "8d5101f0-b9fe-4fab-917b-c4e1ad6671a5", "value": "768:qeXr/3SwGEbwC1DEsl0d5P6HVGt/reJLDhlol0ANCxa1M8kXxHw94RyBFMPQ10yl:pls61Are5Dh6nkXJ/ReTaewe5joD7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682264, "uuid": "9d171e5b-aa2e-40ce-95f3-2b2324010c68", "value": 68704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682264, "uuid": "09577ee7-099e-4415-ad58-4700ffb90430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e84b70a-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682281, "uuid": "ece3beb5-0fc7-48b3-bd7b-8c0d47cbfb65", "comment": "Malware payload (Mirai)", "value": "bcb263dff5fc9802aa2ba76b055e1f09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682281, "uuid": "ea62957b-b2eb-4d8f-9629-65eaf9833e84", "comment": "Malware payload (Mirai)", "value": "619a84397e3f394e2ec405916eef2c8c46f189a9ecdb7558b0e9ac59c4b5ee13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682281, "uuid": "3c3a6f96-d622-4560-9feb-e71cdebb7a29", "value": "T190334C01731C0A47C5676AB42A3F17E093FFE99120E4F688650F9B9AA271E3645C6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682281, "uuid": "9df9d23b-3a9d-44f5-823e-89292dcb45c9", "value": "768:2H4GDlIExeRqrURJM2CumdEVAAk2T9rB4zLZLK5s9cW4Fw+t/mcJqIu5:27lBEDYbumeyB+rCzQ5s9v9+ZmcJq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682281, "uuid": "86e0f0b4-76c4-4fc2-81d6-7ebcfef45338", "value": 51736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682281, "uuid": "6f80a33e-067a-492c-bbc7-1d4c4463cda3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a272b2-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682315, "uuid": "6c883763-40c4-49c7-8dde-1b05db20fe36", "comment": "Malware payload (Mirai)", "value": "46c80a95c6bff2f60b0579816d096683", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682315, "uuid": "8ee3b367-c55b-4a3f-8ec9-56df08847a0a", "comment": "Malware payload (Mirai)", "value": "9b74a9446cca9628383bc26e57ccabd5067821f5b57a7a1e70a7cd785045b796", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682315, "uuid": "e8f6b71f-6e04-4632-89d9-86d7e4f68e0a", "value": "T124C2D06D4505656EC9E2C43FA9F913A11FB20F965B63D8873C46ED93EF880B43A431", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682315, "uuid": "f4ad5b02-2cb9-4fe6-843e-9b934cadb73e", "value": "384:1878GB3AAqeh1WNLszY9kWt/5PLHfjC4zV7kiHLhZcbFkh3vQ/tXJgGlzDpH7uN3:C3AnePWN3vjZ/HcOS1JgGlzDpbuR1Jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682315, "uuid": "07d84870-ada8-4406-976f-94f8bdb040fd", "value": 26448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682315, "uuid": "261c46aa-9a38-4dda-9f47-fa02a8ee08ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b724c20-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682384, "uuid": "810ad36d-18a3-4f89-b2f3-96a01069cf42", "comment": "Malware payload (Mirai)", "value": "4b3a61f71f5e1c4161a19c3a2ce6782b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682384, "uuid": "1f3cc49d-8418-4e31-9876-bf987ff502c4", "comment": "Malware payload (Mirai)", "value": "663de22bc7b10d1ca1310dbc1d2205a1a80cc479a90221e0d38b7b6e393ff3a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682384, "uuid": "0f62bd6b-a59b-4ce4-9487-caf831e63fea", "value": "T152630986B9814B22C5D413BEFA2E118E3313177CE3DE73129D206F24778A96B0E779", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682384, "uuid": "ac2e984d-a8c4-4bc3-8db4-2bbdc56ac7a4", "value": "1536:/AnOxkwGnn32MUeRIkxDhYYpL1FadB+nzsIpib3BGAW5zJD:XkD32WRIqzL1FadD3BGAWRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682384, "uuid": "3e0d60f7-1b73-47e6-ae7a-6278d5c8c5e3", "value": 66940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682384, "uuid": "ad8515d8-54d9-44b7-ace1-110d54fc1667", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a8655a-22b5-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745682424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682424, "uuid": "266b1872-18a1-40f7-abcf-eb4a8548fe26", "comment": "Malware payload (Amadey)", "value": "4804386859d315e09f89c0ecae1375ca", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682424, "uuid": "05ae330d-93c0-4441-ba3d-ed686687abcf", "comment": "Malware payload (Amadey)", "value": "6ee4c8a9997e8a2ef5becc2a223f08e9ec110b3256860ed19512ef7d69e08329", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682424, "uuid": "f3929eef-28bd-41db-b38c-3b6e95fea97b", "value": "T1A3A5231BD7D48032E57487B029FA27D30D3A3E924B75C3963A8FA8570422674B6727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682424, "uuid": "d886adff-1a56-4afe-8485-d2b80456ebb1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682424, "uuid": "b202b128-b75e-4def-bf90-0d0e007d087d", "value": "49152:eg75CMZPLL/2bRXbN5t2m1h2cI+SJtIUV6PrBGna0pmTkcphJpOTvKu6u:xLDAbntf14U6DvtYTkcvavf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682424, "uuid": "3514bae7-83a9-413f-9d31-511b889fbb16", "value": 2202624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682424, "uuid": "a3565111-05b4-4d37-8957-941f68588b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93629129-8755-11ef-afe5-82aee05be84a", "comment": "Malware payload (StrelaStealer)", "timestamp": 1745682453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682453, "uuid": "97ef377a-2d13-4a62-b6ab-af641cc39b63", "comment": "Malware payload (StrelaStealer)", "value": "38d365898fd6acbb4788e654e864922d", "object_relation": "md5", "Tag": [ { "name": "APT", "colour": "#cfa990", "exportable": true, "hide_tag": false }, { "name": "BeaverTail", "colour": "#193B98", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#0917e9", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#ac075f", "exportable": true, "hide_tag": false }, { "name": "python", "colour": "#25a4eb", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#c8921c", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#8f1ebb", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682453, "uuid": "172e7a97-e6b8-4b8c-8094-4c0b75a6c64b", "comment": "Malware payload (StrelaStealer)", "value": "6a104f07ab6c5711b6bc8bf6ff956ab8cd597a388002a966e980c5ec9678b5b0", "object_relation": "sha256", "Tag": [ { "name": "APT", "colour": "#cfa990", "exportable": true, "hide_tag": false }, { "name": "BeaverTail", "colour": "#193B98", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#0917e9", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#ac075f", "exportable": true, "hide_tag": false }, { "name": "python", "colour": "#25a4eb", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#c8921c", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#8f1ebb", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682453, "uuid": "9f1927cf-4eac-4fd0-8488-1f9b29de704c", "value": "T1DFB72313C29D4275DB872F38218A5327D86CEF64B3616BE73EB41E58EC92B84874B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682453, "uuid": "05f806ab-95f8-4e32-a704-16c23c6ffe11", "value": "1572864:6mIiGkgmsKpC0Xn1OoG4JC6B9O1jPIaG7YiC2:Y0XHRB9OZJG7YiC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682453, "uuid": "c8e63d6d-8de8-494a-9aaf-635b1f38fae2", "value": 51476596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682453, "uuid": "a8af87a8-f8ed-45a5-b7d4-a275eecf275a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010067ac-22b6-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682554, "uuid": "b9592b79-1809-443b-9a59-78b19a078e6d", "comment": "Malware payload (Mirai)", "value": "bc1cbd2be46e85da64fbc3f57c8d62c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682554, "uuid": "44dd5d6a-2f6c-4630-8c7e-0c5d2bda5274", "comment": "Malware payload (Mirai)", "value": "b3248125c51d7411f7aad0867bf0d428e13ed4bf9b7b8fb3b7825d1438c827c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682554, "uuid": "6860db25-8ea1-46d1-8bed-4373fc6e10cb", "value": "T190332A81B8829613C5D412BBFB6E418D376567A8E2DF73079E226F10779AC1F0EA37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682554, "uuid": "7feccbeb-9669-44b3-a7bc-3e51b10fbc29", "value": "768:qeK/W0mkPqTqSpG8cVVqlzDal7IX/rdAiWlhHMEu7e1W5LMFVBdmaMrGcOB1YY+I:y/WdkPaqC++DaCrDutvFV3wGvBmY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682554, "uuid": "48d18f64-788f-4f52-b21b-135d5d22c6e4", "value": 51808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682554, "uuid": "f995c1e7-677d-4b7e-8952-a6573f87101e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f66cf6c-22b6-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682578, "uuid": "bd954360-5435-4234-a79c-18591cf2d6c0", "comment": "Malware payload (Mirai)", "value": "041cc2aeb9889f9e120ad1e66e33f9fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682578, "uuid": "9f47b3e0-67df-4899-84d3-ce88cba964ff", "comment": "Malware payload (Mirai)", "value": "5edc9a9879f979294be16fb4daa42d0af6fd25e176afec7a6e6c35d08fbac6b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682578, "uuid": "e5540432-2abf-4df7-8448-117e03f16eef", "value": "T18B338D21F4399E94C58605B4A45CCF390F13E1C493535EB727E68AB97883D98BA0EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682578, "uuid": "7392dc0d-faf0-4be8-9087-72bfbc8c0e68", "value": "1536:5ad+Nmf8ojKAtoVVb4eKUbwslqS/2e4AGMC7CX0Son:5fS8IKAtOVb4eKUbwslqS/2e4AGMC7Cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682578, "uuid": "8655a957-407f-4805-a729-f20a0fa6e1f4", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682578, "uuid": "09083f72-2810-47bb-ab39-ea3f3008216b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3def561d-22b6-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682656, "uuid": "5856df0c-263b-418e-ba16-4b7b527aabc3", "comment": "Malware payload (Mirai)", "value": "b5218e3205b29e5f35e83df875c9ddb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682656, "uuid": "f63e8e2e-e0d0-4eca-b1c8-f3ec19dd8fea", "comment": "Malware payload (Mirai)", "value": "3fadbea0fd32607a8969a80baa62e377c8572ab64023492e6c6944e773813b0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682656, "uuid": "ec82e802-9507-4ee2-a8c4-fa42980e315a", "value": "T11F639DA3C9396E98D1A991F0B4349F745F23A11082A71FFB0E55C1799087EACF6463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682656, "uuid": "626bd99f-b878-4fbd-8cfb-f9d29f2bce0d", "value": "1536:VatwtVAbFF/lAKfLfGp2KR58flmEuiCXMLeWPASio+:Vqhbn/ltTfGnRGmEuipikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682656, "uuid": "299ff2a9-d16b-49e2-a683-46b7a76a37f9", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682656, "uuid": "ae982d06-f3b2-4295-b947-91583dcd98ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "686f1411-22b6-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682727, "uuid": "e5bad45e-4b95-4287-9469-178f495192dc", "comment": "Malware payload (Mirai)", "value": "b0b558ab47b5217101ca71dedb2f3d94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682727, "uuid": "d19f4820-c890-421c-beee-5611ab905eca", "comment": "Malware payload (Mirai)", "value": "490c4fbfc45c8f6637efc645da4bca4b990f929f1ed18218a4bced48fa4d6e48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682727, "uuid": "5c7779c0-ff70-45a6-84e4-142407cabd91", "value": "T11A23F1FD3E3F956BD8011D39EADD8586B88AC77C508F28DA01584CE0609AEA55BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682727, "uuid": "7b76ea5e-0abc-4cf4-9db5-cfa18d93d71c", "value": "768:Euj0Oi36re6XxT+eELnLu1Os5f9zy9dmUfl19q3UEL/sFV3l8HgRKY6VR0523t:Euj0rqre6R5Eg51zqdPlILET3hKYc/3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682727, "uuid": "2dbb8158-ac54-4ffb-8b51-d59d581fd941", "value": 49568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682727, "uuid": "7e357fa4-ec67-440e-9ce6-4ee8acb872dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c19149c-22b6-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745682734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682734, "uuid": "6109a180-c708-4a1e-a515-eb16da800187", "comment": "Malware payload (Mirai)", "value": "68218671fa5c15ec8b6ac8c85b11a259", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745682734, "uuid": "8e94cc96-691a-4719-925d-36e089dce9df", "comment": "Malware payload (Mirai)", "value": "6007f0c1255310823c233e79dca977cbd6f91cace3b6c0e89327addbacad631a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682734, "uuid": "52a45064-e82c-414d-aaf1-91ffedf57ea6", "value": "T1D0D2E13A56906DADCCAF9C3965A593A299D461D3B40F0F7D13F31D8C3F2024FB9948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682734, "uuid": "79430fc3-58ef-48b7-8f1c-05b6aa23cdea", "value": "384:tYtD6ynF4b1nghjt0UQcOupcjyHxeHfBYHWEXrshaIvPUPNBV1EsjTsRWGVCz0Nn:tY9CtOt0UbOic2BvAaIYNBP9TMWkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745682734, "uuid": "6705bcf9-643c-4a36-b3db-2f75d36ab963", "value": 28552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745682734, "uuid": "cf1b919c-818c-4453-b6ad-3eeb00914fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "168f6f53-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683020, "uuid": "3d663f0e-ea85-4b35-8878-8bc0207c6f7c", "comment": "Malware payload (Mirai)", "value": "fe4dabd6092fcf3f667893f1cc439e48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683020, "uuid": "1e32d183-8b9e-4deb-9bcc-0f8c21af95f1", "comment": "Malware payload (Mirai)", "value": "5a3735ba451590d165aa2e5fc57c6958160d3fb8d4244abf71eebd6219a3f089", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683020, "uuid": "c1cdff9e-22eb-437c-8af6-d8270460a175", "value": "T180B2D05012DD2A1BCC259FBEE1EF0D6D50609CA4837FC343B26CA6C22AD21A7F03CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683020, "uuid": "c7e9ada7-6f87-4feb-b5b3-5a393757832d", "value": "384:M3wfr5tUs8F1Bw/knusNwQkQlR2fFVOnfc9CRkq0MR81GLsLv1Rl:dr4s/knFwQDRcVOf4CRTR81GLcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683020, "uuid": "a908be13-326a-4855-b9f0-de8edd40f04a", "value": 24300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683020, "uuid": "6935544e-5224-4b2c-baf1-3ae04d006a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be2fa5d-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683055, "uuid": "d2d67a0b-7a99-4b0a-83c2-71472aae9aff", "comment": "Malware payload (Mirai)", "value": "6ae15332883a1426ebdc30c55b706d62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683055, "uuid": "14f8afd2-e706-4ed4-b5c6-2100138dc778", "comment": "Malware payload (Mirai)", "value": "8511e7d09f3265e2f91bbf3ddab7b12b08d1ad965c4b2c5311123a04efe09947", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683055, "uuid": "a247de67-e2ad-40de-8431-cbab7ea552b0", "value": "T10BA3C71E6E219FBDF769833007B74A21A79833D637E1D685E19CD6001E6078E641FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683055, "uuid": "c44f7b13-aa3a-4895-a7d9-5e549e8f6e92", "value": "1536:F7EnxX/ZpiIvAuZrOVgpjlW5iIO24eFyZNI4oSiWjo4Z:KnxX//iwhlWAIO2ok4zUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683055, "uuid": "cb5056e9-06e6-46fb-8aa4-b5ab419a67e4", "value": 98356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683055, "uuid": "c703b5cb-0d6c-4d1e-92c2-d55397a1bc9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330d7d0a-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745683067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683067, "uuid": "a0a55f2f-468f-479a-b371-f81316d56c89", "comment": "Malware payload", "value": "67b4b562d45daba9677cc8d18c4aa102", "object_relation": "md5", "Tag": [ { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683067, "uuid": "dbac85d4-b3e2-46b2-b98d-fa6d1128b041", "comment": "Malware payload", "value": "f78892355e6019ae60c1e830826cda523496ce2cd70d0e4ce4bec9a085f47b21", "object_relation": "sha256", "Tag": [ { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683067, "uuid": "a87a2def-7e3b-4f48-9c6b-55eacd4d010f", "value": "T1FED4D018926590E9E59B41B25B402345F073BC33D7686EBF72E0F3253E92BC01EB97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683067, "uuid": "2b59263a-3d3e-467a-91cc-902bb7114190", "value": "d6937b39d566e5795f3eb7422ac303be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683067, "uuid": "e5278186-7d65-49ca-82c1-f4bf75cec3d5", "value": "12288:W5t5Cw4TK1yG9AUX7+zHiJvvTGzzHiJvvTG:unCen76CJqCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683067, "uuid": "c13506b5-06da-4101-ac81-326f29a872df", "value": 599552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683067, "uuid": "2dbffe1a-7895-4840-bf04-d7f489fc189f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3329324f-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745683068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683068, "uuid": "aacdbfea-e69d-48cb-846a-9e0d377716aa", "comment": "Malware payload", "value": "8127aac373558ad147f529fce04edc4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683068, "uuid": "00489f19-4a0d-4085-9553-019cb0a1f1b7", "comment": "Malware payload", "value": "24a19dbfd64485d8b9dcf00b32c08caace04e3af4c9715a5e04e09c7f303e0ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683068, "uuid": "bd4b4bec-4a91-41db-b38d-50e7a15ffdce", "value": "T15F259E027391C062FF9B92334F5AF6515BBC69260123E61F13A81D79BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683068, "uuid": "75a35e97-1cba-4eae-8d84-2f8e9f55d842", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683068, "uuid": "ad9a3fd2-12ae-4fe0-8c5d-e3e8d3f1e9d9", "value": "24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8ajYu:1TvC/MTQYxsWR7aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683068, "uuid": "f5fc806c-738a-42c7-8bf5-4ff02f44a809", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683068, "uuid": "052d0456-79cb-45ec-95f0-507c643f8e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445cbc8b-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683096, "uuid": "5a6b056f-37b9-4290-a9c6-602625a4a140", "comment": "Malware payload (Mirai)", "value": "b385a621ce2442d58795539f0f5ab8fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683096, "uuid": "1473a08d-0389-4f0e-a152-20e00021513e", "comment": "Malware payload (Mirai)", "value": "3ca161ee9a327beffe610a5f02147269e89f8f204e37883cbcd10433f78e17ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683096, "uuid": "0d358988-8878-47a3-a73a-85baa9f3aa34", "value": "T1B4832996B8818B11C6D512BBFA1E118D3313177CE3EE72229D246F2477CB96B0E379", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683096, "uuid": "8c08992a-fb62-46e7-99f4-a812850d90f5", "value": "1536:A0nEuqMaFivPl338hLxhIYIPHINia5Nr74Q0MyigRfaIl1R7OV5ySioDM:EzFGomFHI0a5SRfaIl1R6VH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683096, "uuid": "4d3857ba-385a-4eba-8e6f-007cbc55a59c", "value": 83448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683096, "uuid": "c89c6ba2-6059-492c-a18f-8ee72deae0a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aebc366-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683188, "uuid": "73c3f626-3187-45f3-b982-f1ca2aeec5c7", "comment": "Malware payload (Mirai)", "value": "81d38bb4831ad5eb38b43a6d6b6038db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683188, "uuid": "0312b671-a68e-4f84-8d61-6ac4231d4826", "comment": "Malware payload (Mirai)", "value": "a44e5e2ce69578030a9c7a39f01747fb0aa5c200bdf984dc9b96ec12d74f5af0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683188, "uuid": "d5172a06-ae1c-4249-b176-280db61f2124", "value": "T1AB92D11068827276D0B4EC3EE978C341C38B4D7CD7EC72792E984BAE6A5B41DA1B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683188, "uuid": "b504f0eb-5fd3-4bc3-ad1d-3fb016510ef0", "value": "384:hwUpbe6X7x/VfVZG/ZtTfQVlHP5FC3p28lPpZXEPHPdWsRhymdGUop5hINah:muf7BVtZudfAP503p9xhEv1Ts3Uozak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683188, "uuid": "abeff367-bdd2-48d5-92f1-26e192718b80", "value": 20828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683188, "uuid": "9e58e69f-cbb1-4f6e-83e5-7fc020da9f66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903fcbf5-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683224, "uuid": "83d092a3-7d3f-417d-84fb-d3e58a55239f", "comment": "Malware payload (Mirai)", "value": "eb43f88650f7d0a3be14affaca882315", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683224, "uuid": "20a7f584-fa79-4b54-9888-f756aa730762", "comment": "Malware payload (Mirai)", "value": "b16badfc3f379355627fc2b1aa3b47a46e75d74cecec819701c94dc944799cf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683224, "uuid": "b4aaea9e-6ec7-4e50-bc4c-c4cd5ab84f54", "value": "T185238D77C929AE88C1498274B8354F741B63E049D2A31FFF1A99C2698087DBCF6053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683224, "uuid": "fa17a670-2441-41fa-9bf3-1929a3ba1108", "value": "768:+aRwt9bwXmQceyEm0U1BL1mqIHuUaQC42lKxYY4EaR1o8cFwuC7+QtJfrJzj+I:+aRwt9icFo4Bp7muiuKxYY4XA8ruC7BU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683224, "uuid": "e2328ebb-0b79-412f-8e9b-e28781babc67", "value": 46528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683224, "uuid": "206e129b-01b4-40a8-b8ff-f6b2a61652b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0724ab5-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683278, "uuid": "a5e8f075-7f08-4392-b889-4e5ed5f6a789", "comment": "Malware payload (Mirai)", "value": "7a5ce5bd0ddd46d83cf82ec27bf5f085", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683278, "uuid": "6255f2ca-9682-4794-85c2-0a3ddc119eca", "comment": "Malware payload (Mirai)", "value": "9f0dde5090d31f8a0740505ad66e867aadd6576bde7de9b05507177eb2cee62f", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683278, "uuid": "fda853ea-d561-4870-afab-646bbc1b732a", "value": "T186835AC5A3A2C5B3C4872B3401A3E7735970F8E61B6DDA12E36CEEF46D035C5708A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683278, "uuid": "a539a732-489d-4bea-bd7e-2fb2c932dc31", "value": "1536:DyHvmj8tRTURfzV63kZzUrSoBFo0cSwNilWBw0:kmwtRT3kuvFN0NilU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683278, "uuid": "cbb4322e-f671-4f7a-8d84-88b7bf71f990", "value": 88747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683278, "uuid": "3da54546-3eec-44ad-a1b2-b8b139320b7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c31992-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683287, "uuid": "1c9bc420-3f7b-45a7-a1f3-76725925b83f", "comment": "Malware payload (Mirai)", "value": "3be85d3b5dc8f5ca3efceab9efecb0a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683287, "uuid": "7957fdf2-abe7-4fd3-b844-407c1f27be58", "comment": "Malware payload (Mirai)", "value": "cf418c7616a40f6d11fa5483f4fe969bc7e2f02219cd405c19d034b97dd5c1fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683287, "uuid": "51f4d3ef-199b-4508-ac54-226cccbf797b", "value": "T15FB39CEBF24752A1C86246F047CB4BED3E2723815F27C5E36C6A617868792CB8911F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683287, "uuid": "e4cc16af-8fe3-4bb6-bc49-4cb3d80a1669", "value": "1536:B7YFB5tpHmY2EOVYsHp4YhzkWY2gHV/LWw:94XfmY7QY84czkWlgHVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683287, "uuid": "8eac290e-0a9c-45c6-a912-a7ce1d783e31", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683287, "uuid": "7a9287a9-1e64-4b72-9dd1-d01e6f09586d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb8a263-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745683330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683330, "uuid": "c27cba8a-8e0f-42eb-be54-62ced07c1f89", "comment": "Malware payload", "value": "4ceeb05598baeed8cee1ac915a3bf5a4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683330, "uuid": "95b5849d-5ab3-4e0d-a8df-99b39c80f2a3", "comment": "Malware payload", "value": "44fb54593b9b53e72ae6958b73f6b2dc306ff701e660770f8fe915fc6b8db200", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683330, "uuid": "f3131bb2-a3a9-4552-bd83-bf3290bf13e5", "value": "T1A895337D5F23BB78E73F4EF662B398A88D93B464106992D04DE3E0451C03E25717B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683330, "uuid": "910d7bb2-21c1-41df-b84a-6fe50817f5d0", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683330, "uuid": "5a671f9c-a92b-40bb-ad77-3c0f0ef926c8", "value": "49152:TEdKJPKVTEg7LoXdpcA7n0K9HHN+tvzksV5ICmhX5Qn89EE4Va7:+MPKG4LoNrnFRHNkvgm5mpEE4a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683330, "uuid": "56d89566-3c8c-4078-8a89-6d7b435560c0", "value": 1896960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683330, "uuid": "364feaff-48f1-4c4f-a449-1b944e151f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f27240-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683394, "uuid": "4eeb2a9f-7ed3-443e-b2e7-a34633ab1e52", "comment": "Malware payload (Mirai)", "value": "63d5197761e495037ce75e1c986dd29f", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683394, "uuid": "b33df889-adb1-4229-9ebf-1a89e4d5df21", "comment": "Malware payload (Mirai)", "value": "79c3bbf817a87fca366fd4968c7aa0614b08b007004b5e739c6398879f972d97", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683394, "uuid": "c9f7dae9-5fde-4363-b376-b78c981c2a97", "value": "T1D9432A32B57A1F13C0D4A47D12FB4B5972A25BCE26A4C64E7D720E9FFF116406842D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683394, "uuid": "a26fbd19-27c4-485e-a7fc-63f98298793f", "value": "768:mp2ov1KgN02o/bkIg+6rST/GcfD/BFZzqlfF7U3kwgzfO+AnZmCwj:u2YKgN02o/bkvZrST/GcfD/BFZwtjAoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683394, "uuid": "64b73715-734d-49af-84b8-9ac3418cc264", "value": 56352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683394, "uuid": "eb231a01-ac30-4e51-8696-efb45cfdf694", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e54a84-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683398, "uuid": "862f3674-4ff1-493a-bd1c-5559cf4065e0", "comment": "Malware payload (Mirai)", "value": "36a04aeace9d6671e8698b54f5e0e1c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683398, "uuid": "b260efa0-728e-48c3-a563-58094af4a941", "comment": "Malware payload (Mirai)", "value": "fa26941e78d54ec93c9c364e78df313b2f4d7e5748074ecf121407d850504134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683398, "uuid": "64d21b1f-3831-4a8a-ae62-94c16eaad368", "value": "T190D32B46E7404A13C4D6277AB6EF42453323AB6497DB73059928BFF43F8679E0E236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683398, "uuid": "b0818f40-51e0-4bb6-ad93-bdb65897d9f3", "value": "3072:1QoLGphWGmaqQj2KlNAER1JOLqw7/huZM/9u/q3p:1QoLGT/maqQj2KsE0v7/hoM/9u/qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683398, "uuid": "b0608923-2f70-4c93-943e-cd005e98d721", "value": 137335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683398, "uuid": "51663962-7f72-4b95-90e0-459d6640b42e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd75d3f-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683406, "uuid": "0dd0a61d-e1e1-496d-8a27-2f2226bbdcc8", "comment": "Malware payload (Mirai)", "value": "7d85df4334177de6006e11a63106d5a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683406, "uuid": "a190163e-161a-474d-ab3c-43f341bbb5cd", "comment": "Malware payload (Mirai)", "value": "131edad75fe9c4419995b4b29cc8883334fe1301ef8aaedd504b315d9d6a1495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683406, "uuid": "cb3906b6-a503-40e4-aa58-7ad4282eba57", "value": "T125833BD7F400DE7DFC0FD77B4453490AB671A3A156831B3A2367B9A3AD321A44926F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683406, "uuid": "03a18856-6488-468a-b19b-12a1285dc153", "value": "1536:zl7JnS9QdpMbcPixeY8gyHPkU9PCjaKI4THvxdxt9WpCWq/C8:x7JS92mbcPixeWyHPk1j3IGX9WpzWC8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683406, "uuid": "bbe77049-c4ab-4279-894b-86c8fca09add", "value": 85240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683406, "uuid": "61e973fb-a929-4033-b461-2f173b2e474a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc6554f-22b7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683408, "uuid": "dcfc08b9-2100-4998-a48d-5caadacd6ccd", "comment": "Malware payload (Mirai)", "value": "25ed645cbc2e6c9820cbf3864d5ff0fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683408, "uuid": "ad150bdd-44fd-4581-b54e-88ecfa75e139", "comment": "Malware payload (Mirai)", "value": "2fe01a428074aabe5435c56318854383152337f2bedeafe948662719798318e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683408, "uuid": "cf9db6a6-99d1-46d1-81c5-381183aac73e", "value": "T13A734C13E1655EA3C0871BB825BBCE390B13A8A157532E32562D8BF80E47DCDFC85B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683408, "uuid": "5ae7a606-801d-4ccf-9ccc-fc50dc0298ba", "value": "1536:cHBpSbCG9uYvToaGL0q2HvqpV9YxnpYKJL:iBpSbCCpvMZ4caxnp9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683408, "uuid": "e73cb076-e140-4fcd-90de-9983f8459cf3", "value": 77181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683408, "uuid": "3d6cf6ae-07a6-4509-a772-f2e7d1b0e37c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082fd58f-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683425, "uuid": "e39a0d92-6f09-442a-98f0-120f196cc131", "comment": "Malware payload (Mirai)", "value": "690dcb24fee008c929dc7e163852b7f7", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683425, "uuid": "2729dbb8-8fe2-486c-9e96-9bf6edb2a20b", "comment": "Malware payload (Mirai)", "value": "66499a3cb3bebcd89e9f24959fee515e7bb3a73884b7ab4cf0e83d5095fc5a01", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683425, "uuid": "ecf723d4-4027-4928-b01b-82fda5e05940", "value": "T1FFA2E1A7B14F787DC58A993AB0EB4CAD115E9E48138E951C7E4C9061E3731CC063DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683425, "uuid": "1000c7fb-8499-419a-84a8-86b008ad761f", "value": "384:MPXPSyJ/iQP6almgkSbmLbrW+PGDe3myE609FBH24gQJwpXSR+CoblObRD++v1R7:+SCiohyLLZUx9FU4UR5ClbRDh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683425, "uuid": "fded1d43-9749-4338-93b3-195349d46543", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683425, "uuid": "af67f285-d1a8-4239-808e-c64d9e977b8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f74d7e2-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683464, "uuid": "b34dffd6-ac27-49ca-afe4-6b29dd74e374", "comment": "Malware payload (Mirai)", "value": "83d67edf633a3dc3ca2d89df5ecb211a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683464, "uuid": "fd015176-4128-45bf-a71f-f5e643a2b0c7", "comment": "Malware payload (Mirai)", "value": "836e54183a4a4efa7829b760e1287c33f6f129bf37397e007526c44b929535f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683464, "uuid": "06dc26c8-b794-4156-bfe3-617aed8ac049", "value": "T1F6430845F9818B13C5D412BBBA6E128D376557E9A2EBB203ED216F1037C6C3B0D37A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683464, "uuid": "80361181-cfe3-43d4-be62-b775aaf3dceb", "value": "1536:mSoQtQX54GF5iejSTRWZHNGZ7n9Fr2GfTXc:4pPrjGRGtIL9Fr2GfTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683464, "uuid": "4fa8f98a-cfb1-4353-9b1d-7282e3e2bded", "value": 58520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683464, "uuid": "845cfd1e-9d2c-4d35-9d09-ec5152c8db37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2265cab9-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745683469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683469, "uuid": "cfe503a9-5479-4204-a195-5d3333b071cf", "comment": "Malware payload", "value": "85d182f9b9b7aa807c902db3e6e2a16f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683469, "uuid": "88ea87a6-72c2-43ca-b554-bcd6d6dc6222", "comment": "Malware payload", "value": "b4b771329724cb45cbc7dd13d394203eb4e472a5551e6621cbcdf37e9a48df7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683469, "uuid": "d66c1407-fdd7-41e9-98e3-b0e93dc2b8eb", "value": "T1E795339F9BE964B3D0774AF9EF26D603D1787953069874782DB2C22E0F37682B2D14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683469, "uuid": "941f2ff9-ef20-4c36-85ae-6ab253422916", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683469, "uuid": "5ec3b2c1-659f-4a6d-b65a-6ad14ebfcfef", "value": "49152:teiL0tEGNH2kbxC2lJfamF3ftTZTo1WvZQdKpgeNQ:MiLOE602PaCFTZTonA5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683469, "uuid": "606b001f-9b58-41d6-a0b0-00a0be583c3b", "value": 2060288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683469, "uuid": "6da3bf27-b4c4-4869-88cd-95f822c80692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526fa1c7-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683550, "uuid": "71f1c25f-74a5-4576-aaa6-3c46fa9da8c5", "comment": "Malware payload (Mirai)", "value": "458cb706216e6b3f774a8503e763427f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683550, "uuid": "db5cd184-20a0-4290-b10d-a404562b5eff", "comment": "Malware payload (Mirai)", "value": "6ab6971d56826925039346b78bd1a975fe72e18bedb451aa4d27dbcb8a301477", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683550, "uuid": "e4ed67a6-d452-41ea-8ce3-61f126248d59", "value": "T115433A21B6790A17C0E0647911FE8B29B2E256DF65A8C61E7E320F8EFF519C06943D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683550, "uuid": "1c80486a-5642-429e-be04-2e33423c2b8a", "value": "768:AZo8kzP+GCExw0hgKKKGx/ruT85tf0aEpFI+6AQZiXpBlPfO+bUMvwJ:AZxkzP+BEx/hgKKPzuTot0aEpFpjCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683550, "uuid": "e099dace-a09a-4960-ae35-377b0664bdb9", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683550, "uuid": "83d3df4b-0146-4b41-8dba-28c4d4d216ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f16f16-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683586, "uuid": "c43d3f45-8f9d-4159-a86b-ec4a4de90aa3", "comment": "Malware payload (Mirai)", "value": "49541617163ec14183b8af7b71ece952", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683586, "uuid": "55d32e85-a442-4fd9-b10b-70c494f76b97", "comment": "Malware payload (Mirai)", "value": "e381966d0b8b9c32fe6ecea50fcc100d2ad0613867e1c259f232d4feaefa5006", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683586, "uuid": "9cf80414-b41d-4944-a657-312e35c730f1", "value": "T1FB733A42730C0E47D0675DB02A3F17E1C3BFA99121F4FA89651EAB8692B1E375186E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683586, "uuid": "1493c490-5382-40b3-bb0d-0fbf982a7d3c", "value": "1536:TrMvNNEh1xHHNR2YvkG4jPIFyJIgwDskDWcWUiSiCRt:EkR8TcFyJIFDm8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683586, "uuid": "8464aeef-ce5f-466b-b164-88fa182cf44e", "value": 75600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683586, "uuid": "d86d3a89-5927-4548-a5fc-53db6e6004fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f9598e-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683589, "uuid": "fa31f7e7-93cd-4990-83b6-b35abd9db85d", "comment": "Malware payload (Mirai)", "value": "c7a1f41adc647f47e7dfd885e3e04650", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683589, "uuid": "89a555ab-ab2d-4602-b1fe-1d46ffb37114", "comment": "Malware payload (Mirai)", "value": "69821582adc87ac2439fd19a124b8ed9ec6e66ac1767222343ac4aff5cace2c4", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683589, "uuid": "f3e79844-c893-43c4-8b6e-4c074499350b", "value": "T1343317CAB8029D3CF90BE6BA54164E0DBA2077C15183072767BBFCA36C721A49E12D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683589, "uuid": "3133b19d-da11-4434-b62b-8c955cb81208", "value": "768:8CPfHdPoaiRKMoV8B4243eileQTs826MwoFzwRaXOsE1KPE+GW:73TM824Vegs826M5wRaXY1K4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683589, "uuid": "08f2ca40-47a9-4cdd-98af-2f9a0f6ead64", "value": 54420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683589, "uuid": "d4424943-4b37-46d7-934d-55f1ce181fb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77832078-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683612, "uuid": "61d49e9f-18bb-4d8e-b41d-6e747740c616", "comment": "Malware payload (Mirai)", "value": "e99461b27eeee772be11f54e510fec8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683612, "uuid": "abed84f6-664f-41ce-b549-e2368b7a17c1", "comment": "Malware payload (Mirai)", "value": "8169318026c6937f0c819df86fc21a86dccfa92abdf91289f6edd43149677daf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683612, "uuid": "fc0634d0-0a70-41fa-92a6-4b1d9ce1e4b4", "value": "T1FBE33A46EA818B13C0D6177AF6DF424533239B64D3DB73069928AFB43F8679E0E636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683612, "uuid": "978346ef-4b8c-4101-aaad-54297d438b1e", "value": "3072:uqMtU0/pP6ufa6yCSeMlqbCiNrJWqjfki/6C2M/99i1bn69z+:uqM+0piufaJCSeMlMCIWusi/6bM/994V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683612, "uuid": "b180b843-ec16-4226-b418-c35b0d404c8b", "value": 157298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683612, "uuid": "0211806a-3064-4f9d-b8e6-ff5edc1cdde2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0dd5a18-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683735, "uuid": "59a6176b-5573-43f5-b7d3-a8d284410965", "comment": "Malware payload (Mirai)", "value": "c0fe49c0c9b5458ec13a5a81cda2601c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683735, "uuid": "5b4fe16d-5c76-4e1c-9778-e15a0b6d2eed", "comment": "Malware payload (Mirai)", "value": "1c5b16f01e0b677c85bc324f14f2d16992cd87289936d397cc18e9a186b92913", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683735, "uuid": "9768d37a-f7f7-41c4-80c2-f7b89dc4bbb3", "value": "T15F934B32773A1B23C0E1A47940EB8B3A73F69BC91A64820B7A651F9C7F55AD034437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683735, "uuid": "fa143141-5a83-4745-bb73-22cf9a10472b", "value": "1536:Vc2JQHIZvPAJBNxUYUUTVQpnM0RJUgpQoQoESS6kJ95k2j:ikA7NSYZYn3Qg2oRS6O95N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683735, "uuid": "4ce70cdc-31f8-49a3-aa74-cdafd86bafe4", "value": 94631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683735, "uuid": "4b52d350-436a-40f0-ad42-796849e8421d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14caec5-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683762, "uuid": "c375f431-9206-491a-9449-374a73d04bb7", "comment": "Malware payload (Mirai)", "value": "d44b495fb0d5d57a980d8b65a0d90f54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683762, "uuid": "43ef9e5a-4301-44b3-9d5a-89f377566e82", "comment": "Malware payload (Mirai)", "value": "16c7ec39c09f21c6af246642d69dffe2112870387fcd1596ad2ffa5fd56f25cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683762, "uuid": "a7718a0f-7bf9-4a21-aea8-3bbc35c0e5dc", "value": "T130633A85A363DBB3C8C70B7410E3E7364636F8D6275EDE03E7ADAEB56E4218470462", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683762, "uuid": "c6e8dc8f-bfb4-4e3e-a93e-d440e2466ac4", "value": "1536:yB320htcAToELpVQtZqQpPzLAUga2+ZrKMdP:A7htcA82QtN7cUga2+Zrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683762, "uuid": "bc904fd1-2156-40e2-934d-25c99a9f3d31", "value": 72392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683762, "uuid": "4e95adf9-86ac-41fc-8eaa-a82ad70e556a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff69d8e-22b8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683787, "uuid": "eedbe5c7-49b0-4f6e-a5c5-1eca39ce9772", "comment": "Malware payload (Mirai)", "value": "a5fad45ad687e71e07fb706b89c787ac", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683787, "uuid": "7a82c5bb-7ca8-4104-96c4-b94e877fe54c", "comment": "Malware payload (Mirai)", "value": "d1f826518cc242dabdad3d598673d162d994454c8a4c5b0ed966dbdceccde9d1", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683787, "uuid": "58daf27f-4e72-4835-9352-21b63645eca8", "value": "T1A2236B35E02DAE90C55A0134B4988F341F53F1C4D3532EB71AE646F6A887D68BB19F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683787, "uuid": "17920717-5095-48f0-8ed1-1fc29514aa5f", "value": "768:xa02CZEHq9teGtBLrDjUifWatTpdbb97aSCrocrRDmCOnw:xaJC8+NJYifzzzaSPcNmCOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683787, "uuid": "073430a1-21f9-4cc1-bc4d-bb1f6773c85a", "value": 48796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683787, "uuid": "db57c9ef-6e0f-4c22-94b2-dfd012c912b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50765c8d-22b9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683976, "uuid": "5a85a84e-f96b-47e3-84a8-df12bf64012d", "comment": "Malware payload (Mirai)", "value": "5d359123192de3d0f96d8d4bbae3f366", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683976, "uuid": "fb00fd25-8e44-4f09-bc3d-e182212025e0", "comment": "Malware payload (Mirai)", "value": "9eccf2227f9cf35f3b792d340ad4259ad19e5648d5ba3e928384be857d1d1ce6", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683976, "uuid": "c82635f3-46a8-49aa-8efe-56bd0d768103", "value": "T131A2E121B3D99996E1A55C38DD3042463B610F25F1EC713B294C23B8F7C768636B5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683976, "uuid": "370270e3-b27e-4be0-a349-9a386f1210c8", "value": "384:T/KjLUZ5GYekWo8Dvtd6QPVS1eTSLD11H44ConGjxFrvI0ghMfhymdGUop5hz:QSA1kWjxU1+SH85KGjxFrQ0Kws3Uoz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683976, "uuid": "d21ef8f0-8c98-4aed-b0ab-6eb81001c04b", "value": 22600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683976, "uuid": "7463fe33-9bbf-42cf-8e44-cf5403c8405e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e8887a-22b9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745683980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683980, "uuid": "5f37d769-2cb4-4d8e-90b2-a9a6aca77b7e", "comment": "Malware payload (Mirai)", "value": "fc938c36991770a3cd7188ad3ba652d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745683980, "uuid": "3255ac4b-cf7b-47ce-9729-ed7882d84a9a", "comment": "Malware payload (Mirai)", "value": "967184e40fe5ac0d167c49951a5472363252ec600b21c54a1d4370264f443d13", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683980, "uuid": "ed1f0eb6-84ee-4a56-b4cc-077b4e8f7416", "value": "T120432BD6F801DD7CF80FD67F4463490AF270A75511830B3A636BFE93AD722A40966E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683980, "uuid": "58c58052-01b7-48cf-bdd8-b3065f38fe24", "value": "768:N8e0pHIIShTkydvlHCNaI8nDvzVIv/+/8qZIe3jkx5Rh/qMOIHc:KFpHwkydvYt8DBIv/K8qee3jkx5Rhipb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745683980, "uuid": "88120667-870e-477e-ad4d-41ffa229f68a", "value": 56288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745683980, "uuid": "af83df61-16f3-4af1-bbd2-c1f1255dfcf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67fff1d1-22b9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684015, "uuid": "92837075-3125-4bf9-a3f3-952e34d61330", "comment": "Malware payload (Mirai)", "value": "f939babade1f9ca1ff035ecd09814739", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684015, "uuid": "a65c7df1-820a-4f05-a1e6-7705024d35a4", "comment": "Malware payload (Mirai)", "value": "da5b31e66c0b1c7fa47258127de53a707559bc30c5feddfd8afaaf16927742d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684015, "uuid": "be5aac9f-2216-46c1-b44a-2a570897e70d", "value": "T1C5A3D706FB550FFBDCAFCD374AE9070525CC690A12A93B367574D828B64B24B0AE3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684015, "uuid": "2988585e-f351-4fee-8876-b312d5abfca8", "value": "1536:kCTVNyBDWY+q3Kbv54v3pN7LJGlRVmxg+EgCAKZ61TcXyZ6Zn62r1g4Sigk:k0VNyBjGlHmx9QAKustgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684015, "uuid": "14a58485-a76d-44e2-9f2c-8c656476bef5", "value": 101476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684015, "uuid": "0fd3acd8-6875-41d1-8f5c-b9c0974a4520", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70327e1e-22b9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684029, "uuid": "2a053a2d-8df6-462c-a75a-ed5a1223a9c7", "comment": "Malware payload (Mirai)", "value": "fbf2305f161301479f5b57da337801ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684029, "uuid": "2f528f67-5cd6-487d-859d-cdcc08fb9cca", "comment": "Malware payload (Mirai)", "value": "fd7872458bd0d3ccd9442990022c48dfb8fffcbf8d72e9d9d4e21c5de2c15aa8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684029, "uuid": "83e6b76e-dde9-4410-95e1-7e122d1e593c", "value": "T1CBA33C07BFA10FFBDC4BCD3702DA4B11148DE95A23926726B138DE6CB65728E19D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684029, "uuid": "7cae367f-db7f-425c-aeb3-449899098756", "value": "1536:5KJXZaFiGDUFVnz5xCnlRsRZwjB2XQIPbDHft3v5dIxGw3FWyTWoSxZdS:5KJJ2ZDIVntYRCSjUDH9IxGoYyTSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684029, "uuid": "6ae3af9f-fa16-43fb-942a-8a8858588184", "value": 104082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684029, "uuid": "5537f243-7f8a-465d-9d00-d09db24de70f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9650bae1-22b9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684093, "uuid": "18d46032-2afd-42ff-af04-ef9919bf690d", "comment": "Malware payload (Mirai)", "value": "b6487448deff06356cdac5e038c0c97a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684093, "uuid": "08d8e180-d74d-48a7-b306-f96309d576ff", "comment": "Malware payload (Mirai)", "value": "111d871f379f6ab7df81e3c1a101798f2908b93ab540ca07395221cdd0f85a2b", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684093, "uuid": "75a1a03f-2de9-4c06-842a-a49f2a7608be", "value": "T1BD230260A353646BD1202D3DDEB12E032EC62F54F5BF307EB51B1968DE450427A3E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684093, "uuid": "978f4045-dd11-4abb-9ee2-22129b0c707a", "value": "768:Yi/CN83/GZkoc+w8a7NflvE8K6YApalO79q3UELT4kSUAcINFU+n1jNUWHAeif6k:YLo+ZkH+ja7NflvmnRLTTSlN2MD7ifJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684093, "uuid": "8e094be7-e3b5-4dc4-b6e3-c4ecdc28ae58", "value": 47000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684093, "uuid": "70ee49ab-d20b-43f9-a586-f3894730b574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a108c9a6-22b9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684111, "uuid": "a241e46d-e845-41ac-8423-702624ba6f23", "comment": "Malware payload (Mirai)", "value": "c26153bc312d2afa6aa56450dc84ca24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684111, "uuid": "8de5d532-4dc1-4b31-a493-9787ef154874", "comment": "Malware payload (Mirai)", "value": "d26ac66482c1d80333fa127dceae6b8993fcdbca9faafdbfae53f46eb343a613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684111, "uuid": "ce97d4c3-b6ae-4877-b81d-8d591a642f01", "value": "T1FDC33B46E6418B13C4D61775BAEF424533339794A3DB73069928AFB43F827AF4E239", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684111, "uuid": "95c2f5d0-8509-4e6d-b674-140ed830955f", "value": "1536:BunS+U32zQRcXaEJi6mox2OXSQ/ff2YeceNlCYiNykZ/pw8+2r+E9u2Vnd0w9ScS:MUmzeoTkOXSQ/ff2YPrykPw8+2qwxVlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684111, "uuid": "a33aeff6-59b7-4eb1-ba0e-9a45fcb5ab1e", "value": 120390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684111, "uuid": "17e6f76e-ac03-4000-ab79-c3a093f51258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4139208-22b9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684223, "uuid": "b7bb7750-227f-4b9f-a3a5-a49450653376", "comment": "Malware payload (Mirai)", "value": "15710f2cc564392442aea49e0913e8e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684223, "uuid": "849269e8-41af-48aa-9175-522ebcf7719b", "comment": "Malware payload (Mirai)", "value": "9c5593841bfd8b2fbcee77ae5c69e29d1b0cca15c4c3e10bcd67a516c8d5cd77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684223, "uuid": "a53f6440-8bb7-46a0-9c03-d6bb34a413a2", "value": "T1BCD2D13423235D61E6E40EF5CA2509D72A43ABFCE0961800264567AC4AFAD899EEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684223, "uuid": "5cb6e78f-af04-4110-80b9-25e1b3967cbd", "value": "768:RI6E31Mlspo7dqxDaVB3r8BSKq0tV4u1IW2F/aJRA2MU6lo9q3UELHm:BE31MlspGYDI3odUu15w4K2ILG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684223, "uuid": "a7cdda72-e0a5-47c7-a43b-9f4c02b30ef9", "value": 30156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684223, "uuid": "dd119693-4d0a-49ff-9a78-9c899e2fd60f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed834131-22b9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684239, "uuid": "bcbb7e6a-3413-4e40-be3b-baa43c9583d0", "comment": "Malware payload (Mirai)", "value": "0d6cd3f892e86596a5d5d139ce477dff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684239, "uuid": "25365d0b-1b09-41ca-99e0-8bf035eb85c8", "comment": "Malware payload (Mirai)", "value": "a90ee4d1eabd57645c3878b02d5368ca0731f45a6733738456b85c59dfc18cb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684239, "uuid": "b94b5ece-d152-4437-9f81-b078b531c4bd", "value": "T1A9534D4333180E57D5A61EB0353F07E083BEF95122E4BA89195FDB764A39E761082F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684239, "uuid": "190fe54f-e68f-4686-9665-b69f35c60ccf", "value": "768:IvGRSId6jqFTR8pfTRMLU1Y+a6ykY16LyI0b4Vh5OMCgFvZrVOHQ6/GwGo/xd42k:zZlFTkvW+Y16LNXvZq/Gyxd42+Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684239, "uuid": "e39ea4f4-f245-441d-98ec-f042bfc99297", "value": 62560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684239, "uuid": "61451018-6ecd-4614-8082-18a8caf71b03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6eda90b-22b9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684255, "uuid": "3a34e762-dfd6-4b6d-bd18-ad88fff683f8", "comment": "Malware payload (Mirai)", "value": "ce65363b1d5bb9b51f15d7265194b049", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684255, "uuid": "d0433bab-679a-4fab-b8f8-d9c14ed030c4", "comment": "Malware payload (Mirai)", "value": "184caea7d688db3cc8bf5edd906ce32dbe9046418242f76d29672ec5f2f8f467", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684255, "uuid": "fa324fd5-6f47-4e26-a6bd-799fede07180", "value": "T1C4331981B9829613C6D412BBFB6E418D372617A8E2DF3307DD166F10379A92F0E776", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684255, "uuid": "5d3b2671-6bf4-48fe-811c-1251b04ab9e5", "value": "768:398SGDG3qh2rey4ICxld0m0eRwhc1CAZURczMM1vzcEYanMXPhHO9vjVmi+I:mSqG3o2Ad0maq+RcJvjmXk9LEi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684255, "uuid": "1bfbbada-3b5e-4dcc-aff0-21371714673a", "value": 54896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684255, "uuid": "af5d6fbd-7df5-4061-88ac-fe04fc049c97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519b57af-22ba-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684407, "uuid": "067088b3-01ab-4b95-b547-5968eeafc4b2", "comment": "Malware payload (Mirai)", "value": "b7e225ee51c64331cdd956c45faadf70", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684407, "uuid": "90b2f1c1-1f36-4f33-a687-e012e8bbedbe", "comment": "Malware payload (Mirai)", "value": "2fdb7c5d88d956e78cc708da845896557e636f1df7b83daa3ee568f0630aeab3", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684407, "uuid": "b4293d5e-35f9-4432-8573-cf8a92bf888d", "value": "T1FBB2CF7C0A5244AADD4DC0F52AE243243C7B2F20E601EC9D7B66E696FEA752131873", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684407, "uuid": "c610d31b-b879-423b-8d70-431b2b86d43a", "value": "384:4LccVse+R2J0vpoHTdQou6GK0k8CoQP48YjkKvOqJh1trqaUHFuJgGlzDpH7uNj/:4IcVsev2vpfxKP4YKmqTg8JgGlzDpbuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684407, "uuid": "5585adfe-3ce6-4c88-ab71-b14733682221", "value": 24124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684407, "uuid": "fc7ca9a2-1c47-4e04-a598-53432a1a9821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537e4e03-22ba-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684410, "uuid": "9886ef76-d2f6-453f-934c-b28fdc9fbb5e", "comment": "Malware payload (Mirai)", "value": "8741d12611290e1873533162aca69f19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684410, "uuid": "9ff0f96a-e055-41d0-9a25-3179d4d4370b", "comment": "Malware payload (Mirai)", "value": "de99f20e21b2c70940f6b5fdc19a9497142fb4a43db46ac10464aa64bd075be6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684410, "uuid": "b9f517e3-b5aa-40eb-b26e-62e8fd5d0c85", "value": "T129F2C694B8824A37C5D803BAF76E16CD336073EA92CBB303D9105B647E8595B0D63F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684410, "uuid": "6718ca7b-6f14-4b24-83b5-c73faff16224", "value": "768:ZbUT7CGU3F72vZ/aQ3SR7mL2yscpnhRHxk9RHhvScnAyNc+24DEyZEspfwB+:Zbs7CGU3OaQydC/0VZdXLp2Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684410, "uuid": "8bbe580d-035c-4320-8583-348dee7a0792", "value": 35740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684410, "uuid": "b431ed76-f920-46b7-8a78-514d64729bf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c03fc90-22ba-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684478, "uuid": "3c8f0722-d401-44ec-86b4-798c9438de1b", "comment": "Malware payload (Mirai)", "value": "838a6d22387061bdd4900ddc16598997", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684478, "uuid": "61acdca2-8cf7-4b9a-badc-41fc3f9f5660", "comment": "Malware payload (Mirai)", "value": "f173b59a824ab72c12f57a3f3a65ea15dfa9035e0cd0e1f446a654cc14eb5ede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684478, "uuid": "11837a1c-c4d5-4093-8ea3-73db141da708", "value": "T11353F641B8919A26C6E423BBF96E018D373563F8D1DF321ADC112F6476CA82F0D677", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684478, "uuid": "f90f4473-e424-433f-9fd6-7f90cd569edd", "value": "1536:VnJqFMKFZfsoElxoc8IOFhNRjGnW3tk15huRYJR8d42+:JJFqiVOvjGW3yhu2JR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684478, "uuid": "38979564-8e95-4b31-8857-033f3a6041b9", "value": 66556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684478, "uuid": "dd76787f-4c1d-456e-8e69-e2f2d81995c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b4e1ab-22ba-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684496, "uuid": "402c92a5-9c5b-4ff2-b4e9-292738a9fe89", "comment": "Malware payload (Mirai)", "value": "0c0e464cb384640b432fb5353a5cfe39", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684496, "uuid": "53790479-334e-4ade-aec8-0b3bbcfaaac8", "comment": "Malware payload (Mirai)", "value": "3dbbe02ac1ec686ca99b2e75134efae7a3c2400bf95e09312e2f0ae943b4e1c1", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684496, "uuid": "f3d080ca-06e8-4292-b8fc-068d6c79b769", "value": "T105B2E0EDF9E61695CEAD1CB9550D01A48C01B489FBDE1F881726286CE32419F70AF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684496, "uuid": "5abc6789-a447-4151-af8d-895f1244cf84", "value": "384:ywY4RmtiRp/mNDdMn/CCy8pDUOE6Pv3PfU6fDqdNLBa08c8WML9WWRbb0jKRWGV/:yZimtiRcxCCAfPv06fONG70jWWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684496, "uuid": "2ca67c37-cc03-48e1-9caa-3634d6712d40", "value": 25340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684496, "uuid": "be6516aa-14cc-473f-90de-fcd1f8a64dc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9033e8-22ba-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684506, "uuid": "e89fc18c-52c7-4ccc-9fe9-b7637d751e67", "comment": "Malware payload (Mirai)", "value": "6dd78861d1d2cb40645c39458e72f6bc", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684506, "uuid": "2d67b95a-fddb-4fe6-b36a-b4770962a81a", "comment": "Malware payload (Mirai)", "value": "965ec3b5720b36dd6dd27037f8444abd9cc8c2cc88615dfaebd49418fed9d9f9", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684506, "uuid": "dce54043-440c-4525-a413-d435f0d7d3db", "value": "T12FC2E14145AFB962CD70047ACC5D84DD17818BFCB0BAB636169006D96ED2E424FF5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684506, "uuid": "d5cfc356-2de0-4ef9-97d8-1e7d5ce76fe2", "value": "768:Tn5ecZTywv+9ikQ73uzv6ag0Sbw9q3UELHo:j5bT9+9jG+Rg0Sb5LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684506, "uuid": "176fb0b7-3991-47d0-86e6-c9c91e85245c", "value": 27676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684506, "uuid": "20a41fe4-e198-4314-80cf-e248d9bef192", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d68e301-22ba-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684508, "uuid": "714dd85c-b94c-408b-b449-31572ad5c782", "comment": "Malware payload (Mirai)", "value": "a9a9e60d8eb0d7852a98d56f731ec089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684508, "uuid": "bcf104fb-00da-411e-a1ad-21aef3f93596", "comment": "Malware payload (Mirai)", "value": "3d8dbb57d5926f1b6cd06e5ca4dedde85e509d8be6b24f1ee20ca2c5465499c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684508, "uuid": "00b1f57d-1007-4e4d-a1f8-7a8e5f8c04fa", "value": "T18FB2E1719E886BB6D3B15C36D7294E90073607FCE4EBB050247CA6B4675AB0EA4F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684508, "uuid": "c0e4fd04-6567-4039-a94e-691a1068108d", "value": "384:uQbyKPlgQydfT5JU3HulTOY3Ax7lrA7TdA/k30t62UFahymdGUop5hs:uQby8lgQujcOlTOeGM76k30jUFas3UoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684508, "uuid": "3b35d83b-00cb-486b-b988-eae695b66258", "value": 24556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684508, "uuid": "2b1d5320-d5d5-40a7-9fe1-5fb342203027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4403a421-22bb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745684814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684814, "uuid": "0c3af371-5346-4db0-a324-a681a3f47a76", "comment": "Malware payload (Mirai)", "value": "8d5f693e0dd49eedbcd4bac38789c48e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684814, "uuid": "6dda30a3-9a73-4fb6-9386-d88586f07abc", "comment": "Malware payload (Mirai)", "value": "2bb0985e49bbd7fa74a5c07f171bb07484577e4bbd71c553c575ffd2336f1482", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684814, "uuid": "1a8ca9dc-709e-4432-92c9-855bd5c1bf50", "value": "T1DAB2D040D8519FEBF2BE7EB42CA5D784A3D11E9E2AC2C832E1D25B32637703592749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684814, "uuid": "bb99bfc4-d487-4798-b95d-53ae8a22f7cc", "value": "768:eIlOMsC8eQOiPGeRZXB5b1KAAE5j/G5ct4uVcqgw09E:eIkReQAEb9n5qyt4u+qgw09E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684814, "uuid": "56c9cee5-f2df-41dd-beab-797d14707fd6", "value": 25068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684814, "uuid": "0b34d833-a274-4b51-9ace-d68cbfdea35a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48da494b-22bb-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745684822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684822, "uuid": "14004ca1-ecc0-427b-9fa1-16b0c592e7e0", "comment": "Malware payload", "value": "8d33d45a4381b827805859ae0203f0ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745684822, "uuid": "eec38f04-4b9e-4fc1-9d19-d4d2d9189726", "comment": "Malware payload", "value": "584fdad1c97ccc9d201ea497404ba1700423f5a794e5cc042d5a942118b31a18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684822, "uuid": "8a0462d5-9ae1-45c9-87c3-a72d182e3f89", "value": "T1DC532ADAF401CE7EF84AD7360C564E097771B3D106931F2657A7BAA7ED32188291BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684822, "uuid": "c272d8ec-0579-437e-abe6-048d55680212", "value": "1536:9hNICoi9c8MrunAGLzQQeuacWjcW0JcWcByBEGNtkYTTmJmzxQwe8ZfKHX3T:DNdoi9/QuPQQeuacWjcW0JcWcBaEGNtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745684822, "uuid": "d61215c7-8d33-4ecd-a753-ac5a8a1552e2", "value": 64476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745684822, "uuid": "a28ee477-10d7-4e68-a71d-bbca3b6e4784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717d9075-22bc-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745685320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685320, "uuid": "c5ded171-e688-4577-af3a-d3616d4836d5", "comment": "Malware payload (Mirai)", "value": "e3845ee03f44ce1390c07278085bf943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685320, "uuid": "8502dd9b-bd41-4ab6-a529-00e93c0eeafe", "comment": "Malware payload (Mirai)", "value": "559f3ec8efd9b1d437b4a2c96040ec2051125cb0a55e103e901dfef48dd324f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685320, "uuid": "d67a011b-b880-477c-a284-71c0007862ba", "value": "T1B5C2CF3DE283199CD44EC8FD17B403602FFA1BD6D657CC9E2A99D65BCE418A839C22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685320, "uuid": "92548f82-4263-41af-b39f-1b02779189ad", "value": "768:lBIo4VCzxYsG+BttcyuRGgSqiQZBqFaJgGlzDpbuR1Jy:lBIo/zxPGotRF96gUVJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745685320, "uuid": "66058ff2-bdd1-4b3e-9e38-affc3aadb827", "value": 27524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685320, "uuid": "1aaf5de5-50dd-44ad-982c-2f7e27702ce5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f503e928-22bc-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745685540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685540, "uuid": "02f2acfa-cc21-4f65-b6d4-de1873877aa0", "comment": "Malware payload (Mirai)", "value": "f3fb54383dd34252802620bab516c586", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685540, "uuid": "13c1b001-e987-4430-be2d-1e26ecfacce9", "comment": "Malware payload (Mirai)", "value": "75ab14549fb27a8efbc6df19c11adcf0ce5d6765250ba9c0d2840a607c5cd06c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685540, "uuid": "79e59aea-d105-4501-ad5e-794889e77a7a", "value": "T1F682BE2022887472D674C8B9EE3EDB42B79A1BFCD1E3353322864B6CDB451CA11759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685540, "uuid": "de51ad92-e290-4544-9d12-aa2a8394d429", "value": "384:nNqDrwfJiILEz92SdRskh5UzKkKxhymdGUop5hu6:cmJXU9ddRXbCKkUs3UozM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745685540, "uuid": "f0c9edd3-bb85-4538-93f5-68733eb7c809", "value": 18904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685540, "uuid": "466acc31-2539-4ac1-8fde-bc5ae261e927", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798eaa7a-22bd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745685763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685763, "uuid": "570935cf-fbbd-4da2-80e7-b4bdcf0c8f46", "comment": "Malware payload (Mirai)", "value": "31caa9f00eecdbef2a11ab6fd6b085ba", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685763, "uuid": "c20a9ed4-29e2-40af-a44e-6bafcf50980c", "comment": "Malware payload (Mirai)", "value": "fac9e1639f12e59cf012ee868546c5163dd0fc2d3444d3dba67028a7dc0550c7", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685763, "uuid": "f955c3d2-77dc-4cbb-9398-7a0f9408c0e7", "value": "T135A2CF72D3C24D01DFEA6DF8544ADDF6AB680F08CFE9DE92E455BF520603C06A14A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685763, "uuid": "2b821272-4a46-4df0-af67-b6f52c0c4410", "value": "384:7rLjufWJJZwH79o4CEtM83/5Dz4ffpNYlWEfBcz65wHq5arTbM4uVcqgw05VxJe:3Xu++H7WeYa2zAiqwHI4uVcqgw09A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745685763, "uuid": "8a65293d-4815-4980-b471-7d652228a67a", "value": 22208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685763, "uuid": "34c32f92-9777-4410-a8a4-fe2f5dbd6ae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd46845d-22bd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745685903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685903, "uuid": "058f68c1-7325-4891-a3be-2dee51c6c1ff", "comment": "Malware payload (Mirai)", "value": "0a3c18acd2a3fba4ab84fac78650843d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685903, "uuid": "7982e2d1-cdfd-4d56-aa17-25d529d4358f", "comment": "Malware payload (Mirai)", "value": "ed475281b3c1e64185ee74d57977480f86e9072c167dea68f1b456a3ac9640ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685903, "uuid": "935a89fc-6083-4366-8df5-91bec5de344c", "value": "T12BA3D71A6B118FACF68E923107F79E31566527D227E2D141E15CDF102F6238E6C4FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685903, "uuid": "c0727fd6-fc10-42c0-8548-441ea86586ca", "value": "1536:uRGS+yaAuiJArwM9k39m0mq33BiCRAjM0c9mpxzPS:7S+yMvcmqhqY0WmpFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745685903, "uuid": "85444d29-ca8b-46bd-b282-3c43d716b0b2", "value": 102210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685903, "uuid": "f3519a6f-6ac9-45f9-a201-68dd52e942f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07161a8-22bd-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745685935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685935, "uuid": "1ede670a-cc0a-4d45-9b9b-d43d0de432bd", "comment": "Malware payload", "value": "3866cea2b577eca8451679a6175d270b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685935, "uuid": "da07b95b-9c29-4c3e-b611-5a2c22616ded", "comment": "Malware payload", "value": "13fc52cb58ed8d39c210fe8e08ad28ca7656b63264656fa958d9ac9917400bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685935, "uuid": "f239a389-4f61-47a3-97ae-3d1ad1c5ea84", "value": "T19F25F119D32980E6E29705B24A497745F4737C3387385ABF22D0F3313BA67C06EAA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685935, "uuid": "dcb6425e-77a4-44bc-9936-a451e6d94d1d", "value": "d6937b39d566e5795f3eb7422ac303be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685935, "uuid": "94fee0b3-39eb-4735-8325-25c0fa860322", "value": "24576:GnCen7vb64RSEvpGFprltOKb64RSEvpGFprltO:Gdn7z6plvOM6plvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745685935, "uuid": "78356a00-5a18-4eb3-bb5a-41467a510401", "value": 1019392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685935, "uuid": "2debe6db-9f78-45ef-8aef-5a5437e9836b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5871ec2-22bd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745685971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685971, "uuid": "3934f6b9-8323-4b01-9b88-6c848236afd6", "comment": "Malware payload (Mirai)", "value": "dede54eaad9f435f558a33ac5e8fe0c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745685971, "uuid": "4788e30f-dd3f-4b33-b366-401d9ef1db29", "comment": "Malware payload (Mirai)", "value": "fa3d4b8df827df26ea1cd25ea3944b80944e058579c3ebad90a993d77b63a7b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685971, "uuid": "a48978e7-ff35-4bce-8598-ca7dfb2c29ec", "value": "T159833A4273290967C0975DB019EF4FF187F6EDD02AF2B205A62D7FA40B72BA11885F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685971, "uuid": "b8c15c12-3ce6-43b4-9d6b-e4eb685013d0", "value": "1536:4dN/vFI2NQWgsaTsWFVl3C9X6ybe7MVGVTIp2v:i/vCgQWg9sWFVg1bZQVTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745685971, "uuid": "36be0ae8-4444-4f42-b96d-c1770d79283c", "value": 82366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745685971, "uuid": "14b4e808-92aa-46d2-a8b3-309a6f43d9c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aff715-22be-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745686159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686159, "uuid": "9d35c645-da80-44f5-a43c-1b589ba5571d", "comment": "Malware payload (Amadey)", "value": "1ae6fd903f8273b2396cbf900a69d47f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686159, "uuid": "d33da55f-5e39-4bef-9ee7-4f2cee99145a", "comment": "Malware payload (Amadey)", "value": "55b2b981d591217035feded0e04d7704ee0ebb0cb91d22eb9201b5c934dded74", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686159, "uuid": "5281bff8-1489-48a8-b215-b9bc90b1682e", "value": "T1C9A53347A3F8E162D4655B7008F901D30B75FFA02C34C36797572CAA14A26A6B93A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686159, "uuid": "909c970d-b368-48ee-9739-f736cbfee86d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686159, "uuid": "caacf551-2501-459f-aaca-417c3702518f", "value": "49152:Ks75CROk/uNLM2TH1pDDbRKCweQTpJESCWxICAPpvU5nOms:pkmNIMHL2espJES/d+vUBOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745686159, "uuid": "b23722c5-bc3b-4abe-9800-bc56fa2128e5", "value": 2200576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686159, "uuid": "d5fb981f-cafc-4eb1-90d7-1646fc92ba70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f2b723-22bf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745686460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686460, "uuid": "e32afbef-f18c-457b-b3c9-ef3c6f1e0984", "comment": "Malware payload (Mirai)", "value": "76ed410da5f6013b3d9a96aaf983bd75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686460, "uuid": "fc602de1-2322-4f25-864e-7921b71c84d6", "comment": "Malware payload (Mirai)", "value": "08f99387c63c955677790f92719f8e4cc8136d696719d5cd17f99136941265b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686460, "uuid": "1381af4f-d2c4-485a-b7ca-18a01c6795ba", "value": "T18D534A26397A2E17C0D5A47A25F34724BAE9635E21F8C61E7CB30E4EFF14B50A0471", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686460, "uuid": "31b8a960-8d2e-43e1-970e-1375c12ec603", "value": "1536:aQfooXw2iq4ewIbjXS80WbYTRGaCWOpGapqpdYm+e:Db3i85IdCWOpjwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745686460, "uuid": "61dd590e-b984-4583-bf93-64bf2ae6df03", "value": 66568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686460, "uuid": "e8ce9940-4b9f-4074-bf52-443d2c1a4321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5045dd48-22bf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745686552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686552, "uuid": "810b55ca-55b5-42ab-a527-473f537e69a5", "comment": "Malware payload (Mirai)", "value": "04b94d25b39f8516464e32025bd5c5d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686552, "uuid": "a6a1869a-5327-40fa-b568-b751a5e030af", "comment": "Malware payload (Mirai)", "value": "ba174aface1ee48ccc371c889fd2755584c56479a970826680e0289dce42d5b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686552, "uuid": "d6691d51-fae6-4d8d-b5ee-274df23abf48", "value": "T19A92C0B0218B50B0CAF08C75A69ECF81A35157F5E2EA707139442ABA748710A7D7D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686552, "uuid": "ca6d9b4d-6c92-4ef6-a861-d96eafa520de", "value": "384:UsfB69pW3Rfq6BFtC9dxkK+L/h4xPdhnP1pHrTA4ZO/sNhymdGUop5hB:Usf49p4fqTNp+rh4t/HrFOCs3UozL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745686552, "uuid": "689e303e-6bdc-4834-a70f-0c72aa74da31", "value": 21136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686552, "uuid": "ee78cdcc-075e-4226-847a-e2b1abf8cf41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648527a2-22bf-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745686586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686586, "uuid": "94327ae7-83c9-44b6-926c-15784ff4eb13", "comment": "Malware payload (CredentialFlusher)", "value": "8c4a906d1735407b6a987038f6b412b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686586, "uuid": "53a3c212-efc5-41a1-9a00-c59865bb12e2", "comment": "Malware payload (CredentialFlusher)", "value": "f4017d83286c4b4ced6757c88b1080b4237320b572ca80c886860c443e347441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686586, "uuid": "92020630-33c6-4fa7-b078-c0958af8e9da", "value": "T184259E0273D1C062FFAB92334B5AF6115BBC69260123E61F13981DB9BE705B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686586, "uuid": "0622dc0a-2428-4290-a313-1aeb3590c1f9", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686586, "uuid": "f6b9994f-42c2-4f53-a74b-b33ce19d9918", "value": "24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aupCKrFK6:CTvC/MTQYxsWR7aupRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745686586, "uuid": "101c287c-cadf-4d54-9312-b3661f345b73", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686586, "uuid": "af9a1113-7c5e-44dc-a1e8-f4e1a34d77d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895a7f46-22bf-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745686648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686648, "uuid": "d3c4e219-c88c-4fd0-905b-b7bef546b1ba", "comment": "Malware payload", "value": "6291ad9a61898778a505d8189ad208f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686648, "uuid": "a5036da5-ae19-4587-a5ee-c7947b62d69b", "comment": "Malware payload", "value": "2fc4fdaacf0355b5a7ecbb0af54ee83d9ebe705601213d9c6f9ca61a255e1964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686648, "uuid": "b9cf8a18-c236-43ae-a367-fec5cb3c029d", "value": "T1DDA5222FCC3D3673C78A643146BA4E9FCC595E6C0BEB4A1B4ACD02B0B0971D5B894B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686648, "uuid": "2f6ea818-ee82-42a3-be01-15d42ce9ef15", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686648, "uuid": "a0a0ed3b-9a1a-488d-a06c-b1a7d1ef2c2f", "value": "49152:c0sIvBECa2RWHh7FDaTLC+1sAzEnkFb5cJpw:FjaRdFDfAzE9pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745686648, "uuid": "1667a403-584b-45d2-a5f7-8490363f403e", "value": 2099200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686648, "uuid": "b235e3ac-510c-470c-9dc3-393309bb12c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c99455f-22bf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745686654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686654, "uuid": "7fc79fb7-a837-49bf-be16-1139ccb64406", "comment": "Malware payload (Mirai)", "value": "84fce2990b14c985299ce052afe308b8", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686654, "uuid": "5a577037-19f5-4f55-87a8-7d5bab7ed5d5", "comment": "Malware payload (Mirai)", "value": "db50cafe6aa0a59072c29d00fd2bad4c9a0add9344f0b63b077c261c7869730c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686654, "uuid": "33ea601d-610f-4dee-8ed9-6c823e6fd1fa", "value": "T144B38CEBF2471190C86246F007CB8BED3E2323825F2785E73C6A657959791CF8906F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686654, "uuid": "8ae12b1e-41a7-45e3-98d2-a1a5639336dd", "value": "1536:sh8418CBqX6SpXxD4UFpfeOLIWggmc/LWT:s2CQ6yXh46feOcWggmcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745686654, "uuid": "5b0ffea1-206e-4dbb-9840-6cd76e0d8e6a", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686654, "uuid": "28be57bf-23cd-4777-9b27-c8a77dd10018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952517b3-22bf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745686668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686668, "uuid": "4f2d15c3-4d3f-4767-b919-06bc22495bd4", "comment": "Malware payload (Mirai)", "value": "68c658968f9dd359be00ff9656c29c79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686668, "uuid": "1c90853a-5bbd-417a-863a-267c647ad96b", "comment": "Malware payload (Mirai)", "value": "aa69e4a405534d4f76e3c9ac9a1178112d54e959505770f573169d949dfa0e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686668, "uuid": "fac26e0c-872c-4a8c-968b-490f58fe0000", "value": "T145A2D0BC4B4745AAD5AEC1F683C60B611C151FA6A922DD0F786AC5C7BD261E07C13C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686668, "uuid": "c369e0fb-feca-41dc-96d6-68fdab1e08a5", "value": "384:HPgkCpaPZBND5oDWsU/rO1NCGxU1hhAFuoLyJgGlzDpH7uNj1Jt:9/PZB/UWsU/rOmSU1hhAFuoLyJgGlzDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745686668, "uuid": "58b27196-8663-4a40-8a43-5835a90a6b2c", "value": 22316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686668, "uuid": "e5711a55-3f17-4066-86be-22124c1f16a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f4cc1b5-22c0-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745686900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686900, "uuid": "f976268e-f4e7-4507-b0e4-b68f6b3dac97", "comment": "Malware payload", "value": "8478d7fcc5f275790c8c95f521bf6495", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686900, "uuid": "4f321e18-629a-4b3b-a48f-f38e7e1c53f7", "comment": "Malware payload", "value": "f22e60276ed43d770d9d1304a9672fb23736217d6d9bb92236c07bd10aa12634", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686900, "uuid": "805a2e10-f3fc-4be2-becc-3031b611c96b", "value": "T1C2953341091694F2F1AC8BB887B82B57C16C1BE1EF2DDFB497086F95C512EBB7D069", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686900, "uuid": "7bba046f-282c-4672-83c1-5bb16be07200", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686900, "uuid": "f268f265-102c-4890-bd62-189837d7b751", "value": "24576:ZhB1/oMWT4vJUTJ+vrNxRz/BoIg180B1x9A5kfwiPDNkpI5Tiz6CQh91U:ZhmTCJUT6NK80T2INie2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745686900, "uuid": "e54f38af-71e7-4420-90e1-58ddf4b708f1", "value": 1893376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686900, "uuid": "23f9136a-5081-4cb5-b039-459790006d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436b89a6-22c0-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745686960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686960, "uuid": "cbc2d4d5-91ee-40e5-90a0-242bc7720eeb", "comment": "Malware payload", "value": "db8eda7d4f4e460766e2bd156782f3f0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745686960, "uuid": "1983d370-d977-4c3b-9566-850720fbabb3", "comment": "Malware payload", "value": "0d3dac5da5e4199d7d699d1528f0403a38862dd0b7664cd90cc2171932faf550", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686960, "uuid": "1ec5c611-4ad9-44d6-9ba0-08561e5555d9", "value": "T13C36339F154DDCE0E89E1170A5279AB46102AC26C9FF4CF2FAD5D73D91B32A842B70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686960, "uuid": "315706f0-6be1-47e4-8d3b-aeed7d795c55", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686960, "uuid": "8529aa79-5dc3-4507-89ba-f038a863756b", "value": "98304:K+Kcb81cwjSi//awZ3VZCfXHsdazo5DCyiwJMrbMUmZqP1o9:Wcb81cCv/rQfXq5DCyBJMnMDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745686960, "uuid": "91d7d5ac-e763-4fc9-aedc-482454de9719", "value": 5108224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745686960, "uuid": "458162bf-3157-4913-838d-35bf1c8da8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f18107-22c0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745687129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687129, "uuid": "3b999bf2-2d14-4b56-ad89-e434bf346186", "comment": "Malware payload (Mirai)", "value": "8052e6157334d50e0cd2d3ce9884ac71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687129, "uuid": "86448e8b-26bf-4901-98da-61ac751302b5", "comment": "Malware payload (Mirai)", "value": "f76e6cf4327daacf6a337662412f4f2ee2be00ca2b587cdc28f10b3d23fb345e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687129, "uuid": "9a455bd0-2edc-402c-9ed7-becf989b8f5f", "value": "T12A333C35B6361E17C0D2A47A21F75B14B6E116DE22E8CB5B7D730E4BFE61540A803E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687129, "uuid": "06c09385-5902-45aa-9e72-938510b0205d", "value": "768:Gxo54RPsFKVrp9XH+FPAOCcQOdPfElDE6Gf50oiUO+BoaFDwv:GxVxscVrp9XH+FPLCCBWgCoPB+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687129, "uuid": "fda3967e-4d95-4fec-82a3-dc7e50fbe76c", "value": 51504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687129, "uuid": "a73f5f5a-031c-4eb7-abf5-9995c58a3fc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fa3e563-22c1-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745687410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687410, "uuid": "2f631a1c-e049-49ac-afd3-b70a2f0c4e8d", "comment": "Malware payload (Mirai)", "value": "2a84e9934c8f3a212fb96507cd2919ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687410, "uuid": "d38fd6ff-7626-4f47-aa82-eddf54f58e85", "comment": "Malware payload (Mirai)", "value": "2b118c3db4b99e767784df21b275efdd55296b7cf0e8a6264a886a013153d93c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687410, "uuid": "1b572f57-8ce1-46dd-b3ba-eb0effb2f5a6", "value": "T190B2E01C8A530F4FEA66DE3D896C9EC981448CB6A7259C073A18D5D67B8303C867EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687410, "uuid": "2829729e-682e-46da-a80e-4eab6b757570", "value": "384:MiMkMjhknOtxUuwQhst8AjDQHlyx+hNMiA6Zelo8++zGF8HP43Lv1Rm:XMVzxTTWt8KMyx+jMiAOeyKKFxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687410, "uuid": "418dc40a-d955-45d4-a4cc-c65858d40d68", "value": 24672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687410, "uuid": "302791bd-9695-4433-900c-d68f95ec321e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d71442-22c1-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745687419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687419, "uuid": "974b9725-ce51-42a9-9fd9-8cdff0563b14", "comment": "Malware payload (Mirai)", "value": "b6e41eb35be82124f00120d3cba78921", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687419, "uuid": "8b2e9b25-ea0d-4568-91e0-6e26a25a07eb", "comment": "Malware payload (Mirai)", "value": "f8bdf4696b96d3b8c4219738f3b9450c39fba6b92a2940e5f8126c8ea83e5ae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687419, "uuid": "d1f9b410-5d57-4be6-8c97-479473898b92", "value": "T154C2D16C1502409DD17BE7B7A7E587807B600FF6668BCC9926B4CA92EDF61A0E4037", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687419, "uuid": "088668d7-d38a-4f5b-ae61-9d458f16bfa4", "value": "768:M3QzD+6COjrB7W1cTUN+OTdE3BajZcym+MprEXr7zsQ9SJJgGlzDpbuR1J9:46l3B7ycTUN+OAaZvMxEXQQs7VJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687419, "uuid": "24b8c98a-a93f-4b07-9471-b1fc92e296b8", "value": 27824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687419, "uuid": "3843df36-3cf0-4047-b3de-ed5a270a93b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69df1c35-22c1-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745687454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687454, "uuid": "b918c56d-9e6d-40c6-86e3-d448d5e18304", "comment": "Malware payload (Mirai)", "value": "40e06d09dcfb4d7bfe1cf8d697cfeffc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687454, "uuid": "69085e2d-dab5-4c50-93fc-e31c19440220", "comment": "Malware payload (Mirai)", "value": "860355763560804e3e643cce69b57703fa6ce67f37d201c6ed0f46dc1e66828b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687454, "uuid": "0c15fd7e-17ee-4c9f-9648-48b95b5819c7", "value": "T166434B22B6751E13C0E4A47A12FB8B29B2E257DF61A4C75E7D720E8EFF115806902D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687454, "uuid": "414279b3-e0d5-488c-9fe9-5e3eaa5d4c45", "value": "1536:jYXdc1pmDcmexleigKKz1WyvMasMF4wfG1GLVy:uKiKKHjF4H1og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687454, "uuid": "0ce0d931-c05d-412c-876c-a15df53ba865", "value": 56624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687454, "uuid": "3ada5983-da89-4d10-9b0b-baafa8e84087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9d7f7d-22c1-11f0-82df-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1745687459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687459, "uuid": "6349f94d-fa31-4ab2-9f1e-2c45ffa1791e", "comment": "Malware payload (ConnectWise)", "value": "c81781c144b29c81c8630cf72a7576d7", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687459, "uuid": "67ad54bf-725c-4d9e-9d3e-33003531bfa2", "comment": "Malware payload (ConnectWise)", "value": "58dd2f541b6405ea7b6b79759c9e7b680290d611ad3802f515953c6a5041f1b5", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687459, "uuid": "a96b8378-6676-4c08-8324-091d412ed12f", "value": "T1BC646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687459, "uuid": "c67250d4-d717-4142-bdef-44b2171285ad", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687459, "uuid": "1c850ee2-1ab3-4584-aeac-ea9c48ef8697", "value": "6144:NmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:o1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687459, "uuid": "4c9fa617-f888-47d2-a5e2-df3840c31424", "value": 312584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687459, "uuid": "dd011895-347b-4a5b-8515-1894e8a806c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d02602-22c2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745687771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687771, "uuid": "c542a6f3-6182-41c3-95e4-9c7cc989e284", "comment": "Malware payload (Mirai)", "value": "63190bbed90a7a23ab934594d8853026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687771, "uuid": "cd2626fd-80d4-43a2-b207-b58534c3114d", "comment": "Malware payload (Mirai)", "value": "209e6bf4b19558d89d786b883d1a51cb237389078a34ecaf3c55095457538961", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687771, "uuid": "c72f158e-9924-49c5-8e17-137ddff870d2", "value": "T175D2D08E62187486CF6D8C3F62AE32B52EB2D1C252ED4B09F7144C94AD2D98F64170", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687771, "uuid": "b4e8d483-827a-4cd9-b673-08e6f22a4549", "value": "768:yXBQkAxetAExFw1bR75+P9c2Mj/QMv8Ij+WZs:KKwA3MMj9xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687771, "uuid": "936af4d2-3fcd-4e4b-8c54-6d527efc0acf", "value": 28872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687771, "uuid": "9950fca9-1899-46a2-b2f5-c0c8d6f719b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a512d32-22c2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745687858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687858, "uuid": "b89740a7-74fc-4cc1-949d-30ddb6b0ecb6", "comment": "Malware payload (Mirai)", "value": "3a851714508b22e3cc08d245b3d84a9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687858, "uuid": "716cd5a2-dec6-40be-8984-7632d35e1ac5", "comment": "Malware payload (Mirai)", "value": "877e36d4037aaf93e13ae008f182589f792130d91f7be59a97faa4e8e051565f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687858, "uuid": "c998985d-27fd-41aa-8954-e5b0c9e9382c", "value": "T1014318DAB8019D7EF81FE2B9501A4D0DF921A7C112834B33A7B7FDA3AE721945902D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687858, "uuid": "1301e00d-b9b1-4a68-99a5-eea1a0fb7548", "value": "768:QweLujurUhfoxZlCwhORceqJ8TY8yWNjAz2VYXqR8ZVkekGEGw:nuuYeAxZlCFR4JUY8yWNW2VYX48ZWCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687858, "uuid": "c1df798e-a565-4d37-8b6e-f848bb39402e", "value": 56052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687858, "uuid": "1333aadd-f52e-4a53-829e-21888dc18960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994df156-22c2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745687963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687963, "uuid": "f27f1da5-ca1d-4b4f-a084-72fe3cd428e1", "comment": "Malware payload (Mirai)", "value": "5e1b225a770096d5cf6317fec0babae8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687963, "uuid": "a0063a67-6318-4507-b032-d9ad0e7c2ebd", "comment": "Malware payload (Mirai)", "value": "4551b75621c29aafe44faecae3a5381c1cf48ab05e030dcb47a40e7cac5e6176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687963, "uuid": "5a591583-d3f0-4e85-9283-5da3e8595752", "value": "T1DE6308787216F2ACE9E54078F44335EA2C11079837CCE2D3A1A31076BD75B8DBA1BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687963, "uuid": "63caffbf-aef0-49d2-9f85-7d73abb2a821", "value": "768:jasfhtY8e5dXKsSzX23q/QomiDqeiO1DNngXt70IKWcOI7lYOZx10Usu:jI8MdXFi+mnvngX7PVIpYOT10C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687963, "uuid": "8ecd9742-16a4-494d-90f5-0de00db92ff0", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687963, "uuid": "d64c1531-d7cf-4f85-afe4-09284f0bc376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c47fbac-22c2-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745687968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687968, "uuid": "fb59fa30-c7e1-4c84-89f7-3cf969a22ce2", "comment": "Malware payload (Healer)", "value": "3645f20b3be622cb94e9bbd5a708ee6a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687968, "uuid": "aff98976-ee20-456a-9074-154d51e279cf", "comment": "Malware payload (Healer)", "value": "0d0751c5561a75f6a93a357899491ae6ce6607aca643c9127eefc9f55c63ed1c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687968, "uuid": "17312e65-1d9c-4346-b2f1-32e328e8c705", "value": "T1A48533BC02716E72D25CE2B4FFBB2808BDD5A4C56284313E96584DF9BF5BE42C89D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687968, "uuid": "df264730-061a-4be1-9c39-e3ea252c3f54", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687968, "uuid": "9ebe72c7-90b3-4b78-b0dc-acc86f02616a", "value": "24576:4SoHcI/0CzYmuCI28xhROUXNvhl84nMbHxhB4x0wPBZH7nmSbF/PcNBeI3lIEwQZ:TuYNvFRBh24sx34x1PzbnJcNJ+QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687968, "uuid": "45e99850-83c4-4f65-b72f-d648573d5823", "value": 1779712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687968, "uuid": "97b65a68-3dab-4857-931f-455853ed6cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88df6ad-22c2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745687989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687989, "uuid": "da4ad9fe-c4be-4036-b43a-f16505bbf02c", "comment": "Malware payload (Mirai)", "value": "9c9da4bdb5cde4c468c6db1d96879559", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745687989, "uuid": "88f871f1-4eb6-469e-b074-85d51b8d634e", "comment": "Malware payload (Mirai)", "value": "01fab1f992b91fe56a8b7357f18b9278878cd078f930cbe4f931433e87421d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687989, "uuid": "5068d409-45d1-4e9f-a364-1b3d4d55f909", "value": "T16892E121CA0999B1C6F40434FDB295877BE318F89156633558051A2C82D794FFFF92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687989, "uuid": "065cba3b-ab77-4583-a9ac-27535d047d40", "value": "384:6WwHoCGF05iMiBsfRR+7Rin21TjOD3vsK9/isTqwe3TBc7BhymdGUop5hT0:ILGFn6ZR4g21/ODEK9/ibdcls3Uozh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745687989, "uuid": "a9e922e8-d359-4f16-8c0b-c02d10be2a05", "value": 21124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745687989, "uuid": "c24b2d0f-19fb-43b6-861c-9aaa7ee1002b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b90083-22c2-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745688261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688261, "uuid": "05f351b7-07c7-4971-9564-413dc4fc5778", "comment": "Malware payload (Amadey)", "value": "608121813df12b43bcbec967c99b76c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688261, "uuid": "1ce50186-2eed-40cb-ae96-6e42b313e5d7", "comment": "Malware payload (Amadey)", "value": "1d619255426a6e9b260aaf57b6e514671458608cdb5d9e71033b34c5b19b8044", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688261, "uuid": "a0becab0-3f17-4675-a247-2d78ec166a0a", "value": "T10A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688261, "uuid": "069fcea7-a074-43d9-9db3-4511ead609d0", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688261, "uuid": "c31f30f3-67a0-460c-9dd5-18157a156f31", "value": "24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aebV:UTvC/MTQYxsWR7aeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745688261, "uuid": "850a5d33-1639-44c1-98e0-d531a9b9be67", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688261, "uuid": "10773abb-8a7b-48a8-96c3-43e32828df04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885fc85c-22c3-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745688365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688365, "uuid": "5ae87a22-3c68-48ad-9085-d2a8a1287e55", "comment": "Malware payload (Mirai)", "value": "b2ca89003cfc057113fb95808b43b118", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688365, "uuid": "8e3cacaa-7881-41d9-8dee-e7089721d81b", "comment": "Malware payload (Mirai)", "value": "0ef6283291313477b0eaced1c3ae79a29c2632b6c8900146ae89e138531124a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688365, "uuid": "640ae721-d5bd-44b4-aff1-ab142ed2e041", "value": "T178730946B8818A16C5D413BBFD2E018D332267F8E2DF7212DD105F647BCA92F0E67A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688365, "uuid": "2ac4ae4a-4bc3-4e2e-a754-730e2d657fc1", "value": "1536:uNnba1njb6e6cr9F8AO5s0kB7SADhW89LpvN4/LB3GZjzVniMpi73zWznwd42+:H1n//6m9FBe1AFlm/LB2ZM3zWzn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745688365, "uuid": "c69f9ef4-0004-45fe-a077-254e84aa804b", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688365, "uuid": "46cb62b0-1f2b-4a93-8548-ac0d651e5e0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0b2622-22c3-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745688508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688508, "uuid": "dfc140e2-64ee-427b-a55e-97e81a4b23e4", "comment": "Malware payload (Mirai)", "value": "ebea2c2a310f4d1b2539692f6522743e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688508, "uuid": "c4c8cd15-fdb9-4308-ac07-c5256af211e1", "comment": "Malware payload (Mirai)", "value": "05792546d6de7c9fe117abbb20ad2b1cbb8a98f23c560cef29f9e32a7296c764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688508, "uuid": "f0734413-139a-4bb4-bc9a-2f3c28e6fc1f", "value": "T18C339E26D4699ED0C19A0134A49CCF790F13F2C593532FBB2BEA46B16853D18B90AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688508, "uuid": "41a270be-8cd5-4079-94c0-7f09a7461f0d", "value": "768:OaxzxgzLrH1soqXfiKatbtUaqfpeM0HbFz94442Coocjz/qC8/w:Oax1Gj1dyfKAXn0sB20cHqC8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745688508, "uuid": "1dd40c0e-1560-44fa-8c1c-58b81062b5c2", "value": 50576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688508, "uuid": "e51340cd-fd45-477f-8df6-79c95fa15d6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86ffbea-22c3-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745688553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688553, "uuid": "2cb5f42d-231f-4aea-85b4-de49450d23f2", "comment": "Malware payload (Mirai)", "value": "2735c06dcf6e6a680f029b09251d2f4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688553, "uuid": "aa7c0f38-c9f4-440a-9ab7-0017cc166d2d", "comment": "Malware payload (Mirai)", "value": "c72dc59683c984adcef44e6f5e13435620e7d85f4e4dc36e4c59aa456e0e2510", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688553, "uuid": "993aa2ad-4d53-406c-a896-dd686ea25cff", "value": "T15B23F1A36881926389B04974DF1DC9D78F4C53F1C2E9B153630CA688BB9B37CD0A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688553, "uuid": "0aff189d-ce9a-4b96-956b-de7c6c12c988", "value": "768:44miZyERZpveU9aZfaD8gyhkZmqiT2jfYA7t9q3UELg3aLi6KqlzUv04npfi5J+P:44miZrp3AiEqiT2jlkLWaxV8p654F7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745688553, "uuid": "27f543df-4507-43f0-a79b-094e2c0f847e", "value": 49900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688553, "uuid": "1f289b2c-b297-4a06-8fec-f99635a02b2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a860888-22c4-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745688610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688610, "uuid": "60e72483-9195-4784-a879-7a7560d3cee6", "comment": "Malware payload (Mirai)", "value": "d666034656c30f9357fca1fe94b3beca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688610, "uuid": "162a9746-bbd7-45d4-b039-232269eebf98", "comment": "Malware payload (Mirai)", "value": "a7f4ff0b28883f34e8a1dae7d626b3f3152026a8258ffd17894809ee5342a6ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688610, "uuid": "bf548926-2c11-4a4e-b430-c3e0baa06176", "value": "T1D8D2E02A7342A8A3D510303EF95587C5AE1E4EFCF132F19765A405BD2AD4E448AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688610, "uuid": "bb69a26b-3127-4f3d-aaa5-333c618ef0c2", "value": "768:Cjtl0qkcrWUHHGGnBcMOQGg39ST+LWnyBesJZ9q3UELdM:Cxl0qkwLGYrOQGSZcjLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745688610, "uuid": "6caed07a-eda0-40d7-9090-fd939e536455", "value": 30464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688610, "uuid": "59ebaf6f-a927-428e-a18e-60179f6b4620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d27692-22c4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745688848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688848, "uuid": "6afec4bc-66c1-4134-a6e6-b2a63f977062", "comment": "Malware payload", "value": "e3a1bfd3072cb0d2e86245dbcbac40af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688848, "uuid": "df8bece3-7b3e-477d-a736-d509f78d1860", "comment": "Malware payload", "value": "8a3654b69c27deea65de833ba20b8038103cd83b00de95dd73cf2cb00f0283a8", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688848, "uuid": "d718d888-d844-43ca-a6c8-76074975612c", "value": "T1A095332F48F19969E615C9758DAE0641CA3D8C22FEFC092E0851E47F0B5B327B9F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688848, "uuid": "614fbec5-972e-4579-a4d6-0ae499911aac", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688848, "uuid": "3725b9bb-90f0-4e22-bc81-437da19997d4", "value": "49152:DIoaj+dmbLaO1BlhxyhE7n3EHLj26G3wBfjCsAVRY6nE:coQmia0kfG3mbhAVRY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745688848, "uuid": "a8e2eda1-7f60-459f-b9a4-857578772c5c", "value": 1944576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688848, "uuid": "98d73dfc-9d4b-4eda-918f-85752194d767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e774d4c5-22c4-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745688954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688954, "uuid": "ebfd3d32-0935-40eb-9c60-790d07278d3a", "comment": "Malware payload (Mirai)", "value": "9899f9342a64d4c0e186a1f288c332b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745688954, "uuid": "7f2abf6c-8978-49c7-8e46-9e9bbf3885d6", "comment": "Malware payload (Mirai)", "value": "939b262c2619af514e846ab983d099b2b0a9a5f56d502410fce101cf3083dff4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688954, "uuid": "4929524d-73e2-4847-9594-a3dbc2733ae6", "value": "T1CA04C716EB550FBBDCABDD3F06A90B0139DC544722A4BB363674C528F5CA90B49E3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688954, "uuid": "839c45e3-cf2f-42af-a59f-f36c29d17208", "value": "1536:q7VIMD3H7yLW1kS/fsN8x9SHR7XWCw2iJguXD6V0GBzoNOZfzwWBtkU8re//qBSE:qhRDX7yBS3IbxPij+z4Ob58r6CBEn7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745688954, "uuid": "2422e3b8-395f-430c-b2fb-3e7f0eba37b2", "value": 186144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745688954, "uuid": "d5d4e773-844f-4255-8d71-9e4b24a06f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7a2879-22c5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745689021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745689021, "uuid": "034b1690-2b35-4126-bcf4-043a8d371c34", "comment": "Malware payload (Mirai)", "value": "a366b68abfc3d0e5a197315273eaef6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745689021, "uuid": "840e41ce-00fb-445e-85e7-d3d42ae5c5b0", "comment": "Malware payload (Mirai)", "value": "3c0a11499c908d0cb5517515d6cca03e3ecf797558a4166eda2f5d5074afc436", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689021, "uuid": "f4f279ca-a554-43f5-a838-c13dc0bbec49", "value": "T155B2D095E68BB053CF3094B9BA6D838127B70379D0ED70F27B605A7464920726BF82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689021, "uuid": "1df95a0d-e813-452b-bd71-fdd8db8c77cf", "value": "768:vChHyJI0nd73OEvV1/9gwivX1RLNzZwUOt9M0ts3Uoz4Jg:KhHSI0nN3O4V1/9jOLNz2UO3M0wz4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745689021, "uuid": "c4ab4b41-19fd-4deb-9bc8-9302284a3980", "value": 24888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689021, "uuid": "917cd70e-421a-4407-953b-74da9438c334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ebad8e-22c5-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745689265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745689265, "uuid": "4625fb27-a0f9-4ec2-803d-8e88617a5e0c", "comment": "Malware payload (Mirai)", "value": "550f4e6365437d5a087948505b183b6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745689265, "uuid": "3b6c6cb4-55e0-4ba0-b3de-0a6a40a8bbe1", "comment": "Malware payload (Mirai)", "value": "bbd547140d2d28ebc59caa9e9f9cab865c16c9b131ab06b510690ff334fa5dcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689265, "uuid": "ba9273eb-21e1-4944-a64d-66bbb207a8e4", "value": "T1F6A2CFADF552B2CBDFB96CBE558E1B504AD174803AA65FC9470108852F52CD7F08D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689265, "uuid": "86ecdecd-1ee1-420a-925e-3731b0655462", "value": "384:C35A604Ka2bNH3EqViCiohqMhYOH6Mh0lnVfKDhzy/RWGVCz0Nv5:h02b5xViCioZGOH/qzW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745689265, "uuid": "cc6bbdf1-8487-46a3-a5cd-df887add75b7", "value": 23304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689265, "uuid": "b7c2837d-3a76-4066-b5b1-061b006536ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51496ce3-22c6-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745689561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745689561, "uuid": "d8cc05f1-51ea-40da-9bfc-4340cf6cf590", "comment": "Malware payload", "value": "9a65e2c4ac880571493eafe6164935f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745689561, "uuid": "8d53b3be-60f5-46e2-8d99-7bed12d51475", "comment": "Malware payload", "value": "1409f327bcfed93daec4e092dd636aa5057409d1402967b33693b55754a8f7e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689561, "uuid": "7d6260b4-83a1-4743-95ae-676ac0242a57", "value": "T1819533365DB6E974F1388D381EABCA49F3B3C213C12166212FE4A7097C5A6C7A5D05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689561, "uuid": "16190769-9742-4603-a867-5c32ffe8ff4a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689561, "uuid": "d79c6077-fdd4-4186-9710-f6ea3c139624", "value": "49152:9u2ez24ZTej7Plq+PgPEu9iUfGz9rPGarB48q1eI1nJ2jb:U2RDvPlnZu9iLYarBiJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745689561, "uuid": "009299e3-4958-4bd0-abef-488790e15c00", "value": 2025984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745689561, "uuid": "7e0e325f-71db-4d3b-9afb-70bf212df3dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781b94f9-22c7-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745690055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745690055, "uuid": "b0ebccb4-3f3a-4176-9210-10646b248a81", "comment": "Malware payload (Amadey)", "value": "8b85cc19881999410b33aeb4b0d53f0c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745690055, "uuid": "a8e2b45b-d7b4-4f5b-addf-195ee87aac5b", "comment": "Malware payload (Amadey)", "value": "4cdc049d4ed9b9d6a49fd2569e7afa3ba0fe2e7fbd6919c74485e27012198820", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745690055, "uuid": "c091522f-95c9-45eb-9565-3ae83e7d00c3", "value": "T1D7A52317DBEC4433D8F267F11AB206C31575FE51A7B8017F26EF986A15A22A0E9317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745690055, "uuid": "5ac87a5f-00b7-4efe-b738-41823db233fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745690055, "uuid": "c47151cc-292c-40b5-a464-f199b135b1a9", "value": "49152:+t75C+XkksVpgyjee1PrLT10W5yhMlFg9YEEJXBZF6MH:C2Vsez0RylFg9VEzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745690055, "uuid": "d584a1d4-d645-4d40-9035-bbe2d40679e3", "value": 2192384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745690055, "uuid": "4bc52490-4d5a-4294-9244-51aac2cf92e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c98eb6-22c8-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745690474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745690474, "uuid": "40b54ceb-c45f-4888-88b2-c755bf0040c4", "comment": "Malware payload (Amadey)", "value": "0ed381854464dad5130647254e513700", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745690474, "uuid": "b4d7807b-9ade-425e-abfe-06198ccb15dd", "comment": "Malware payload (Amadey)", "value": "c8ec341b88c79678817e66aa2117f75bdcb6c4dc4760f41ee83ba15a26393af4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745690474, "uuid": "3163e0ab-2102-4cb7-8a56-b468fcddd336", "value": "T145159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745690474, "uuid": "90847dcf-11f2-41d0-9aa5-f2c6f696c8df", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745690474, "uuid": "47fa4a1c-bfdf-46ea-ab35-531d4c0ef1de", "value": "24576:xqDEvCTbMWu7rQYlBQcBiT6rprG8aeAV:xTvC/MTQYxsWR7aeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745690474, "uuid": "10d75c16-1003-4411-9708-4e8f73c852c1", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745690474, "uuid": "76b8b093-016e-4ee3-ad12-5bdc5f92e341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040523a8-e5c0-11ee-b38b-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691007, "uuid": "066185dd-eb76-4034-84cf-f45b4f9e6c2d", "comment": "Malware payload", "value": "724f25e7f93eae0ae54a80142e11b7ef", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "casdet", "colour": "#4f8a65", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "sshd", "colour": "#893e97", "exportable": true, "hide_tag": false }, { "name": "sshdkit", "colour": "#67ca42", "exportable": true, "hide_tag": false }, { "name": "SSHDoor", "colour": "#E78F29", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691007, "uuid": "9348a631-2f0e-4d6b-b1f4-a7eaec71492f", "comment": "Malware payload", "value": "ab69ef32017a5365ee0e7faca03e1352382865c5672e989d99d2d77ec91c33ef", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "casdet", "colour": "#4f8a65", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "sshd", "colour": "#893e97", "exportable": true, "hide_tag": false }, { "name": "sshdkit", "colour": "#67ca42", "exportable": true, "hide_tag": false }, { "name": "SSHDoor", "colour": "#E78F29", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691007, "uuid": "2d03d226-2175-4d9d-8de2-b89fa6e84cd5", "value": "T16D356D56F9808EA2C5D8177BB75DC35833534B78D7DEB102CD08672877AB94A0E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691007, "uuid": "7102d734-6aab-4c98-bc75-3ef7d52c121a", "value": "12288:00Bw2wHeeJgR3asIAksAi0uObzkzOgFr1qwRcFjV1D7a9KbsaKjpeFmz4T28bLv:00BnRED/TwOjX0a5xTdv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691007, "uuid": "f9fb9053-4fb5-406d-b6af-4291d22e44e0", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691007, "uuid": "df90e87d-2062-4f06-a67a-a5fc244581e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "telfhash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691007, "uuid": "7f272c05-69e9-458a-9dbc-78c8d012c9ae", "value": "t140317403a83f8f3ac5a298b0dc650765516b5701b4f9d7109f3ca9d06c79016702aa", "object_relation": "telfhash" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ea0263-1a77-11ef-b2b7-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691009, "uuid": "498d6bd3-8cca-4c10-acf4-fd7cc4383820", "comment": "Malware payload", "value": "567d3249dbe60fa9478a424a69c2c535", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "sshdkit", "colour": "#67ca42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691009, "uuid": "985e3338-54c5-4f70-834b-529f72a3bd58", "comment": "Malware payload", "value": "ff70c53dd6e9806c588d8f78ee35d406db0879bf5419a18a87c7982c79e3e9bb", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "sshdkit", "colour": "#67ca42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691009, "uuid": "277c2de2-bb2d-4f26-b334-edfcbb3840ee", "value": "T19F05E184F5E01E67E487813F9B8246720266ED5FB34AC317574876BBB4BEA34EB153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691009, "uuid": "2ee31a47-02ba-460e-a1e9-7fc4a683cda5", "value": "12288:BZpdDbfRWxSYOkwVcqcMFT5G1z6EtYOyDIGOnd7w4bLvVc:BHlb/KwiqcMFUzYP8GU7PvVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691009, "uuid": "c126cd96-fd87-4041-a33c-62cf87746a82", "value": 848048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691009, "uuid": "df91b709-4c19-4a88-b4aa-bc8d93afcab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "telfhash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691009, "uuid": "ee5ac2b6-80d2-4625-ade7-b5a962f66b34", "value": "t189217143a83f9f3ad5a2d8b0dc6a0725512b5702b4f9e7109f3ca9d06c7a016702aa", "object_relation": "telfhash" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8af856a-16ee-11ef-b2b7-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691010, "uuid": "05d91e5e-f789-45ad-bb7a-54f9770fa6e3", "comment": "Malware payload", "value": "91904c76a5d6e973a8015a716d5943e0", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "sshdkit", "colour": "#67ca42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691010, "uuid": "2eada8a7-9cf1-4515-a637-38c56b6a5d33", "comment": "Malware payload", "value": "a1c7e1a0b84f6ebb45e91fdd79ec9b9c8d6d80b1af754c72a1952aff4674c209", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "sshdkit", "colour": "#67ca42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691010, "uuid": "6b76cb91-0d09-49aa-8f89-7d73b8525c35", "value": "T12305E184F5E11E27E487823F9B8246770166ED1FB349C317574866BBB8BEA34EB153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691010, "uuid": "f22d16ee-c48f-4bc5-b033-0dec1a04f085", "value": "12288:FHkOsP1QHc0R9HaVc/fQZ0CShw6P/5cNDMsm4gO8/mRQbLv:FExepQi/fQZQ7x0O1Xvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691010, "uuid": "bdc51b26-5edf-4073-902e-6f8a44ab7b8a", "value": 848048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691010, "uuid": "eaac0e79-ff1d-404d-94b7-f294cc2b9e32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "telfhash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691010, "uuid": "6fba078d-2513-4641-ab45-180417755a2a", "value": "t189217143a83f9f3ad5a2d8b0dc6a0725512b5702b4f9e7109f3ca9d06c7a016702aa", "object_relation": "telfhash" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cae4e4b-16ee-11ef-b2b7-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691010, "uuid": "80408e6d-b768-472b-a43f-fb5e62eafb37", "comment": "Malware payload", "value": "936b35bfee8232f437bf6b46e88401dd", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "sshd", "colour": "#893e97", "exportable": true, "hide_tag": false }, { "name": "sshdkit", "colour": "#67ca42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691010, "uuid": "85b0124a-6d3e-4172-ab28-ecc1cba2f5fb", "comment": "Malware payload", "value": "de9a5647bdf02fa2b927566c78e54d5931e25c9f07d2ab884e135766815d53cf", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#26305c", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "sshd", "colour": "#893e97", "exportable": true, "hide_tag": false }, { "name": "sshdkit", "colour": "#67ca42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691010, "uuid": "879e66e9-de68-4d5f-b80d-dbbe01e604b3", "value": "T1B9356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691010, "uuid": "25dd16df-c41b-442b-8c51-96e263b17105", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVD7bLv:E8dbbsO38+TfgRinIVvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691010, "uuid": "c6d1763b-7724-43ab-a086-05ab759e78f4", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691010, "uuid": "8a733685-ab23-433d-b40b-0a65ce552565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "telfhash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691010, "uuid": "7881906a-95d6-4c7e-9f8d-3e581aacb5c6", "value": "t140317403a83f8f3ac5a298b0dc650765516b5701b4f9d7109f3ca9d06c79016702aa", "object_relation": "telfhash" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fd4ba3-1fb4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691011, "uuid": "93a5a9c1-bc44-4f6a-81fd-ffbd2040178f", "comment": "Malware payload", "value": "3b4cbac8dad90d932e233a89650530a0", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#1fb927", "exportable": true, "hide_tag": false }, { "name": "xml-opendir", "colour": "#1F06AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691011, "uuid": "139737c4-288b-4aa7-9da9-056d69cf02cd", "comment": "Malware payload", "value": "d8fe935ffee91b6d589392e60c0af2c0de956b21fa9b752a468bbbff6a495afe", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#1fb927", "exportable": true, "hide_tag": false }, { "name": "xml-opendir", "colour": "#1F06AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691011, "uuid": "699b8cae-b0c8-492c-8a29-939de748eb1b", "value": "T1180526046BEA0325F3B29B766C76B710887BBC1ADE168F9D015181881875624E4B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691011, "uuid": "617f6ddd-5596-494d-8d74-ee1732757d44", "value": "24:8Ayw/BHYVKVWO+/CWX62fV46/KkDdd79dsoEZ/7QAMN5:8y5aj62fV4YdJ9ha7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691011, "uuid": "0b369c4e-f59a-455c-94a8-8cf4e8d2f630", "value": 869633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691011, "uuid": "07500005-2a3b-474e-817f-0f7995415140", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f01552-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745691199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691199, "uuid": "cb765885-da7a-40f5-bff8-cd7ff60c7e2d", "comment": "Malware payload (Healer)", "value": "12523b84d3d7f59b4517712d55fef099", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691199, "uuid": "4660de3f-db2a-476a-be78-9796a04a646a", "comment": "Malware payload (Healer)", "value": "7713dbc6bf45aa89526d34df0219f89906cb820cce6f8199735b292c6ee08752", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691199, "uuid": "e4929549-4910-4e1f-ba5e-c5af4f6311cf", "value": "T1AD8533271D26BECFC5180576D4CEE3029F2D501D78DA9E4BAF27E3A98C4273914CAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691199, "uuid": "d08b7447-1ddc-4a78-986c-c4a329504b49", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691199, "uuid": "13d48082-11a8-4751-af72-b0bf76864f26", "value": "24576:ZnbdkpyFzM3A73PQ3EWbeCyMq90Qlsu+PIBqv+BpO9AEOlj3Zlw58A3BLVO0A7aI:1dkpyFzM3A7BAUN2QqvaHlj3y0uw4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691199, "uuid": "d079ca1c-0c19-40c0-bda3-61b19776b4f9", "value": 1742336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691199, "uuid": "281f73d8-24a5-4bc5-a4b5-80dee6c88df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50db577-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745691419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691419, "uuid": "57060038-78c3-4de8-a6ee-60420ef48254", "comment": "Malware payload (CredentialFlusher)", "value": "e332902ff755a0bc60a116682c66ef67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691419, "uuid": "67fa0eb9-15af-4a3d-8982-a0881d41c9e1", "comment": "Malware payload (CredentialFlusher)", "value": "f2e16ba24147e3b2695a7742715b401cff9625334f31b40dbd431543f63dffb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691419, "uuid": "fc91842a-cd7a-4885-9aa2-c06bd0a78dd8", "value": "T171259E0273C1C062FFAB92334F5AF6515ABC69260123E61F13A81DB9BD705B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691419, "uuid": "eef629c3-41ab-43c6-8a56-7b3d0823eee3", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691419, "uuid": "9aa297d0-e589-49a6-a82c-791fc1ca6191", "value": "24576:gqDEvCTbMWu7rQYlBQcBiT6rprG8ayQ0Z:gTvC/MTQYxsWR7ayQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691419, "uuid": "03f1287b-0fb4-4492-96b9-8c4b647857b5", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691419, "uuid": "f779b73b-fa5a-4647-88ac-a2df40395703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a894cde3-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691425, "uuid": "ee6a8e32-60c0-4908-adfa-c4ea6e50a670", "comment": "Malware payload", "value": "88ab49fe02954d61d259954237b00432", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#1fb927", "exportable": true, "hide_tag": false }, { "name": "xml-opendir", "colour": "#1F06AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691425, "uuid": "f247e3c0-c976-4d73-a271-45af9be6e6e5", "comment": "Malware payload", "value": "8419a4f16ab7b36d22e0292825ff441e5a27b51ac2fc4dea99d96e26858de310", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#1fb927", "exportable": true, "hide_tag": false }, { "name": "xml-opendir", "colour": "#1F06AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691425, "uuid": "7a388898-287a-4a46-bbeb-2e66ba790e90", "value": "T1BB516A142EE50724F2B2CA356C767310897BB809DE3D8B8D019DC2443763225F4A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691425, "uuid": "b06f770c-f08f-4fc1-abc7-3da70d1dff83", "value": "24:8Ayw/BHYVKVWO+/CWYk3eRlPP/dd79dsoEZK:8y5as7dP/dJ9hJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691425, "uuid": "be11006d-af92-4634-9af0-4115277a4870", "value": 2538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691425, "uuid": "22d4c2f1-82a4-4993-8777-2970fbcaa569", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaeb4e0b-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691429, "uuid": "4ada76bf-3a16-4a2b-b778-28ba9dd35c34", "comment": "Malware payload", "value": "02b4852b565bfba319bb6f4e75ef2f35", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#4f70a0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691429, "uuid": "d0e32c09-baae-49fa-81fb-e70a3b324638", "comment": "Malware payload", "value": "759e2c73c4378d922be46bc00a8e9a5cc1e6ef21e9d266bfade57e2b3ce32331", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#4f70a0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691429, "uuid": "e627c750-bc7f-403d-beea-3dcfac243b0e", "value": "T1A8D5F7AE571C310FEA521735B4CC171B6B74ED69135387834851B2368C3A2A6CEA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691429, "uuid": "01e878f9-b4d6-4934-9fcc-9f8caa0fe39f", "value": "6144:xCo5MekBCo5MekPKCo5UCo5MekzCo54Co5rCo9Mek6Co5Iek2Co5MekCCo5MekPM:XsU04q0fRBv/A+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691429, "uuid": "f7f833cd-b24c-4bd8-92ef-6ff5cec9021e", "value": 2958306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691429, "uuid": "c267ea56-2da4-4748-aa43-3895b699dee7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf38492-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691484, "uuid": "3e0ff2df-c895-47e1-9d97-ab7f3d8123be", "comment": "Malware payload", "value": "edcf3c8c06a5a59b7b71224c83a56820", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#1fb927", "exportable": true, "hide_tag": false }, { "name": "xml-opendir", "colour": "#1F06AF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691484, "uuid": "a6d2e104-01de-4963-a865-ee1014918d75", "comment": "Malware payload", "value": "e16fac7ff6d0999e03b4fb3f71525d1116a14b270f98aaa111c20fd0cc28b8ff", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#1fb927", "exportable": true, "hide_tag": false }, { "name": "xml-opendir", "colour": "#1F06AF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691484, "uuid": "7835f474-31a2-4998-ba51-9d3d216aa7f6", "value": "T152515B045EE50324F2B3CA3558766211897BB809CA3D8B8D009DC2447763624F4A9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691484, "uuid": "24fe2c4b-6186-4bbb-b342-15b181321f7d", "value": "24:8Ayw/BHYVKVWO+/CWOM4plPP/dd79dsoEZK:8y5aCNdP/dJ9hJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691484, "uuid": "6ffee23b-c2d6-4997-b381-22479e2b99b7", "value": 2550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691484, "uuid": "2b9f8e81-c2aa-4734-a2ef-8a743ec0957b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0f3358-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691488, "uuid": "72380200-37b1-4369-8c40-965787222d95", "comment": "Malware payload", "value": "badf5dd6b2a45be8fce0a7f1693c07de", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#978c67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691488, "uuid": "db5e7b16-62c0-4e66-91a6-24613cea5fae", "comment": "Malware payload", "value": "d4c7a4729719f8d24ce40793d4f23abb629101920775bc5106486b59835d1ee4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#978c67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691488, "uuid": "45dd1daa-5fe6-41d6-8148-9444c4a98ad7", "value": "T1B426339BC4A833A1CAEE5678140E474DCE5C9C234A6AA19664107FFE227DF30E15EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691488, "uuid": "babe9389-8470-4e74-be7b-63cd334f0ceb", "value": "98304:M8+wZYIAIzckmqY6am2EzNmc+ydknHkphj5S4WW4kA+8UxHbPCZi:/GIzPaBILaE0tkACJbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691488, "uuid": "e0a3563b-3ed1-4c72-b821-b43363eab040", "value": 4812800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691488, "uuid": "25ffddf2-fbeb-4879-abe9-ea7cee0422e6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06c3178-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "d3e29a9f-52c8-4b2d-a795-c1427430e52e", "comment": "Malware payload", "value": "9d2141fe632f81519b77f4ce64fc33d4", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "00acf152-06a9-4d0c-a31c-f2ae5f574875", "comment": "Malware payload", "value": "aaaed4cd222d649682f717820ab09df66f6e08ad388fc0b1e02a0ec416008411", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "c5bb1a04-03c7-4b21-8242-74e5737ce8bd", "value": "T1064151CA31D25630ACB5EA2373B58848B4E1A0C79CCB6F94DDDD78E984CDD58B149B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "d550033b-8a40-4001-8b53-3c069505535b", "value": "48:1p4m4rkpBT5pFL+Mpdz5pllpsQUpz1pvdvNpYOYUpkhp4t4MVTpz5pjk:1kk1SM35l6fhpG6Tfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "fe4f1048-534f-4af8-af03-1eb839ec2a32", "value": 2146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "213b444e-5f12-4955-9b73-3ca37df8197c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08a6b65-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Ladvix)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "8345e212-2374-4bc0-b4a7-bbb412852918", "comment": "Malware payload (Ladvix)", "value": "f7b5c8339e2102d841d746ddb18cb755", "object_relation": "md5", "Tag": [ { "name": "ladvix", "colour": "#c4644d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "4c1607d0-7237-42d7-be3e-e8bdbc2ae3ed", "comment": "Malware payload (Ladvix)", "value": "6e3656eedc60cb1b902db50064855cf72378cae86214aa42d0c76fbf55374c6b", "object_relation": "sha256", "Tag": [ { "name": "ladvix", "colour": "#c4644d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "353d6f6a-2e48-47fe-a372-554cd2fb8c80", "value": "T18E63E1E3A602F336C48897B0D9BED1099DB5B4DCBB0260367B1899553A04B9C5F1ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "7ecd9cd3-ac91-4e51-94b0-85a3e87f9607", "value": "1536:GTqRRbmf60jd6IuDYU6v9S21PMFRdWMlRNlJwtd+nfNr:62Rb8/OOvdPMbdWMTNleT+n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "334ae291-a7fe-40aa-9c65-0e5a04c6897e", "value": 68379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "34518cb3-b80a-4ec5-bc0a-99e0c27771ae", "value": "application/x-pie-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08c330f-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "307d57bb-5c05-432d-b1db-cf77f5cba402", "comment": "Malware payload (Gafgyt)", "value": "69a699c1fc52530f2f49a02189ba1970", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "353bd5d5-50a9-464f-91b2-be2723b5bf32", "comment": "Malware payload (Gafgyt)", "value": "61de24ef679ab3a81254d189a8a00ce18d7509006b4c4b85b7e52602eb85a937", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "976ee565-fd49-46a2-9f50-caccab54fd1c", "value": "T13F4302D594856AA8E9E71B39E30D405BB2202CFB122FB4D55C8935B9BEBC1C0C03E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "3b10408f-e79e-41a7-880e-79c03f847ff6", "value": "768:B3yAeTzS6Sntdm8lDZUTMuIyA7N4DJiy0IFrJNcXOP+jDX1kLru03ZSeFU+3voNn:ZFuVST9MMyO2gy03X6UI3ZDD3voNCGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "3c87bc42-dd8e-4298-87e2-e8372d7f5644", "value": 57364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "bd7541c4-3321-4826-87c7-2e7dc1dcb89a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f090a66e-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "00fe9d0b-4418-48ff-8548-c68ee55b7762", "comment": "Malware payload (Gafgyt)", "value": "a260c249e6c99629f3f50642f7b58be9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "9b4b488f-3d1f-441a-a7a0-e3e8034cd7e9", "comment": "Malware payload (Gafgyt)", "value": "b871c79b32efaca58b0a7a29d39c82ba700a27e07050d6c17e0402f741653d76", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "7561974e-16b6-4316-bf63-6cf0aae1b1eb", "value": "T1664302A7F4647706F868C33F923A602E9D4BD46183BA6567F440A6982E76C7FDE005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "1e141b05-ac13-4e2f-9249-7fa8ae306982", "value": "1536:IZ/VKVuHLDpMZ2GEV39jA9CWWiNFIMFQVxvINbbcTc:5VOLDRRVICE3IuQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "2f49b7df-ca8c-4046-8b1b-c4494c191dfe", "value": 58404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "6db0849f-742c-4f02-b9b7-c718f7366972", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f09e5877-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "85109d3c-d3f6-46b7-a8b9-2dca3877558f", "comment": "Malware payload (Gafgyt)", "value": "2a1e14576bcb6d371b00cb30b556caa5", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "38a0c20a-b8af-4184-bd8c-09f7833ca061", "comment": "Malware payload (Gafgyt)", "value": "5e6ca618e843e6617e779b09e201df92f5b1e5a9827b40d8128944a1495eab3b", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "7f12d014-9551-442c-b0e0-7c32306ba7e8", "value": "T164430203D77C12A5E48FA310A45A2ACCB665EBF3190520D5F26D6C70AD33CA7B17E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "24ec5e79-1d1e-4ecd-b424-a40d2f2710be", "value": "1536:JCYcpCl0p2V7tijDHJ+wnodTZZ9Sua77Gp:4HpCD5MDHIwnCTZTSYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "9b62ad01-b21b-4842-ba0d-309b70e3296f", "value": 57500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "4ac55bea-b53b-4985-a2e2-cfe11f83e5b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a54db2-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "234bc4de-ae10-45f5-a9b0-92b53d698c9c", "comment": "Malware payload (Gafgyt)", "value": "84947afed40eb43f7c5a84a94f676a07", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "9e088bd3-131d-4d3b-88ab-43ccc1ed0379", "comment": "Malware payload (Gafgyt)", "value": "de91da1f87c3367227d70a1e7f86496807bd7672240341f3596e3e184790296a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "f8bf3bf4-7e92-447e-a77a-a8cd957c03c3", "value": "T103C3D8834A20DEB7C053AA7176B25524B795BF690B1F0A867E1DB6A00F3F4CE741E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "00e65b05-ce2b-46ac-8082-161512e2e75a", "value": "1536:GqNhGLhj69giXiKWSVzjARokEg3isJCz3kVPRG5/+kxevFdG8fFXFRRT0IAf1Bgh:/LD9pVWYARoYJgp5+rrXFLT0IA9BgeJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "4dbc2a37-f9c0-49ff-bd6e-29761d3ab980", "value": 126607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "637e33e9-af90-454a-8a28-cecd7c830e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a58749-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "43a20f75-0d59-460e-ab73-e1a048830e15", "comment": "Malware payload (Gafgyt)", "value": "24973bbd99538b4b02690ea8774bc079", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "e36e4fec-b0c1-4351-ae17-ba40c16736cc", "comment": "Malware payload (Gafgyt)", "value": "74a8ad3a624da32eb0e4587b8bc4a80f5a2ba0d82b6126ff7d4b90815e63f667", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "87c53d82-94a1-4534-a232-d1edacbaf2de", "value": "T111E3D82B22232F13C4E505BA01E24734FCE9DD6D34664FD3AA997E792E39D9034893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "0759d1e8-88e4-44d1-bc12-42e75b4b8b82", "value": "3072:923hv2zuuB+yImylxwNPWN1REZL+/70cEIxcHgyps:92AznlYYi/70cEIxcHgyps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "c95dbf0b-9c77-41ba-a5e3-8b70940e43a7", "value": 153700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "72847d87-b667-47c5-a7a7-b998462b7fdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a67838-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "0145b6a9-3a92-463f-a3f2-9b7986381ff8", "comment": "Malware payload (Gafgyt)", "value": "28d4ffd285117a2c92165db446c89baf", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "edec3e59-d9f6-4bbb-88cf-b331fef67f39", "comment": "Malware payload (Gafgyt)", "value": "7fef782eda27f27d5ef9cf5d0aea55d0a91e935302d6ee17ad446114773b097c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "cef7fb90-8818-4699-9075-c1b1197902a0", "value": "T1AB43024F4A32B6FEF2AEB0360557D9DBB2146D91C413887A3F363A341E4160C0648E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "3c129976-c756-44f6-984b-ffce317fcd38", "value": "1536:NHwdvgH77iZtyw/giJ153NzK3VCNnhE0rFDt2JU8BcdbD:pxo1/xh28g0rND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "0e012834-21b2-4829-bedd-29c47c804c11", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "0f248166-9562-460e-9270-37af5f1c89c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0aaec95-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "2f9ddf41-3f61-412c-ab65-28626f741367", "comment": "Malware payload (Gafgyt)", "value": "9e8619e8efea02f69a4e3924fd9b6bef", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "89df7493-332a-4030-89d7-fc721cb360d6", "comment": "Malware payload (Gafgyt)", "value": "66280fd474fb572ca9c21972168b8a36e5f1725c9aa246d050fbf97b35ab6aef", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "4c0e8fa6-2982-404a-97a9-8374c866ae8a", "value": "T187D3E783F410DF6BE44B5A3646C39721B7B5EF5D9A4302327317B9569BB71E228B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "653efd7b-036d-449f-acc8-27c1ef6136fa", "value": "3072:smLd7ELHUugZhMp2ozS7HyMNLI9JYPmLc0IZcHgeQs:1B75Kp2ozmyMx4omLc0IZcHgeQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "806509a2-0011-4a8d-b8f8-4b8899abdd46", "value": 137478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "42747313-2579-485c-86e9-2e1145ee5ee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c3a8c2-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "60b7b498-e851-493a-8b9b-58dcd635a357", "comment": "Malware payload (Gafgyt)", "value": "426627ef7132b8f796053f3f6a62cf54", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "cc02d030-3e36-4b47-b14c-ed81af7f6a6f", "comment": "Malware payload (Gafgyt)", "value": "2a04a906e019027b6a46ff08e5829bb6459df83ecf3212e49e153850c7e3ae07", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "ae0442f1-8a6a-406c-82aa-f77561879f03", "value": "T16233015A0742C712E9F1D2BA4F3D4FEA229B53905C67E9C133993A5B74CC200498FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "619d25b4-12b0-410b-96b2-aa3a6fd6dcc9", "value": "1536:rcT0qZUcudpAoE4IBRzAvUoRZtJ1BtaaYb:W0fAoE4SpARRZt1bYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "dca607d1-72cb-4905-b1b6-38ec9b143002", "value": 51920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "a4dbf100-a548-45a7-ae20-ffb9f629e58b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c83143-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "5713fb0c-27c8-47d3-a08a-c91dcd06010a", "comment": "Malware payload (Gafgyt)", "value": "a7d91bad781950fa2203916de8c28c08", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691546, "uuid": "be9ede29-79f0-4be4-b7c8-79994319dcb3", "comment": "Malware payload (Gafgyt)", "value": "650bd6cc5e57414cd8c87fe9a356b94fb01ad161023a16bafbde82c0ad1a6f47", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "0d4f7011-69cc-4de3-880e-81f2075da6d8", "value": "T13A2302CF9548BF72E4038D349428DB8B77105D4F8A4C19625CAD7DB941F221AF3999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "1c0fc397-b0a9-431b-b6e5-f08efa8b6f16", "value": "768:6vwvVuJVUUdptUXF7TiUL7YX1rXDLfbcYo/it4s6k3ICoywPF0JuL:tvViltUV7m27gXXfgwrHKbP+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691546, "uuid": "ca677dea-ac72-45da-b242-d5fd3c3db2ca", "value": 47656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691546, "uuid": "40ded997-3f90-4f5e-889d-22261cdfc2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17fe65f-22ca-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745691547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691547, "uuid": "ad0d3bd4-c08f-4c8a-8206-1bbe4695584f", "comment": "Malware payload (Gafgyt)", "value": "b5324229f1945158a8da45673a676c59", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691547, "uuid": "f8e0f3fa-4fdf-40db-b45a-16cfe4036c25", "comment": "Malware payload (Gafgyt)", "value": "84e3408d645f508333da2a630cfc9081f00459004568187d34e8e77ccb0b5747", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691547, "uuid": "da8c33b8-86a5-4c76-92d1-7631467ce59b", "value": "T1DF23F1C957D4892DD962F07FB80C38DDCB1AD2457E8D29033AB3394201B395CEDA97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691547, "uuid": "323cdb1b-3044-4dfe-b921-f8b69610b91f", "value": "768:R5zhVm+CoHbtEgG15rhHObBHrIiyBrTBAqPnYhPwBrAIsUYNbDA5ZEIyYqlIBj0G:RnV17CNFhHwHrpyBnBdY0sSYNbDpuqlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691547, "uuid": "a0f456f7-f9ee-4384-9a15-8cf61969463f", "value": 48224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691547, "uuid": "dcd57b07-303c-4bac-b704-43792894fffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140de72e-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745691605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691605, "uuid": "c4f69bee-17a9-463c-9e39-f2f4f0db7886", "comment": "Malware payload", "value": "2094ab85121be3c3ab871561a07899fe", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691605, "uuid": "11d90ce3-abd8-437e-85f0-bf7bb255b600", "comment": "Malware payload", "value": "c49716c86090bce0fb04bdc99d7e15da3dbe214a16a33bb80d9f5f45fd40ac7e", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691605, "uuid": "a4cc8ce5-bd51-4dcb-a566-1814d7577b6e", "value": "T1E393D057F7E44B2BC99C8338464F51256573A8B0EB072327360151B92A87B9C2F1FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691605, "uuid": "838eabac-359a-47b8-921f-0a89a18644b0", "value": "1536:GTqRRLbxUJr5k4MKT9n7spG8ZUKB8rvqL7HaQxLSj:62Rfw5k9KTZYpG0Ug8+HaQxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691605, "uuid": "c86e6047-a31a-4879-be6c-3ffb83debdfb", "value": 89223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691605, "uuid": "3367ebcf-7c7e-4db6-85d6-d1eaf777cb25", "value": "application/x-pie-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e69960e-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691623, "uuid": "40ae113d-1445-48df-8a83-34a3643962c0", "comment": "Malware payload (Mirai)", "value": "062f91b1b4d6baff8003127003707aa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691623, "uuid": "05fc17ad-7eae-4142-8a56-4aa07349ed17", "comment": "Malware payload (Mirai)", "value": "90068ddaf934cd0bfcd6045a58405044a184f20f3d7c535a96866e86df994af5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691623, "uuid": "04fa2bbe-3e60-47d7-b208-00ea9e3adf0a", "value": "T144439E7BC8BF6D94C5894674A42649741F63F10481B3EEFE5E818B608047EBCF61A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691623, "uuid": "29b6cd19-34cc-4155-9d43-a0c9951d656e", "value": "1536:gCdszO3y+wt6h/lc89C0S3nePMHC1Id42++:gCqO3y+60anePMHr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691623, "uuid": "b19888f4-a612-4aac-ac52-6030ea9ae58a", "value": 56820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691623, "uuid": "0ab382b0-1c17-415c-b9d0-a6bf6259e7ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb42287-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691726, "uuid": "3eefd087-8f64-4e46-ba03-79af48943390", "comment": "Malware payload (Mirai)", "value": "55a0c7c94b95d4fa8543fdff6764aefb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691726, "uuid": "7b2332a7-6d81-4403-90f8-c4098059091c", "comment": "Malware payload (Mirai)", "value": "f1716237de5c3f7494551d06d122284a69377c0ddaa58f40a89656f89532f74a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "0ecb79ee-4721-488a-8a2a-122a763a7b4f", "value": "T1BC530881B8819A46C5D422BBFF6E41CC3325A398D1EB32179E252F1537C792F0E7B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "731e730f-6ef0-46f6-9cb6-985b6bd676b3", "value": "1536:kCWmw+yQpGQOu/OSP0v0leyKt7X+JHjZImVJFVnFdo:kBmwepXO871lhg7X+JFBHFVnFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691726, "uuid": "ce1232c3-44b5-4f25-a551-5835919894b9", "value": 62436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "dcfe4620-78d4-4b09-a220-2250bfe47791", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbc632c-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691726, "uuid": "d0c60610-e09a-40c1-9a12-a6ae4b00f524", "comment": "Malware payload (Mirai)", "value": "51cbe106499cd6ba0fd040aa78e32c02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691726, "uuid": "d77f3342-b519-4213-ad3a-feff0d46a840", "comment": "Malware payload (Mirai)", "value": "221a655aa1f8a503c022e6b81ea25a50ab3d9148e53e41849a5118d3d5753391", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "13eb8758-f41c-4acf-8337-bae03fbcd54e", "value": "T1EF634AC6F401DD7DF84AE67A8C524D0CB231F2A119530F2767ABFEA7EE71158291AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "f2484423-6580-49ee-b1f8-1b36017919ac", "value": "1536:2mTPjZfowy8s79xn3Kfzm9KZQeuacWjcW0JcWcBFrjMVCgM7w3Q8M6K:2CLZfda9xn3KXZQeuacWjcW0JcWcBRjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691726, "uuid": "fc60b268-f43e-44ef-949d-628b29669f17", "value": 67132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "707f98a6-6a1b-40dd-b60e-2640068bf8f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcc53c7-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691726, "uuid": "fb952ebf-6c31-4f65-bd73-3a92168965df", "comment": "Malware payload (Mirai)", "value": "44f5fc89f22113665b69bed8b4ca5539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691726, "uuid": "8c175ef8-fc01-45f0-a766-98a9667b91c3", "comment": "Malware payload (Mirai)", "value": "704b2147cabc25343642a2c8e70d9f8614280069261168f0684760848334d115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "2f566521-a788-4dcb-819a-e5264e8372a1", "value": "T122C32B56EA818F03C4D51776BAAF42493323E754D3DB730689186FB43F86BAE0E635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "af26135c-8a41-4ca0-92ed-2932cc29f80d", "value": "3072:lgU/44TM2nDQwI25oFxhYJn6ZNI+W4LxV00i/:eU/44TMKFx5oFxh0niI+W4LxVxi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691726, "uuid": "ff409700-91c4-4c48-9f5d-f6603b7ac9fd", "value": 121479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "c574ddf6-f4e2-470f-841d-4445e5810e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bce2efe-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691726, "uuid": "9077d5a0-379c-4af2-856f-745af3847401", "comment": "Malware payload (Mirai)", "value": "cf54fb1a5d8bd6bed69db1d6ee94bbb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691726, "uuid": "def28189-66be-467a-9993-f9363c998092", "comment": "Malware payload (Mirai)", "value": "aa5eb20e1cd80757a0576bd4f87f237f0e02eb17f6dbb4a0ee7e7fde7ebdcabe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "b8026e1d-d9ea-43f7-ac7a-fa4cc8c79415", "value": "T147B3C71A7A218FBCF69EC23547F78E31465526A22BE2D144E25CEF001F2178E6C5F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "b2d1b911-dceb-41d7-813f-1bc5f286a22a", "value": "1536:FkWTdOyR8sUFYL219T0EgXwF6AiqaaNaGko1oLbCuCsBYdpXY7Zwo0KNd:FkW4yRFmYwggF6AiqZaE1oSm+ZY7/XNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691726, "uuid": "a18e9968-53d2-4d26-9058-92daf06282f3", "value": 107905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691726, "uuid": "fb39ea45-74ae-4a91-9788-e578b2f0c70b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f332439-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "7670ae8d-2492-4d3b-afed-b4c3eb7fe31d", "comment": "Malware payload (Mirai)", "value": "21b8c021dcce3141b75c5cf328a16b1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "ab147b32-f95f-481d-b2ed-9b7d7c9943b0", "comment": "Malware payload (Mirai)", "value": "feabea3b65ac5a5479e4ae0bb35fba2c65d8c80920e772e113a327d7dbfa9bd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "d8e5c80b-cb1c-4595-a6ee-f159cada46a0", "value": "T19A03C592BC828D5AC9D457BBBE7E02CD3315A3A8D1DE7313C8145B147ACA91F0E67B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "43d239cc-765f-44b9-952c-1df5bc35f629", "value": "768:QqnrAl9twmMDMqPJnj9Yb1skTa3LcfJ+7ojxh5d4At+88iR1KxenyA4iUS9Pqk+2:Qqr+jrMQqhj9OTa+Bd4K5KyhWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691785, "uuid": "d4dbd893-0d28-4e8b-9c14-d9ae9d934f0b", "value": 39544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "86ebbdfa-5e58-4d96-acd9-a26ce7383bad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f43114a-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "de795f32-a344-4a8c-8059-0c707d8f4901", "comment": "Malware payload (Mirai)", "value": "eb618558d0f5b6d90ded0547dd5ca536", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "0f91c3bd-607f-418b-903f-65b7a759229d", "comment": "Malware payload (Mirai)", "value": "ea2062729dbcc481b5a2e43e07e120ec730ab87f391fb1ee303bd3961749f22d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "6f7582a8-e625-41d5-a544-b8b797c04a56", "value": "T1AE83291122394D67D5974AB029EF0BF193FAEC8129F176049D1FFFA80732BA51486F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "7ad1899c-e111-42cd-abbc-bb539bf221dc", "value": "1536:m38eJ8UiAXeUMFTBfWmvZqGY1kSzc2vl0/Y1F4MWzz6qmu5jcS7wU:mMxKeUo5WWZqvzzc2v1NW4u5jzkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691785, "uuid": "ea79c96e-e900-4edb-9404-f7a5e969c3d6", "value": 86201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "4b0a7fa2-8fe2-4020-a377-f24668635c03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f44221f-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "2f9ef260-3ff3-442f-9699-fd088574b2bd", "comment": "Malware payload (Mirai)", "value": "d10ecc70ff0127c5aa8d6cca39af23ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "38832718-3204-418d-87ca-be83a80a43d4", "comment": "Malware payload (Mirai)", "value": "4e9af2ffa4ff7a0bbec19d6afc09c6f99c6cdf08ae2e8bc46b7e9aa74126f24e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "f1a4c6e4-0671-4732-8afd-7d4eabc54656", "value": "T14E734CC55263D9FBD8820F7511A3DB764131F8262B6E9A47F36DBEB16A037C470862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "671a8219-3508-4dd4-a131-d4203577a003", "value": "1536:MqUnIwZ22CYNotPM/yyo5uDTkWen00yZnjny6uC2PzKgSwqm:MqUnIwZ2/Yotiyyo5uDzqyde65sK/3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691785, "uuid": "5dfa1f78-4cf4-4adc-b4cb-f1d1b5b260c2", "value": 74284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "ebdf02a3-708f-41ee-91e9-321982427fdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4427f3-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "2dadaa22-3c3f-449c-a127-650c32eb84b1", "comment": "Malware payload (Mirai)", "value": "c0a90908b988fc2c92512356f738cd6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "3cb5d7a4-f8db-4022-8097-ea1c775dffb9", "comment": "Malware payload (Mirai)", "value": "7f300ec895ba32b04e3276dd427fc2b0fd0ab8688f6baa0ee0926683b032c25a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "0139fd70-66c2-422d-90bd-f2ba1e0a1023", "value": "T1BC733B1391659EA3C4465FBD15BBC6380713A8224B172E35961EDFF80747EDCBC983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "dfb4a65c-6794-474e-8407-c532716313fc", "value": "1536:o2gWo0I6RZdfE3/hnIKYloRoHClA2GQLp8j6ESW:o7Wo0I6RTRKYme1QtFPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691785, "uuid": "88fad96c-0c21-4cf8-9e68-781d0d6dc5e5", "value": 79087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "76e1a5c0-164d-40c2-898d-3ac9840896f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f449716-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "7c13e87a-4abe-4b12-a407-6212c6ac3ae4", "comment": "Malware payload (Mirai)", "value": "f1e4aa1605f589f2c80404a26d34c10a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "dce13692-d4e8-46c5-9e81-a8e9e66ed5fe", "comment": "Malware payload (Mirai)", "value": "cadd220d90baaab9266ecfbed81a00902e993e871c05d8cc88f2504f2163ba6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "e407983e-cbca-4a41-b18b-1f9fa96c212a", "value": "T149933B3227392B27C4E4A57A40F79736B3F65B892960820FBE251F8C7B556E031933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "7d225068-870a-4d35-a5af-c80bfe629fa4", "value": "1536:hk2FwFyyJ4BcZKVE54dpZTu6SkI6WHrg1wZWEuAcE/SvPU:6ypw4FW5Sq6SH66rRWpAcEa3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691785, "uuid": "f13c5d9d-8577-4aaf-b4c4-e0b7ecf982fd", "value": 94031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "39cd56b9-ca93-4c32-89b8-b371738e9c2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f566cb1-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "21d74b74-2551-4ad3-8f6d-2d413e2d1be6", "comment": "Malware payload (Mirai)", "value": "956b234835d439979f88538831b60d8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691785, "uuid": "bbfc94d2-b36d-42b6-8bc8-0ddb165a0a01", "comment": "Malware payload (Mirai)", "value": "f744d4e457217e9f287a05c305d57bd27cf9fd6fc37d677e3bc061762a6c97c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "5b80f9f2-b71b-426b-8d6f-e3668ae08a78", "value": "T115C32C56EA818F03C4D61776BAAF42493323E754D3DB730689186FB43F867AE0E635", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "33afbfd0-d16c-48bb-a57e-a54dd70ce6a7", "value": "3072:lgU/44TM2nDQwI25oFxhYJn6ZNI+oV+M/900i/:eU/44TMKFx5oFxh0niI+okM/9xi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691785, "uuid": "12b3e97d-a4e3-45e8-97f1-40f8ade8f5cd", "value": 121479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691785, "uuid": "c20e6f22-1d64-4329-9391-e13796b1db24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f89693d-22cb-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745691786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691786, "uuid": "0780121f-d276-424b-9f39-46df08fbb5b5", "comment": "Malware payload (Mirai)", "value": "36ed21fb64b6c3802bac495ebce10aca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745691786, "uuid": "d6b0d17f-52f5-4ee7-b931-2e3fbe2118b4", "comment": "Malware payload (Mirai)", "value": "3b1bfa0198d3c3485432ad03e1ed25d41b6d3d2e8e16e9a2fe17befe856835ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691786, "uuid": "69e960ac-fa8d-4619-bb96-6e33edf1deb0", "value": "T1B8B309066FF01FFBD85BCE3711EA1751148CE91A27A62B36B138DD68B74768E06D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691786, "uuid": "268ff7ad-40ce-4525-8b48-f8584c9f2d5f", "value": "1536:jOwswMWo8ZG3ZNH7Id1kUWnYDIItT1tu38TiHQIEXGZJLvmKNd:jOwswlo8ZGJNbkLT1tu38mHQLy71Nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745691786, "uuid": "1e151022-c108-4c9d-a73f-678870ac9fed", "value": 107905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745691786, "uuid": "ca91183e-73af-4b58-8a52-6dd6007a33b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0681d924-22cc-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745692012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692012, "uuid": "0fe5d256-50f4-4a3c-ac92-b428eeab0432", "comment": "Malware payload", "value": "bb3ca43c178259be7f9ef90d6448c6db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692012, "uuid": "97559ca9-ec8c-4641-9f82-865c41476fa0", "comment": "Malware payload", "value": "21d9f11efefd792773ae6ce6c911153089f97e1f0be7ed3c7c047e2122332346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692012, "uuid": "b9015664-7b6c-4b30-826a-8a6972734e8a", "value": "T15BA5224958F75471F2DF813E4B75125C8B60F35288AB4C4CA62E1E1126C62BE7EDEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692012, "uuid": "63ff0ed5-4200-4275-8c12-0472d2638b51", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692012, "uuid": "5d953eb1-9925-49c0-a5ef-e608529d91fb", "value": "49152:Z14Y2qm5xUuL8ueNvP88d+6h77JfXzlUYdcQBbfx:T4im5KuLoNvk8A6hH9zlhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692012, "uuid": "82b53eed-7d8a-4816-8b0a-92cc48896dec", "value": 2113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692012, "uuid": "f4fdb599-ae40-497a-8e42-022033da6d69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110effbc-22cc-11f0-82df-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1745692030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692030, "uuid": "fb0a58c0-7431-49b4-8bbe-ca3aa7767d29", "comment": "Malware payload (ConnectWise)", "value": "261e4dfa29fc1d22965e00ec2d8d27fc", "object_relation": "md5", "Tag": [ { "name": "bitbucket", "colour": "#435d86", "exportable": true, "hide_tag": false }, { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692030, "uuid": "b71ac811-eb58-4903-95f5-2ebb88923608", "comment": "Malware payload (ConnectWise)", "value": "c674873ddc78fb3a0d38d64a5a376ad1fab881f76b78fc32501af27b31c9048f", "object_relation": "sha256", "Tag": [ { "name": "bitbucket", "colour": "#435d86", "exportable": true, "hide_tag": false }, { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692030, "uuid": "acafe77b-a00c-4cd3-9f0e-cc26b042f4a5", "value": "T1E146E102B3D695B5D4BF063CD87A52A96674BC004712C7BF57D4BD6A2D32BC08E323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692030, "uuid": "e69fb82f-3f44-43b0-a19a-a25f5b78f73e", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692030, "uuid": "405c01e7-9a75-4984-80c1-fbde3deb17e0", "value": "98304:Nzs6efPhFFNUhJFF3s+BoiGg1Gc977zbt:tfefPCFF3bBR1H9773", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692030, "uuid": "3473d711-98ce-418f-81f6-f055be3e6b57", "value": 5658656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692030, "uuid": "848ebf33-09f3-4dba-90a1-2086ee01de39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc4456e-22cc-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692128, "uuid": "d1de0fc8-1fef-46cc-bbb7-bfb92ac39fd5", "comment": "Malware payload (Mirai)", "value": "9560b563d85459e54dd6ae30d3aa9af7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692128, "uuid": "84b2a081-5eb0-4fa4-ae78-00fae981cd05", "comment": "Malware payload (Mirai)", "value": "5cec8a32047c618a87493a1f7b0b266865165247179cb99a229b4af9635edc55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692128, "uuid": "8b81dfe1-0b4b-402b-b1c0-e64af948d131", "value": "T19AB3AEDBF34751A1C8A646F007C74BDD7E2322815F2BD6E77D29213A68791CB8906F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692128, "uuid": "4f9daaf6-2c75-46cc-ad9b-9170cf90609f", "value": "1536:0VVhV9j1WmAOgROGkiyatwp7rA1n1gLR/LW0:0fhV1wmAX1kiTwVrA11gLRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692128, "uuid": "1d1334ec-a808-4744-91f7-ab93dac144e1", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692128, "uuid": "b2eef737-9827-4e88-93ee-8ab9175d1fbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f41e4cb-22cc-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692161, "uuid": "fb0b47e8-0b0b-450f-b39b-63b282753365", "comment": "Malware payload (Mirai)", "value": "6ba8780398ad6ecf04f66a4d29dcd327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692161, "uuid": "b2037570-39d7-4f66-9079-571c5c63a17c", "comment": "Malware payload (Mirai)", "value": "f55cd3a5e6f68864b047ea7c8fc020bb34011ebca162d56987228cdc0eb1a7f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692161, "uuid": "99e8d6a9-2568-4d68-8d07-a0e0acf19270", "value": "T1E5D33B46FA408B17C4D513BAFAAF4249333297A4D3DB730699185FB43F8676E0E636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692161, "uuid": "aa0fd51a-3f69-4997-ab1e-2db44d7f2ba4", "value": "3072:Mcxk3MzGNCPrz/mfeEgpsmasvwE7s1z6GSOHMUbM/9Eujj:DxcMSNCPrz/mf7msmasvTg3HMIM/9njj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692161, "uuid": "7705da5a-e455-40aa-836f-771d66fada8c", "value": 138049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692161, "uuid": "4fdefbd5-e26b-4963-bdf7-07482fcc8542", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e1f9e8-22cc-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692358, "uuid": "5103dd8e-4950-4d4c-842b-f57898c06124", "comment": "Malware payload (Mirai)", "value": "bd8509dba224e9eee3d5e507185142c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692358, "uuid": "9d1190e3-5209-4c44-807c-92baa5576654", "comment": "Malware payload (Mirai)", "value": "1d52fb249e38c275507e3d3ddae076176dd1fd4544ba2246f87846741a11d5a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692358, "uuid": "aadb2310-3eb6-4a10-b67f-e9cab1aeaf6b", "value": "T101041946EA404B13C0D627BDF69F424533239B9497E7F3069528ABB43FC679E4F229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692358, "uuid": "9dd4c4e5-84b5-4e6b-8558-c31d53c8025e", "value": "3072:ShaFN1G2z9mY6U24q6EaZsTPtgBK7QGnFLGeY3mXJo8M/Ri/2VctFe6:iaFy2oY6b16EaZsTPtgBG7LGB3Ou8M/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692358, "uuid": "41e216be-d464-4d39-85a4-76aabc015dcc", "value": 188580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692358, "uuid": "edce9d13-3e84-40c7-bc78-d81a159c10c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac76fd2-22cc-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692395, "uuid": "f60250c9-b22c-4552-b16b-975eac030de2", "comment": "Malware payload (Mirai)", "value": "ea71f92da766cdda6446b086dab2cdd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692395, "uuid": "0ad63bd8-104e-4a51-882d-e5df4193dca4", "comment": "Malware payload (Mirai)", "value": "d35a35bdad5c0cf97a5c9b843376eea600bbd213535a0fedec4235c1d23b4e73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692395, "uuid": "acef02d6-dcad-47c8-86c3-eb2e25548293", "value": "T17DB2E018B54C6D29C46CE27ED1B2C4AAE5583EE4833DD35B9B0A9180D3C31B3E0765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692395, "uuid": "5cad8e8e-52ff-46fe-8b63-7976c925bef0", "value": "768:RELPx+P/YAStkzUK7l+1yq0jE/GJrgoH/:eUP/2K7lv4+Jlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692395, "uuid": "2d624f72-33ac-42ae-aaf8-10bdfaad0088", "value": 24840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692395, "uuid": "215e8666-2d4b-4b35-bed0-01ab319205e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29c6407-22cc-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692408, "uuid": "6701c367-919f-4695-a4b1-319331ad39fd", "comment": "Malware payload (Mirai)", "value": "0c67fef6b2ff3cdca00d64b16827c669", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692408, "uuid": "27d47cb8-dd59-4388-83e1-f0fb0befed5e", "comment": "Malware payload (Mirai)", "value": "df366615670ba91d618961269db7e4ccde5e23cef5b4a9c8f242fd25ad4b899f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692408, "uuid": "85e384cb-c3ec-4b8c-b524-0c422b6af90e", "value": "T1D5B2D030242F6DB6C9A1293DED78C08336237EFDE5ED6DA362358A17648244F36BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692408, "uuid": "672d3f03-d59e-421f-98fb-7cfd0d841e8d", "value": "768:wLdHjCDMv9l4jFXZyOt/7ZOlpuFam6/aKuEjyas3UozG:wLdDCK9lBOt/7I/jm5L6yXzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692408, "uuid": "13b3cffb-b61b-4e1f-a62d-1508dd240516", "value": 24968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692408, "uuid": "d9c91a7c-61f1-4450-9657-5799b980328a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1b9af0-22cd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692506, "uuid": "896fb92a-7f46-4ecc-8337-4c7be9402307", "comment": "Malware payload (Mirai)", "value": "c1c284f17d18ce27aa0e0b10731e49c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692506, "uuid": "b7fe4310-bd10-4b2f-97a2-976a9995b574", "comment": "Malware payload (Mirai)", "value": "2a9605feb265db6f4045ad0500e02393752cf53168fadaf447ee073809afd5be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692506, "uuid": "ae0f3c99-63e3-4036-8d48-cdb0adac0dca", "value": "T17ED2F170D2B5C492CA269836D26477C93B63AF78D1DE70160748A5C41EE5E0D27FAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692506, "uuid": "4d5cdf70-39ea-4e41-9e81-6cd4f49deef9", "value": "768:1kvfkDWcNQSHoZ3xur6mPEdDn6WmCR/uET9q3UELEd:1kw6SO3xoFENvR/wLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692506, "uuid": "210031a5-5ebc-4a5e-835c-1f9bc415930b", "value": 30620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692506, "uuid": "2517326b-85ce-45ba-ae54-37b45499e575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6ac419-22cd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692510, "uuid": "971b0886-a54b-4835-ac55-0a1605b48037", "comment": "Malware payload (Mirai)", "value": "426196ce54457e5d4c283369e026c49b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692510, "uuid": "a177b913-b502-47e1-b147-6bd5ce457d58", "comment": "Malware payload (Mirai)", "value": "c343e0d659acc042f3b4ee7a7a40f511e24a9cc899f58665f1d8c116e3a80769", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692510, "uuid": "7900b60c-9f2a-4ee2-9adf-12dbd78c7e55", "value": "T14523F161C175B8B183B0693DE9B44E9B3F1E2B2CD2D0A6A53F9E3E089D90D4878F10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692510, "uuid": "d43ecf8c-4dda-4002-857f-580fd496090d", "value": "768:XmtDLeq9Omz3GntxSSLf3TgXHcIdrGs4M9q3UELIvaupUTrk31Ugfh94WW:XmUqf2DSSrTgLdrGZVLCNpUE1jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692510, "uuid": "5d974650-8a7a-4136-8740-8be4978dd01e", "value": 50072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692510, "uuid": "9242a6bd-24bf-4c99-b518-384d7672bd29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b2b499-22cd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692544, "uuid": "f2bf49cb-7901-429d-bb55-1f7c88a2cf6f", "comment": "Malware payload (Mirai)", "value": "0620339ee469e65f56738067ea00caa9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692544, "uuid": "3641bb7b-3547-4763-9bb5-71b0d0899413", "comment": "Malware payload (Mirai)", "value": "345270daf723b6a7aab6abf1538af9c819aeef33b72e11727bed05be97337bf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692544, "uuid": "0fa36fc0-7c05-4127-a2b2-f6e1867673f4", "value": "T1C192CFB092C67CB0C9B00D3A97B89687EB67C3A4D5EA212D374067257D412876DF86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692544, "uuid": "662e9cae-fca5-4137-8515-30183461a18e", "value": "384:SeW8akvnyHHkSuz/Ijj03VACo9DvHxQu3F/m3kChymdGUop5h0Gf:c8a2CknCexyDugI37s3Uozpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692544, "uuid": "a247ac23-0d00-49b3-849a-f828921486a8", "value": 21252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692544, "uuid": "9aa3a0bb-d078-4e38-be27-235d78737864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90422fd4-22cd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692673, "uuid": "7198c6d1-4dbc-40a5-8a9f-727e00b48719", "comment": "Malware payload (Mirai)", "value": "23b587dc7acd57fe8af504079dddd313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692673, "uuid": "29980259-dd89-40a0-abd8-5757df109e94", "comment": "Malware payload (Mirai)", "value": "31ee2d80c261479e8049ad4a81e969f1a019c8815d3ad994d87526c43f84359d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692673, "uuid": "bad3701e-7169-49b7-949c-420b5e1ec806", "value": "T10BB2E0ABC2395E62E5BBFAB90D9547D0FFF91B287374C282659CE7410212A2895086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692673, "uuid": "c638e5ce-7409-42f1-9313-9a9c787d4445", "value": "768:AQ1X0zY7ZACJx45Q7vwjMDnIjeBJEQUgCDADL4uVcqgw091k:zEmx4svwjIYeBJEfT0H4u+qgw091k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692673, "uuid": "f457d96f-8f3f-4843-9fc5-e9a83de6f470", "value": 25512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692673, "uuid": "b716f510-2d17-4dfc-81a4-ad93b02c9bb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b54925-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745692947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692947, "uuid": "62ffee8a-ef58-40e1-940b-df2a40f70e27", "comment": "Malware payload (Mirai)", "value": "ea5b6163d888ea92b80914af7ff4e4a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745692947, "uuid": "a2976a1f-0e00-4e19-a1b3-17522964f920", "comment": "Malware payload (Mirai)", "value": "024951b91f9c86d68ba789aa675412945dbd31e9b81b781d8b680f76bf3688fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692947, "uuid": "f1bab0ce-6a43-422a-85f9-7322b74e7736", "value": "T1B7C2D05D614138F8CA0596791BD40B83BF718FA9D283D84B6665EB079FC02E87C52B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692947, "uuid": "59f08b21-bc64-493e-9011-023a68a87e40", "value": "768:1prD8zo4539Q/y0VY/HMFQgQzJgGlzDpbuR1JW4:1azC/y0EMqpVJuA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745692947, "uuid": "20f27b4d-db73-4d4c-8c4a-5f26fa50a96c", "value": 28004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745692947, "uuid": "66c50b25-5843-4c2e-9921-80d78d328c5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5440cc95-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745693002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693002, "uuid": "65c39c3e-6549-4194-a987-571a2a8fe5bb", "comment": "Malware payload (Mirai)", "value": "7bc7b54ad4c7909a4ba07e33f21a2a91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693002, "uuid": "5c813f4e-7f4e-4aa4-8712-98098e3c36e4", "comment": "Malware payload (Mirai)", "value": "7153e28b247d065b979dfa49e9e0a474c258f6e67ccbb254d85550f50ab8be64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693002, "uuid": "cef120e1-f24d-4189-9461-a887b33df5ef", "value": "T145432ADAF8029E7EF80FE7B9501A4D0EB921B7C11283472363B7FD93AE321945906D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693002, "uuid": "b1481cbe-fb70-453c-bffa-137078850316", "value": "768:ZleskpRta84UudGdIWYUBdgz5hJceITU8+Wqj2hnzq50Xqxrjkjkq0hoXtGE:btkANAdILVz54e4U8+Wqihzq50XkrwWE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693002, "uuid": "463849f8-1fea-45f7-8b51-a43720bf19c7", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693002, "uuid": "fe6ed189-2623-444d-a42f-b1c63bb0c9b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9695ed3a-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745693113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693113, "uuid": "bf52ec59-75bc-4b4d-b7fe-cf3e58eda644", "comment": "Malware payload (Mirai)", "value": "05b83d9243cdfb2aede8faf294403675", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693113, "uuid": "c8068b10-69ba-420e-83de-d3cf7ddff89d", "comment": "Malware payload (Mirai)", "value": "dbdf281599049fe75a2608591e4b4b971c1ed9797bf33e93ca4b9113afa9a885", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693113, "uuid": "db129250-64cb-4995-a77d-304e20fd209f", "value": "T11A339E23E5295DD4C69D0174A09CCF391F03E5C493931EFB1AE68AB26843E99B50AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693113, "uuid": "a52acdbf-4f2d-4a38-98cf-876304327526", "value": "768:4aK7b0LrnYCMHqif/atpntUgCCsiQpcbjm93ybwCCWohBu2gICOEw:4aJzdivfSmgItybwxph0nICOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693113, "uuid": "1697e09f-b053-46fe-b67c-b58d63cb33ab", "value": 50868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693113, "uuid": "515e2489-1df0-450f-8e2f-bea0d82ea152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae8a3f4-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693227, "uuid": "23ea84fa-9eea-47c9-bbab-1c63700e8cd4", "comment": "Malware payload", "value": "2917ad9b59316b4dcd5c7d4a380808b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#8f1ebb", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693227, "uuid": "b3bfcbe5-9a2f-42da-ac96-2443cc9fa27e", "comment": "Malware payload", "value": "1cc6978d10d80b69bc4b81691cac907e20d16bb7febf497a18d85d43415bd64a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#8f1ebb", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693227, "uuid": "f36d8f41-bc78-4a20-b217-92618f077eb2", "value": "T16085338E434D6FD4B98BB15CB5B2C2E56E7DA295B1FA3288E072FDC1484CD4D8912C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693227, "uuid": "c2b68e06-cb76-406b-a77b-9241f4ca936f", "value": "24576:Yxt/vCzcJh7JwgZ5CwbllsQDCD7Gc7+Y6rgXgxIl9KAUOjUqOAzJymKjfan:q/az6h7JnDsQ2CW+3Y3jBOMJhAfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693227, "uuid": "7ac63a5d-815b-485f-8d0e-1fd3f7251c23", "value": 1721636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693227, "uuid": "e67b190e-c7ff-4325-871c-1fd75ebde558", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a227a5-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693264, "uuid": "149beb19-a3f6-4c6b-a9fc-7a99a94e95d4", "comment": "Malware payload", "value": "0615f7a01bf544e4da8b56f1b746c2cd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693264, "uuid": "f2fd3e5e-ca09-4e35-910f-fe1f8355f3de", "comment": "Malware payload", "value": "63ae8a9d4545d933fb8b343453d578798be18812e59a4548ecdb22a6f5ca97da", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693264, "uuid": "6f634c8d-48ae-420f-85a0-c1a754bb5bd3", "value": "T13836335EFA3D8455CA819271005CE6707630AE58CFBF864BEC52FAEDBA3721314DA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693264, "uuid": "643f5eeb-7169-4eab-a7b0-b3a20b894b7a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693264, "uuid": "29262dc2-3b5e-463f-a694-957e7e38dd82", "value": "98304:H0/56eGiON9UDPgyHnt9WrtQI1rOuxc/zhJvFNXMTg0tCOPcFK0hCIo5loR59:UgevAyNMrtQuOk8FLVMTg0tCOaaIo5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693264, "uuid": "a0e48081-7739-462d-97c5-283b03e20f59", "value": 5049856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693264, "uuid": "baebc75e-73ee-43e6-8e46-591d1b5328e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd7e89b-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693286, "uuid": "d9640fc4-badc-48c1-9583-f7bb47c4872d", "comment": "Malware payload", "value": "bb16dde30b851185630ccdc3416b29b8", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693286, "uuid": "1b275058-8681-4f2f-b70e-77a53e57e175", "comment": "Malware payload", "value": "160ecaf1237207b658ae38660d9eff724683ab8d8c7a94074453dd59daebcf21", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693286, "uuid": "cab5253f-7c06-4011-b6e8-cd8cbb00e8d9", "value": "T1A8D4BE2276FC8125F8F3767819F86275563BBD608B75C7DF9240938D2AA26D04CB0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693286, "uuid": "e2a65465-f8a3-4e17-a2d3-f504e38daa34", "value": "dfe29e45dd9c33682c6c062000c89847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693286, "uuid": "afeb4e5e-a59e-417f-9b0d-085eeb9df941", "value": "12288:lHxTOhPWba55P92+uByQdqN6NVOez2lnXByQVQjnrlqaJfi4:lRTo55F2/yQdqc8ezqn/GrlqaJfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693286, "uuid": "22c9affb-2ee5-4ee1-a1ef-705c931d217e", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693286, "uuid": "61da08ca-6212-4081-87bc-ff8ae647cadd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe05dc4e-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693286, "uuid": "83e5828e-e77b-477f-a04a-98e39e8dec58", "comment": "Malware payload", "value": "1a68d2031d0bd524565e2ae7369af4c5", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693286, "uuid": "b0290061-e292-4780-b710-f773d4fd49ea", "comment": "Malware payload", "value": "07286e069e15f02e5560ff5d9f76f24ed32ab01a4e374f67dcf51df33488b432", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693286, "uuid": "e7e082c4-9cd6-4d14-b959-88970346b6a2", "value": "T11575333DC79A7357CA4ACF763110FA19CC0AB9B356B94A356E650743F78408E36B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693286, "uuid": "8b577802-8696-47e5-b610-d928b8953cb9", "value": "24576:meFH3R2HxbL9H2kDyUBdwSocbEyVV5u9cSaM93S65bESyLN6/Yoi:meFX4nH2kDyAdIcbEcrwc5mf5bq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693286, "uuid": "cd929af1-8f11-4fbf-8608-0c244ce546aa", "value": 1633525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693286, "uuid": "f310c2f7-10cc-4464-973e-c3214eb00e79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe19a46c-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693287, "uuid": "2612e85d-fe96-4780-8549-de278543993d", "comment": "Malware payload", "value": "1f95d326d120d381a10f53596da3e30e", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693287, "uuid": "b946fbac-4aed-4af0-beae-25f1e6cb32b5", "comment": "Malware payload", "value": "b909564095c489b8490a68f0145e8a6343991c031360bef7439c6b18740bba91", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "d0285c9f-04db-4af1-b224-f87e00912d7f", "value": "T192C4AD227AEC8124F5F3767819F856B1567BBD508B75C7DF5200839D3AA66C08CB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "7a5f4db4-c585-4c9a-a82b-a1ddd7cbbbff", "value": "dfe29e45dd9c33682c6c062000c89847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "f4d5650c-aac6-4756-81ce-fc5a7749c9e6", "value": "12288:BHxTFhPe855P92+u8yQJj87KS0QeHF8gSUoJJK9oK904lX3RUh6wI:BRTy855F2myQJjjV38gSUozIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693287, "uuid": "ea188a36-7069-4f4a-a107-b39b1f6606c8", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "bca13a74-f31c-4b63-a190-46dabd49b016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4626f0-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693287, "uuid": "49272669-9ade-42be-acd0-8fa4cf356839", "comment": "Malware payload", "value": "648ee16921efa97a62e291c5145d88e9", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693287, "uuid": "8c907a6c-648a-4f8f-8469-791d99c80fb8", "comment": "Malware payload", "value": "f186e86c633782e1ed908c7f559b36db09f82ba0ddbf9138cef1a533aa1f6a4d", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "adec3f4a-d536-4f60-83b4-46cfec1b8249", "value": "T1B8B533BDC075CCBEED489226DA910F50C76549A598438C3B23BAC6BCA51377487A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "c800df56-cdab-4888-a0a5-35def271a88c", "value": "49152:5MiF3EnguJxH3MsBWQH1MRZDHd7nx6Y+7ieLNsh0z+bP7JtfkU:5fB6csBV6D9beLNS0gP73x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693287, "uuid": "b5ca917c-e6e3-4486-8650-c0fb5904dcd3", "value": 2447275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "2c56edc7-a026-4dde-ba86-ca32b1d62d12", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe51d35d-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693287, "uuid": "625f821a-b8b3-491f-8610-3785b3c3ed8a", "comment": "Malware payload", "value": "2818ca4044dfad0f174c865203f2a1b1", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693287, "uuid": "7069de19-b11a-4dcc-8c18-1b0c0d3fc8df", "comment": "Malware payload", "value": "e83bfda79f3e4eb316f1fae7f113cf407a73e30f4f7113f9d08b19cbab000917", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "e426d742-73f5-476b-b843-cbd4f97b8ca2", "value": "T1CE75333DC75A7357CA4ACF763110FA19CC0AB9B356B94E356E650A43F78408E36B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "45e11650-3fd7-4181-aa04-9577f2a7b30a", "value": "24576:IH3R2HxbL9H2kDyUBdwSocbEyVV5u9cSaM93S65bESyLN6/Woye1:IX4nH2kDyAdIcbEcrwc5mf5bq5e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693287, "uuid": "17ccf039-1b0c-480e-b19c-1f1d5d0cbd28", "value": 1633525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693287, "uuid": "0c53bc8c-7a0c-4150-81bf-f2b2555bd344", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec59c22-22ce-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693288, "uuid": "eb0c7bd5-7ad8-4d8d-a8b3-404bf28a3832", "comment": "Malware payload", "value": "700f92b8d92d9d003e04c0774ef31f7a", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693288, "uuid": "b4553fa2-37ee-413c-9404-eb529c16872d", "comment": "Malware payload", "value": "38d38aa52de968bd9ae534778d7b6db1835eac776dcbdffb40258e3cde99c226", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693288, "uuid": "4c9981f0-8144-40b8-9bf4-ab59b705e6d8", "value": "T162C5335CF5BB3EA9D3232130798A8A06B598867FE831171FA737440719F1B60CEA5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693288, "uuid": "63fc8ba3-7163-4137-aa45-edd20cce79ba", "value": "49152:g6BGhV94bKqt0mcG8xiqwL/u4kE9l7kCHRwrG0rgy1TynSIWAQBza8wU9x4x7g3P:g6o/Sdx9qwVlBxRqGsx4WAX8Kx7g3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693288, "uuid": "30ff4f7f-01a2-4fef-bd36-72a5cfb298a2", "value": 2726164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693288, "uuid": "029f8b00-3ab8-4a44-88fe-6c569fa8e61b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05635330-22cf-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693299, "uuid": "70b2232b-a691-4138-b1a4-8e3df14a8cd5", "comment": "Malware payload", "value": "dcee0a6be229f2a1df71c0ca1cf86df6", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693299, "uuid": "c00e205f-b461-4879-953a-ccae151d6a26", "comment": "Malware payload", "value": "487420dd26047e44f53acd3d3a80ed51d798fa6426ea7d065e7296f6b36692ff", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693299, "uuid": "6ab5cfc0-8742-4dc2-ba05-5618c39e0e9f", "value": "T1E3954A46B8E214FEC03AE5314D52F76136327C6547322BCBABC5766A0AB1BD42E3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693299, "uuid": "bdd0c87a-5180-45a1-9a8b-46426b082b05", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693299, "uuid": "ddec44d7-9765-48b5-a4db-a4010a85372e", "value": "24576:FJZWN8ek3jM3HIwlzI2ZG1RSQ3ac1irL8bujtYgidK1XNm:W8ekTM3H7lz7OSQ3a+fgidK1XY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693299, "uuid": "f141cf97-f17f-41b5-abab-87c70e138769", "value": 1888216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693299, "uuid": "e340d76b-61ef-4d7a-9939-c89292afb142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15abc58c-22cf-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693326, "uuid": "775e77cf-baf7-4130-bd90-14c57f29703e", "comment": "Malware payload", "value": "6e2e2c400c3b85f1f39e06d47d3124fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693326, "uuid": "a6a8df12-3cfa-447e-b388-873cd6213686", "comment": "Malware payload", "value": "f944779746a458ad311f4febe6899813a9af5a9e994dd8225def83dc6ba93ada", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693326, "uuid": "a54a68ee-e89d-4b03-864f-20e13de53891", "value": "T177853336972EBEF6DA6B03796EDE5BC78F246623341ECC0C44806A370D935D59B046", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693326, "uuid": "7cfa77f3-f56b-4184-8e67-5d59138ac485", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693326, "uuid": "76f25d5a-2c32-414b-9903-f16465ee7510", "value": "24576:X0v8bdn/MCCMyKfCMqMfbzYuQPRDtUYScR65TKud+/xLx5rG5gHnAadQW4/jAIJ:OIMbMy+pzzIPZ6RZlCP5rCgteP/jAIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693326, "uuid": "58ef8975-31f5-4347-946a-f0964330f4c4", "value": 1871872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693326, "uuid": "c873672d-78f9-4887-ac20-5924936d9387", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3931bdd6-22cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745693386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693386, "uuid": "ca609e89-99a7-45cc-b116-6433656addd6", "comment": "Malware payload (Mirai)", "value": "ecb7f1dd78ab74434583f09c4532b1ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693386, "uuid": "e24b7a94-c085-4b65-9baf-6d163c513df7", "comment": "Malware payload (Mirai)", "value": "08f39c1639500d3f5edde5ae1b0c0ad751190b4d50ac13f1f9807dcb4c41c94d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693386, "uuid": "b4a75656-b374-4d64-a659-7143b171f213", "value": "T1C1D2D05EF87A6996C39D483F219F173394A0F2E227E7A76C53514C80AB6820FB4CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693386, "uuid": "3b1bdf99-4c8c-4861-92e4-f84daeb2fce3", "value": "384:4OJVOSMAa7NI43ZzG94y1kCPJFD6k4UfTclurQUomdoD6v/ZiZnln+dZUldb80q0:4OJZgKY1vSZcKQhmKD6+N+dZUly0KRWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693386, "uuid": "805962e6-fc8f-433b-bc73-c68fca13d16e", "value": 29040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693386, "uuid": "2834008b-b41e-4f1c-99a0-8e951c7477c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9431584-22cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745693574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693574, "uuid": "f9fd1e87-f603-47d0-ac58-2d8b508fb876", "comment": "Malware payload (Mirai)", "value": "b5597c55b5e3fe8dda6eac327c758acb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693574, "uuid": "2f4546e2-8c2a-4f04-a50d-ac98d25e1e99", "comment": "Malware payload (Mirai)", "value": "b441238651dff6f50a424b3573889d77a84850a7e54ef99d09a582dc51d2c2dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693574, "uuid": "3ee0da72-c435-45b9-8abd-13e22fddae9a", "value": "T122432A22B6760A13C0E0A47A51FB8729B2E257DF61A4C75E7D720F8EFF11A406902D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693574, "uuid": "f6447227-dd64-4374-a553-92fb02054000", "value": "1536:ub0Ba1wpPLxt0xU7gKKTc+ycYahcFnYK/I7u:EotFaKKSPFnx/I7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693574, "uuid": "2fdc70fc-358d-4935-bf6b-8c6ad7f528e6", "value": 56840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693574, "uuid": "a48af256-d660-4e6d-9134-0abe9aef30f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42e949b-22cf-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693619, "uuid": "2383d8d9-dce3-43de-8893-386c442e3547", "comment": "Malware payload", "value": "2dddf5e90ee8ec77d815022472e8dc88", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693619, "uuid": "e0c885e7-b413-4522-94e1-755676fde898", "comment": "Malware payload", "value": "c23cafa2ec0190d1323f800d6e814a29faddf49f7e304c7ee82fd8f4573bd7ab", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693619, "uuid": "1b3eaa51-7d6e-498b-99a4-9502bde2e09f", "value": "T1DB95333F26C39944C55E06BD1B09EC4071BCEC34BEC7BA9461B3AA6C6587298DCBD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693619, "uuid": "012b0804-a73e-4c3e-956d-45224792f390", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693619, "uuid": "c6c1f79c-1a9b-45ac-a107-e748142d474c", "value": "49152:TCgKA9WhiCkmQWiPA7Ok5ndDkXcRl0xwxudGFh1SQOqE0:Tb9m9kIiPA7OSn1kXIlQwx8GROqE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693619, "uuid": "46b631ad-a2e7-42a9-8fce-8cd4528c6a7c", "value": 1927168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693619, "uuid": "668b3ba6-34ec-44e5-99b2-0f76502d1ba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4023fc-22cf-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745693658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693658, "uuid": "c4769666-46f4-4d0b-b642-1483853f7f40", "comment": "Malware payload (Healer)", "value": "433eccd885b00c2d7713d0c6186743c3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693658, "uuid": "e069b1dd-d724-4676-b33d-3945a17d66eb", "comment": "Malware payload (Healer)", "value": "49c248afe149124159ad00edef4470ee840655118ee6b4fbec672a9dd5545f0b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693658, "uuid": "61a2d479-67e6-457e-9ac0-d88691094fde", "value": "T12A8533728DF03BDFE105D0762AFFBE54EB95ADBF09DBD33185C180912B689106B641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693658, "uuid": "b85b9bbb-52d6-44fd-8665-414abca74987", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693658, "uuid": "b1cab600-9304-455e-8aae-eb9abdee0d2f", "value": "49152:i3BQIcT+hDx48RCCfAM5TaSR4vJk7quO0C1o4x4L:ihhDy8R7F5TaSRsk7u0C1o9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693658, "uuid": "62fc2c44-7aaf-4208-93a5-ee698b32ef43", "value": 1734656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693658, "uuid": "156596c4-0973-483d-b4b2-29ed47be9d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7a5010-22d0-11f0-82df-82aee05be84a", "comment": "Malware payload (CredentialFlusher)", "timestamp": 1745693873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693873, "uuid": "0a9de97a-dd74-49ac-a420-d8d4e83d7c99", "comment": "Malware payload (CredentialFlusher)", "value": "b6d0a1fb9a839c6fafa2d9a02757deb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693873, "uuid": "f88ada8e-396d-459f-8dc7-734910c89a56", "comment": "Malware payload (CredentialFlusher)", "value": "64839466d73c65a6f417428a17269646f772983233026548892777a28f50909f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693873, "uuid": "d6b2f4fc-c365-47f7-97ae-919a7e1164d7", "value": "T127259E0273D1C062FF9B92334B5AF6515BBC69260123E61F13A81DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693873, "uuid": "38d5aa23-9566-42a5-bfa5-22395cc76c0c", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693873, "uuid": "21c78c6a-9ece-479b-89b6-99d6e00e6a32", "value": "24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aWkUu:MTvC/MTQYxsWR7aWkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693873, "uuid": "83b9df8e-2d37-48b7-bfcd-4b0e1ad87cda", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693873, "uuid": "11ea3565-8e38-4716-a189-7d33e13b1d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dcc6df-22d0-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693888, "uuid": "04d7ee6d-a264-4d6b-b503-76d0e7ab84d5", "comment": "Malware payload", "value": "7b5660eccce9ebca4c58bd1181c636c7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693888, "uuid": "217fc96f-da01-4ed0-a259-ff10cd621a4e", "comment": "Malware payload", "value": "306f26d8f5da8e4def57db3127ef442c6f23bdf2921b58beae86bd626a19c2b5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693888, "uuid": "62138023-2082-463f-9ad1-8f1945502e75", "value": "T1E6D4D05A25B049F9DE37837940D10D57EE717C264360E7FF036881A68FB7EE48939A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693888, "uuid": "40db46ed-cd98-4f11-9f1b-c751352babbf", "value": "2eaaa17d2af3723312759bf7667b8cfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693888, "uuid": "9c22535c-16f4-4237-8fa9-819d7a46d492", "value": "12288:CUcEohewQciZdLG2TnPoL48OJ8O1bg1V3fymNhWem1jvUr2:CUcjwvc6LBTnPx8OeOq3PymNQeUjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693888, "uuid": "8afdac7e-256b-40f1-8b0e-1cbf28369e9e", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693888, "uuid": "29c611da-1ec8-4467-a113-379bf1dc309f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ad31dc-22d0-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745693923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693923, "uuid": "cee519f7-c44e-4a18-9c17-cc752971aed5", "comment": "Malware payload", "value": "0c195114b6f520a29922e9f55f4f2926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745693923, "uuid": "80572703-c3c3-4dac-b215-9a01d22f85a5", "comment": "Malware payload", "value": "e00d8aca89665ee629e8341204c0dca5c18db57b95c2d491d2e79739db2f6cb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693923, "uuid": "42837ef4-08ad-4125-a7b8-ad6e84646b66", "value": "T1499533270E178934F2AC9F39169503CD3BA1CF91C0DC69293520721B8D7F9E6E7AB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693923, "uuid": "0887b491-983d-4cda-b93e-99bd34114a00", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693923, "uuid": "86cef9c4-4d60-4856-a28f-eed7d2932608", "value": "49152:Pbl6+8/2UwD2Q7RqKb93xs2JUMRSrlLDV:PblRUwDXLxsX2s3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745693923, "uuid": "ba08204f-240d-4e78-9007-21adfbf4d086", "value": 2025984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745693923, "uuid": "eeec18c2-8cf6-4fca-ae66-2a2585a77328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa354df8-22d0-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745694139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745694139, "uuid": "1b184313-7572-4fa4-aeff-b2e087b3eba1", "comment": "Malware payload", "value": "4171b1b59cb15afda7e6f44b861e791f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745694139, "uuid": "72019865-c594-41a0-93c0-7f18b4dc2300", "comment": "Malware payload", "value": "4213771ee722195fd5af4e296c6600a19c4113dc7bd871d6e70282fd58c5144e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745694139, "uuid": "b5c735e7-786c-488c-b3f6-75776f5e4136", "value": "T127159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745694139, "uuid": "44f865e4-8c36-42a9-901f-15bfe1de6feb", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745694139, "uuid": "db625457-2ba3-4c70-8e3f-3396c6ea5ae3", "value": "24576:AqDEvCTbMWu7rQYlBQcBiT6rprG8aeQV:ATvC/MTQYxsWR7aeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745694139, "uuid": "14533680-5c5e-4f8e-98b7-9ed2a1d31e29", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745694139, "uuid": "877d5df3-ecdc-457d-add0-f59ce556241b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2eb515-22d1-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745694198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745694198, "uuid": "ad65c25f-616d-4709-bae2-767fbff26881", "comment": "Malware payload (Amadey)", "value": "df97f0b8737d20ee0214d7f5feb1db31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745694198, "uuid": "00e65c88-b4be-4daf-81ca-83396ad61910", "comment": "Malware payload (Amadey)", "value": "42674450002c9de9abdb148470c9f364ddfceccb9a25296b4e5479dfc0fbc787", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745694198, "uuid": "ac0cdcc5-e20a-4970-a629-7ece1e16b8cc", "value": "T119A5331392FC88ABC26557710AF707C31B34FC6057724ADA558E8D5F2AB119C7A323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745694198, "uuid": "fa8955e8-8a67-497f-8c05-d3f4ab4b18fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745694198, "uuid": "9524d00d-a44b-4bd0-a868-17e505931f3d", "value": "49152:rm75CYrEIsggCUy6LibvwOVbFrsvyBYhHE3ZmgxreQyZ5upQR:2rEIsvEiQvwufCFE3NNOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745694198, "uuid": "0f3ec401-5921-49e2-8719-7a4edfbc6785", "value": 2178560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745694198, "uuid": "43e06298-9d13-4fa0-b3d2-324503b0c359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7162523-22d3-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745695288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745695288, "uuid": "14f6dfdd-4b55-42f7-bb1c-b96b9cb4cbc0", "comment": "Malware payload (Mirai)", "value": "113280987a57ffdb34899cb5de0f7d33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745695288, "uuid": "c93e34b9-e70f-4570-8451-fe49e90505ea", "comment": "Malware payload (Mirai)", "value": "9af9fb5b01c44a83d6366e48ee8703d52f47e42bebec61d86f6ddd6dfb18ca40", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745695288, "uuid": "a3bc853d-56fe-4af9-b5b4-dad8f39f7516", "value": "T14492D0EEF5AE4D4ADC4D8832B2B2C1CFA0414CEA6F0501D5B6ADE58395A1614D93E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745695288, "uuid": "817db5c9-b85e-4c3b-80e6-112e5f75f27e", "value": "384:M7/sti8Q1OOs09u1k/ABs7shWxvuIudh0vb2n2VayZvvd+v1Rq:k8QEFtRs7shQOdhqy6ao+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745695288, "uuid": "b9eb35fd-6f8a-4bcb-a176-61627dcadef6", "value": 20068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745695288, "uuid": "b57a7ba7-5c86-421e-a91d-2c07656a60ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b50b50-22d5-11f0-82df-82aee05be84a", "comment": "Malware payload (PureLogStealer)", "timestamp": 1745695990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745695990, "uuid": "ef774944-b41f-4a6d-9829-2516406beace", "comment": "Malware payload (PureLogStealer)", "value": "d47a97059950bb6eed4f2adb065742ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745695990, "uuid": "12c843cb-dda1-45f6-8bdd-445f8a15eced", "comment": "Malware payload (PureLogStealer)", "value": "f245c9574a257ff5089be401cea0944a1178783bb71e604490d042e12db0c362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745695990, "uuid": "fbaa0126-3e52-4ea7-a209-d10c72339331", "value": "T1B2B44C0BBB06CFD0C2886B36C6CF801417B5D5817B97DA4E398917D62A433BBEC896", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745695990, "uuid": "82802583-ab02-4417-b806-6877c37a5a34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745695990, "uuid": "2645fcfc-3290-458e-aefd-8a4113c00af5", "value": "6144:6dEd3AZ/RGxGJW7pJu1kUYBI80edjrQ2CX9pWD+ZS9iPfSRtWKRSxZfftIpjrK8q:6dEZAZUmW7Xu1iQxi3nsgcZffi5HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745695990, "uuid": "630658a8-1234-4e4d-ab8e-76b8bf425e71", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745695990, "uuid": "55b56ad6-f025-429c-92f5-f6f4877c410f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f042dc-7fdb-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745696215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745696215, "uuid": "120c6a38-b026-4710-97a8-2bd2d5b07d8d", "comment": "Malware payload", "value": "e19e3bbb54ad6c2bb440cae74158b405", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745696215, "uuid": "a3ac84a0-a70d-44c6-84b5-ff5fbf6d53fc", "comment": "Malware payload", "value": "9556acc8229094a5b9db2615a7d93e09471eec22af978a647231ea2999a46751", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745696215, "uuid": "f9278ef7-6ca3-425b-a577-2b2f7ce63160", "value": "A753120223AA297586714AF1E7FDBB88E6493E588FF26C256C113D68F97235D1CC4908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745696215, "uuid": "bcb27112-7001-40e8-9de8-aeafdc391773", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PxN:yYI0ARqw1qAEv7UIFM8oJorFquyjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745696215, "uuid": "ad688395-0a2e-4df3-8383-818639497f06", "value": 64260, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c308065a-22d7-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745697053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697053, "uuid": "458eba4e-2f81-48ee-bc8f-18d6da0e7c07", "comment": "Malware payload", "value": "1ddf972988ede9af709e600ce5dbe495", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697053, "uuid": "4e3d89a1-2d98-4282-adba-4ec30b41fb1c", "comment": "Malware payload", "value": "a76c24f44af91dc5bfaa7da9fcdd235d14c00fea746392f6fea43b349f8744ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697053, "uuid": "35b876c5-26b9-44a0-8373-e73a2b1d345e", "value": "T171953337C8A98DF1C2CA607F75278B4AB025DBBD1B7F9E40204F6916E4C3A4A62D44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697053, "uuid": "a093ee37-decb-4a04-b967-8ae37778c4f3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697053, "uuid": "a8c00f33-8067-4e7b-966b-e8bd5675d88e", "value": "49152:SRgjzckgMU0/uLx+xD6fiuckiS9H+/RMPt:SyEzKutXeE9eZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697053, "uuid": "149d4b7d-d476-407f-86a7-9f7a88130333", "value": 1880064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697053, "uuid": "a0a72e7d-c79d-4956-8136-b8e9352edfaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120e1f8f-22d8-11f0-82df-82aee05be84a", "comment": "Malware payload (Meterpreter)", "timestamp": 1745697185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697185, "uuid": "ed7e1826-152d-4f77-baa2-c15166a8832b", "comment": "Malware payload (Meterpreter)", "value": "6afbdfc3d8d7fc1c167044ef34daf3b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "meterpreter", "colour": "#e49074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697185, "uuid": "5e52c1d2-24e9-4f83-9ff5-6b6ff0cd1d95", "comment": "Malware payload (Meterpreter)", "value": "3df6f793f79c8e4bf4f9b37780ceec52f8b2c2683134207cbb75d3c026f59945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "meterpreter", "colour": "#e49074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697185, "uuid": "99345d4b-48a9-4535-9d2c-b5131687cec8", "value": "T1D8E1791337240EF6D87C053C0AD6FD67715D5E252F7B41755D280313253212475B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697185, "uuid": "2aea01b8-047b-4178-a72c-6399331e33ba", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697185, "uuid": "25a8bbc5-c5ef-4db3-aed3-839657275b43", "value": "24:eFGStrJ9u0/6d7nZdkBQAVR1OxhNYKZqoeNDMSCvOXpmB:is0YnkBQigxhNYuSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697185, "uuid": "1eabe7d5-02bb-4a54-bbd4-db8f18020994", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697185, "uuid": "1ca099d4-a76f-4b56-b4c2-65a8fd961b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1358c948-22d8-11f0-82df-82aee05be84a", "comment": "Malware payload (Amadey)", "timestamp": 1745697188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697188, "uuid": "47c0e9e2-34c0-4479-aa8c-501a5276b16b", "comment": "Malware payload (Amadey)", "value": "31e8a67370c5fd496b5e1bbce0ae7a12", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697188, "uuid": "f7644a50-932f-471e-89d4-e96e524d268b", "comment": "Malware payload (Amadey)", "value": "0ad0cb17a4728050f7ee491798e577f25bff61d203fca6625f3a2c0b53e64cfc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697188, "uuid": "73989591-a3fa-4f05-b2b6-e8460cbb64c0", "value": "T1C3A53353E4DC9031E8A257F00CF507F30939BD502A7693D2299AEA5538626D9B7B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697188, "uuid": "81b6cad3-8a4a-45e1-aa03-c2daa62b7b11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697188, "uuid": "60e7f94c-2077-421c-a5b5-8b6f9d681fe1", "value": "49152:f/75C69rHQwofTn/HS+D0yf8069G41l4OW2xq:v8FnflAEp69G4v4OW2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697188, "uuid": "822d4bdc-4e5c-418b-bfdf-87a1188d9f43", "value": 2186752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697188, "uuid": "bc7434df-a454-4f5e-a62e-6b1fd9a6275b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8ac4f5-22d8-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745697235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697235, "uuid": "2dec7d4f-b42e-43d0-854d-aa5ea0357bf9", "comment": "Malware payload", "value": "39597230701a846eff6f660cea4139df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697235, "uuid": "d654ed88-8e79-4de7-ad29-d515acd8d974", "comment": "Malware payload", "value": "9e6423d6997d6286d025c0fc506aed59908920921b14984bd6d1fbf6cbbd5759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697235, "uuid": "636e110e-8a88-49a1-b1f6-6d0319b8e7d8", "value": "T1F1259E0273D1C062FF9B92334F5AF6515ABC69260123E61F13A81DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697235, "uuid": "a2bdedd9-1e21-4ce2-9139-73f918b14d92", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697235, "uuid": "36d2827d-e6bd-4443-9dbd-83c287630bd2", "value": "24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8aYrc0:lTvC/MTQYxsWR7aYrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697235, "uuid": "66e1163b-f0a4-4d40-aa51-9d48c58a84ea", "value": 968192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697235, "uuid": "40de732b-65a1-4e97-9704-c0a9264647e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1bbecb-22d8-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745697446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697446, "uuid": "7c54826f-2d43-4676-8558-57bb5c6e6dd5", "comment": "Malware payload (Healer)", "value": "74fadc522510455a41f1fa1483c3f3cf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697446, "uuid": "df33a835-7a3d-47f4-adbc-bab563479c05", "comment": "Malware payload (Healer)", "value": "d9f4bf157502b80ddfc91434a9bbf58e2396a6a4e0f6b8085b0bafc6ee1e1d7f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697446, "uuid": "fdea1872-b8a4-41da-8305-d795c2c025e3", "value": "T1158533CB2EE95276D3198476EE2FDF102C12D388DB9D010705986735BA23F2778AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697446, "uuid": "ae5d78b7-cda2-4eda-8f74-1e5808c54a85", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697446, "uuid": "90d09e3b-8011-49f3-818c-03daf96c6809", "value": "49152:0Tb07J8fSl7oddJeOXe6YMfmc1+N+/u35i:LAC7od7eOXe6YwCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697446, "uuid": "9b5e525b-e8e2-4979-a6c3-2b9885eeba33", "value": 1774080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697446, "uuid": "be2ebc8f-6aca-4d51-bc0b-eeec3e7b0fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cb3063-22d8-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745697541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697541, "uuid": "fa9079a7-e799-4a57-979b-4aa37d5d4ebf", "comment": "Malware payload (Mirai)", "value": "ceab8180451c21f5e86f43acb04b1c52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697541, "uuid": "bfdd90a5-dbcc-4003-8f58-2f7a91ac4424", "comment": "Malware payload (Mirai)", "value": "989ace19e9c265af7c4fc1332aa08088ba271df998df7db9e9e32da5c46352c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697541, "uuid": "e12237b7-02a5-40c9-823c-ab93dfa23ee2", "value": "T13923F1838E14B422FBA006FAD93A6C878616727DD52BD49235AC197CF027701B6F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697541, "uuid": "f53e7386-d36f-46a8-9214-6494057d87ac", "value": "768:3+TkG7FsGWjosDWzOcxGpIhPtfD9nvCgN6yu9q3UELnBBVoJn0hSV0I1NPscetSN:36kG295DWScQIhZZCgN5TLnBBVg/VsLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697541, "uuid": "3ecb59e1-ba19-417c-bad1-0a03634b5bce", "value": 46732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697541, "uuid": "cb059153-5863-4b6a-8426-b4ad392d4493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf7a00a-22d9-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745697714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697714, "uuid": "0c5d04bc-2095-42fc-86ac-c64e5597b0db", "comment": "Malware payload", "value": "c5a4e82e0e2622af2e91ece6a9d3bd19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697714, "uuid": "cb1a60ca-dcaf-49f9-a828-4e6f3c80f14b", "comment": "Malware payload", "value": "dac5255625c6cdb5c990e4fcaae02af6b265d792b1e758dae01aa989a1f41b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697714, "uuid": "a567f718-9f29-46f1-8784-8d79a74fe8c2", "value": "T198951280BACF555FE38D9DF53A6277DF46239321D50A1DAF8D10B2FCA4872421EA74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697714, "uuid": "80ee15c5-802f-4638-8739-d4df1dad8eae", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697714, "uuid": "9e4388a0-45d3-41a1-a7b0-18e81b2e68eb", "value": "49152:7JVSCsu8xcS8JjBzjUC8c8XN23HHG7EvRxd7t4OM9oH:7JVuWJ5kcs8UEvZ544", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697714, "uuid": "fa6fc35c-cfd2-40ea-a7f7-fc15af3d546f", "value": 2049024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697714, "uuid": "602d5fa7-a5ad-47d0-9888-38986b1649eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17102987-2053-11f0-82df-82aee05be84a", "comment": "Malware payload (MetaStealer)", "timestamp": 1745697787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697787, "uuid": "fc868d76-4eca-4161-a535-382c30fc1432", "comment": "Malware payload (MetaStealer)", "value": "051d32306691e0dd6eb50f16c6f1c382", "object_relation": "md5", "Tag": [ { "name": "MetaStealer", "colour": "#ebffe2", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#860016", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697787, "uuid": "07e514e4-968c-4ede-8d42-5f3af95a286c", "comment": "Malware payload (MetaStealer)", "value": "17ad6e2c8fb12b9c3d587cf7a4814bf6e20758589e82517420f196599c75f1ec", "object_relation": "sha256", "Tag": [ { "name": "MetaStealer", "colour": "#ebffe2", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#860016", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697787, "uuid": "f418c533-729a-4659-9678-83dd7f888f40", "value": "T1063611C03780C527E95B18325EA783D9275DFCA1AE71B0877B61F31E4B39AD2AC293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697787, "uuid": "c3e087ae-bff8-4c92-8e6a-a4de7044535a", "value": "98304:cpTsJorTOyiDlFw3wLQPO2rfPV0SdA+lLPbzm:1EOyMFmOCfPlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697787, "uuid": "c9f1107f-a84a-4b65-9c17-1b3b23e628cc", "value": 5107712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697787, "uuid": "17dc57fc-894d-4581-920b-2170d0f9dba6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af273b5-22d9-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745697845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697845, "uuid": "696c729e-b8f0-4081-b807-bb7498e749c1", "comment": "Malware payload", "value": "9a7751723fb4834749556d173aca3aaf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697845, "uuid": "3cae5a2d-7604-413a-8521-23c75b1aa84f", "comment": "Malware payload", "value": "6ca393164a1afa47eb12d005dafdf1bdcb0fd8203c636fe47862bf39b152c955", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "91fd7fc1-2907-445b-a243-5b55608fad77", "value": "T12311F28EC3ACBC0550A9CF103059961456459AD1A5FD9FE9ED98CB2398DB530B258F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "ae266a04-64ae-4007-85af-056cf3db14fb", "value": "24:qYft9IfY33I9YwSIwYxNIejIxYKLK/IVfY19IfYysIOYmwIaYiAfIkTY9lInY7nf:qYftyfY349YwHwYDkxYKLJVfY1yfYy1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697845, "uuid": "5019e826-3617-42bc-a69d-212d9dc9f7b6", "value": 1062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "554d277b-8c98-4d38-ac60-8d99b2861942", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af530cb-22d9-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745697845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697845, "uuid": "a8f6c6e3-15a7-469d-b7e9-df32dc50c5bf", "comment": "Malware payload", "value": "1eda7cfe4f725740ad53a532dcd98da4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697845, "uuid": "3ab763f3-075e-4f4c-8472-11b583de2adc", "comment": "Malware payload", "value": "8dbdbab551d6bd06e871474eedf7bc3982e7b31fee1018128799469cf634e553", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "51386e9d-06cf-4ce4-bbc8-ac69ccbe4b15", "value": "T1CB2127CFC3ACBC0154ADCF503059942865449AE165ED5FE9ED8CCBB2A5DB938B249F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "aca7b74b-53ad-41d0-88fc-673ac220f487", "value": "24:8Y33ILcYwSIOcYxNIejIXcYKLK/IV5cY19I5cYysI4cYft9I5cYmwIscYiAfIklq:8Y34LcYwHOcYDkXcYKLJV5cY1y5cYy1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697845, "uuid": "7d504177-304f-43c7-afeb-b8ad30e604bf", "value": 1172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "0071f91d-530a-4a27-8879-5cd33affbfab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0264bb-22d9-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745697845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697845, "uuid": "1dd34aa0-1897-472a-a070-31fb8aa2147e", "comment": "Malware payload", "value": "d1d0af223777817c93e3aa01e21c6942", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697845, "uuid": "1ddbc090-8617-4847-aad0-6f2c4ad9e751", "comment": "Malware payload", "value": "d76276e9bf34d2978f0c67ab2c98c9f56225d493f58efc5ffd8eeb13cbb8953d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "47f80e71-6b5f-40bc-ac82-31f107066d80", "value": "T1C3115B8EC3ACFC0269BDCF147059D11C694095D1B5FD9BF5F9A8CB2294DB130B258B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "747a27b9-dc2a-4ac3-8d3e-8985b2561856", "value": "24:3J3DY33IBYwSIGYxNIejIFYKLK/IV/Y19I/YysIwYft9I/YmwI8YiAfIkTY9lI3h:VY34BYwHGYDkFYKLJV/Y1y/Yy1wYftyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697845, "uuid": "50a98435-09da-4b02-a55a-c64373c9bd74", "value": 1076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "f2c43762-3847-48f4-a3ce-9be6264b75e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b063e22-22d9-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745697845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697845, "uuid": "c736d086-0207-425b-9016-f5e818fb2c2b", "comment": "Malware payload (Mirai)", "value": "0934f0d3fae1afc992654dd43f4be816", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697845, "uuid": "83d9ab1a-eb3f-4956-bfc3-007b0d302f0d", "comment": "Malware payload (Mirai)", "value": "a4cf2aa94a0af3b97cda888e31ba3a9b2577b1f456ea7c5e6b49414a005bef8e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "959d8163-8b50-4e97-ba24-da2bfb4486f2", "value": "T17D51778591856C3458B7EB33F6B681383081A0D358EEBF99DEDCBEE4868ED147244B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "12802144-f88a-46fd-ba0a-5f1e2542cc11", "value": "48:vp+70+7N7hp+v+6Gp+gn+zPp+f+KWp+1+oUp+71+7o7Up+fO+3bp+E+9Rp+h+cgv:vI7T7N7hI26GIg+zPImKWIMoUI7M7o7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697845, "uuid": "212ad0ed-0db9-402a-bf35-e8edb4301e45", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697845, "uuid": "8ff0fef9-41de-4b80-89b9-1d653df68dea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00febe1-22d9-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745697987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697987, "uuid": "b858569b-d859-4cc2-a4d9-154397518cc5", "comment": "Malware payload", "value": "385da4ac370e490386deea467864bbbd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745697987, "uuid": "ada78d5e-2227-4c50-a5af-bb4b7a61066e", "comment": "Malware payload", "value": "3427c6e1950a3e9527f132096f36927c60a8c5f7babb10f85676495af2bbf35e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697987, "uuid": "034babde-cb86-42d9-8423-55649b973fad", "value": "T1AA159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697987, "uuid": "41c5dd11-08e2-4c8c-85c3-1cf05fe5e627", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697987, "uuid": "cbb29980-dd53-48e5-bd23-1ccaa6c8b855", "value": "24576:2qDEvCTbMWu7rQYlBQcBiT6rprG8aeRV:2TvC/MTQYxsWR7aeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745697987, "uuid": "0c12ab06-a855-438a-92fc-b63d0ba33dbb", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745697987, "uuid": "a062a450-695a-474c-8d46-86ee3574b4af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77b42da-2214-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745698685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698685, "uuid": "ea5eeb8f-14fb-4ad4-9b55-83205a9b3e4c", "comment": "Malware payload (Mirai)", "value": "7eee023a374ea493c511c34d19649f18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698685, "uuid": "469fff6e-5a35-4db2-9051-87c9e17a7601", "comment": "Malware payload (Mirai)", "value": "87a5b26aa52028507dcd870547f580ee69cff9fb35fd2eb8f081ff34a46e51d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698685, "uuid": "0d31babd-b1ca-4853-9ea0-ec21870b25fe", "value": "T1EBC36A72D8256F98C559907CB0708F781B4399A18287CFBE19A6C3B154C3D8EF685B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698685, "uuid": "88883632-0d8c-455f-8e40-b7d19ab02060", "value": "1536:dmj/03Mq2ojZIm95reCnSKE4Ap2yANWNB8WEO30OMArVmrK:dIM3MofreyVEVANi8W70OVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745698685, "uuid": "78c9302f-afa7-42ec-8359-15dbf5d62c8a", "value": 123136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698685, "uuid": "2c2eccc1-329f-420d-b110-2b67a5e387fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcc09dd-2214-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745698687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698687, "uuid": "52a672f7-045e-40be-ac15-111fd2cb0d04", "comment": "Malware payload (Mirai)", "value": "604eb816e1e44beb282bdf4d725e485d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698687, "uuid": "705afd56-bbcf-41e9-82ee-0da21ffcc1b3", "comment": "Malware payload (Mirai)", "value": "f52346fd61791ca4186ed6b5ae7325af69cc4d9da949559d830410607d4e6282", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698687, "uuid": "5ccbd737-d1f3-4594-8e89-4a086da41cb4", "value": "T1FB934BD4F243E0F6E847017D6177E7366B32E4B5201DEA83C3689E32ACE1551DA1AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698687, "uuid": "a7c95ec5-7703-48cc-bbfe-ffee8f00c922", "value": "1536:uPm81iueec1MZLuNRvWJCNXxIZnD4CuT14tKQ4hr7gSmMKf/7NOL:uOUiueec1LNReJCNXKZncv1oKvh/dWhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745698687, "uuid": "2b06cefa-740b-431e-926e-db90a76f8f18", "value": 96008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698687, "uuid": "d8ef9a50-0107-4272-854b-79bfd4cfe434", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7259c93d-20ea-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745698745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698745, "uuid": "7cd4d4f2-2970-4883-8203-4efe65f29648", "comment": "Malware payload (Mirai)", "value": "51af1107fbaa27dfad1730338521977e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698745, "uuid": "400a568e-18ce-43af-a1b9-bf93cfd5912f", "comment": "Malware payload (Mirai)", "value": "38b364af710caf0396f2ed1dfbf87da760b53ce22d6b87c741048e4514e21fc7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698745, "uuid": "43a7f855-af21-44e0-af4d-796b80b24078", "value": "T1DE41C4DA40808BB03EAB9C3BE5A6418A72C262C144D34F827ACDBCF4455ED24E985A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698745, "uuid": "1b54a333-48bd-4655-85ec-6186328c45d1", "value": "48:v2K1K92KEKh2KLDKL52KBK12KyKJ2K9KN2KEK52KYKL2KPKt2K8KC:v2sU2D42kk2UU2No2C02TI2hW2AE215", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745698745, "uuid": "bc9cc651-40d6-4e06-94ef-162c919f5e99", "value": 2027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698745, "uuid": "317add7f-4705-4132-bac5-11093af4b444", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8c117af-2213-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745698745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698745, "uuid": "d063bbdf-be3c-48e3-868d-e9765e1eedaa", "comment": "Malware payload (Mirai)", "value": "d1c5b37c166afd6057d9f418f1e911ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698745, "uuid": "6c85467b-a3ef-4a63-ab3e-93751143244d", "comment": "Malware payload (Mirai)", "value": "cc58bb17a131428c5802cd9b695f70731a1e5393a251a53e75a7392227d7c348", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698745, "uuid": "ca565e6f-8662-452e-9325-8cdcbd95699f", "value": "T14FE30A46F8815B12D5D111BEFA1E124E37131BB8E2DEF2029D246F647BCA97B0E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698745, "uuid": "5f7ea2f3-ef5d-439d-be34-8d763bf34c2d", "value": "3072:8cvL201xUZdm2eXBB+2LTahAeCGaPe35Lz:NvCeOleXz+2napCe35Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745698745, "uuid": "5006f624-3aef-4b07-882c-deec7880cc84", "value": 150556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698745, "uuid": "5eda07ff-7fb0-409f-be8b-6073c73d2a3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b66127-2214-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745698745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698745, "uuid": "4a2878f6-5360-428c-ab9a-5f7e51b60f5a", "comment": "Malware payload (Mirai)", "value": "a0d03f9161f7f2069bf0ab655fffe8ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698745, "uuid": "ae801fb8-0dd9-41b0-a0fb-bf61bd940881", "comment": "Malware payload (Mirai)", "value": "974736d5ff0ec5801a4d286e36c1fa39f346f98e1c2f6eceba6be4c0914259fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698745, "uuid": "a7237389-2aa0-401d-a04c-63fd37cc6889", "value": "T13404A85EEE228F7DF668873847B74D259B6823D627D1D640D1ACC1102EA039E641FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698745, "uuid": "747743fe-96c2-4e75-8625-19f8460b3630", "value": "3072:vLSb3/L6mg0F3nBVP/kEeRUf84LWSb76x8kyiuvDl93MB:vLy3/rgu7LHy8kurl9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745698745, "uuid": "a493959f-f6ef-4ad1-af9e-1e5c77d6afa4", "value": 182048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698745, "uuid": "83906329-86c5-4490-a3d8-832259b33307", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a95ebfc-2213-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745698805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698805, "uuid": "e270d63d-0a42-4756-a8e0-000dedde05dc", "comment": "Malware payload (Mirai)", "value": "b3eb85be2129bb30e87e755a91e5344a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698805, "uuid": "7ea15be8-a4e2-4066-876d-c755fc606298", "comment": "Malware payload (Mirai)", "value": "f01afacb5219bc0c4888bf1d888a92765d3747a0682f36b86a45c960ebf37cc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698805, "uuid": "036fa8ab-1c1b-400a-a1a1-3a015affa65f", "value": "T18CE33BC7F800DDB9F80AE33E48130905B630B7E60192DB376257796BECFA1991567E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698805, "uuid": "b42572b1-d720-4cbd-aba8-e9671f006c29", "value": "3072:DynCtkrdFcEJzvYyBFfT3sAzjoXVqjbiNLBGNRyyOh04:DynC+7YyBFL3Xjo3LGyy804", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745698805, "uuid": "882ab727-236a-48b7-bccd-c985ae8ec8ca", "value": 156576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698805, "uuid": "d0e53dbe-b657-437d-8b13-c6c6743088f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3538e04e-22dc-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745698962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698962, "uuid": "a64141cd-ecbc-4b11-8fe3-bc477670972a", "comment": "Malware payload", "value": "7040d37c598a42e3984551b6f5d86454", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745698962, "uuid": "12a9b918-43d7-49fb-8836-6173b894721c", "comment": "Malware payload", "value": "15688e2f2e9e41ae9f9305bb82962cec5b33c9d06d15d6198c75f0413e38059b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698962, "uuid": "d0766e90-6f3b-4ab2-9810-156b0d5df272", "value": "T13436335CA19C5E60FE9C5F70C8E97A3136796D28C72F9616E814302EB6BB7583F031", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698962, "uuid": "0daea289-b2e1-4702-a7a5-884bf9432bbb", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698962, "uuid": "e1c0a5c0-55b8-46d7-b1fc-289bf8c3c432", "value": "98304:lTTKZIKdaRWpINW8vQduCRpKNDpABZBTVaQw//F79:ZTTSYLCduCCNdeTVaD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745698962, "uuid": "1c240b49-eb41-4b12-80f4-eb0623c71d9c", "value": 5071872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745698962, "uuid": "215c22e8-8f1a-4263-98f3-70e6c6c99299", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db5628e-22dc-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745699004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745699004, "uuid": "c14ddc6e-ff2d-4630-8a00-a6b3faca2ad9", "comment": "Malware payload (Mirai)", "value": "1f5c156ca58518269f4f541fb7f61432", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745699004, "uuid": "7d8506b9-5aa8-41e6-aec4-c7601b15346f", "comment": "Malware payload (Mirai)", "value": "d35da67990f89d372924af190dee04d106e1e35c35c77196d454a1956037ee4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699004, "uuid": "eded2708-2c21-4c56-bebd-a202e0de22b3", "value": "T1AD92DFD9C8135C5CD57F41B66919ECA71AB0F4ED6ACFB9C1A30A82A193BF058D0B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699004, "uuid": "e5b2ca83-b26c-4dc7-b527-5f5288b7076f", "value": "384:M7X+8hXX+x2xbC3u6AEKTy4MixS552TDHFI0sx5q5p+v1Rl:I1+ycCDFxSj2TDHa5wSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745699004, "uuid": "70b5b248-eb66-434d-994f-b809db36c0d3", "value": 20928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699004, "uuid": "b0a40e18-4e8e-45a4-a16a-37d413a99d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641da8fc-22dd-11f0-82df-82aee05be84a", "comment": "Malware payload (NetSupport)", "timestamp": 1745699471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745699471, "uuid": "b6cbb955-7112-4ab7-a902-c4fc6294792e", "comment": "Malware payload (NetSupport)", "value": "e235086160b2d5256415c012a4cf0a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#f4aa26", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745699471, "uuid": "176bcbd9-fe99-4813-a4c0-194b0060a0ff", "comment": "Malware payload (NetSupport)", "value": "3b5658532bc4058131689c5641def85d7ae25d5b837d3d1aff3af7bb25581f17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#f4aa26", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699471, "uuid": "c3883c22-23ed-46d6-a4f9-6d8894b14070", "value": "T15576331039D96AB2E17325339739FE11B87DBD202B355ACB53707E0A8A624D1CF317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699471, "uuid": "25b2707b-1012-4f5a-8350-ac2ddf64327e", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699471, "uuid": "20cbf6a8-48f6-4164-aa01-5cdbadf153e0", "value": "196608:/xpiMlGJQaY8TknzMjqCtrChb82B4fOSwe9:/xptGlknzOqChChb82e9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745699471, "uuid": "351526d2-eb83-4897-907f-14984f221e39", "value": 7448631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699471, "uuid": "94386065-507d-48a3-9f81-5b1012c32da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3552aa5-22dd-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745699657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745699657, "uuid": "70d95407-c7b9-41cb-9795-bacd728e28b6", "comment": "Malware payload (Mirai)", "value": "8af738992b9025a8803c30ae52816125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745699657, "uuid": "95246f8d-cc96-4aae-b958-90622c9ac85a", "comment": "Malware payload (Mirai)", "value": "159b8317169ccc29bd1b4d38f909ea0e88fb1f8fad126948f06c7e5baffee699", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699657, "uuid": "b594ad89-9b11-4cf2-ab81-038da744fff1", "value": "T1CE92D0300121A530DB71743AB5BECA4B76D22ABDD2FA3131CC281215BDD794736B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699657, "uuid": "3aba553c-577d-4369-887f-a5c91d7e40cf", "value": "384:zmpWUB+iqiGbiUq19U7AwOmojYKlmYub1OxYQea6VhymdGUop5hpql:CpWUB+ipGbdq1O7AJmIYrYuExYQGVs3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745699657, "uuid": "833a5b39-6c28-4466-af61-cfc72deb2d37", "value": 21144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699657, "uuid": "91ca4730-a096-4d12-a6a7-a392acef453a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3d26a5-ed4a-11ef-b199-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745699764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745699764, "uuid": "474720ef-7ff5-4d0a-b52f-7f7b0eed2eb0", "comment": "Malware payload (Mirai)", "value": "453c425f52845893f6bb80030cf6902a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745699764, "uuid": "18e4d29d-5025-486f-9d69-387d25bd5735", "comment": "Malware payload (Mirai)", "value": "1f7544c3620be6e34f040029e119070396a29057149561feb5f44cb0fa31fd9a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699764, "uuid": "a3637255-a629-4703-b23f-dfb526b8ddcd", "value": "T1487191A6C942117C1C595762A9FB11EBF042F3D278E77A0F76A838F4608DF2158C9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699764, "uuid": "20a55fd6-9eb3-4afa-9d68-cdbcde5ae3c6", "value": "96:if3N3Cx3Y3i32B3iE353o3J363Q3c3z3Uwz:M9SxoSGBTpY5qgMjkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745699764, "uuid": "06361a5e-d222-4f46-ad20-86099c64b7ef", "value": 3724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745699764, "uuid": "7a989d13-06c7-4811-90aa-a5e9c19afa49", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476a0a67-22e0-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745700711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745700711, "uuid": "2fe095ff-748c-41bc-8f6c-31de5efcf93d", "comment": "Malware payload", "value": "94638df6256f959c6a13402c86481836", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745700711, "uuid": "896685e8-165a-49d7-813a-989a23720271", "comment": "Malware payload", "value": "b5dc51af3ffc83872b037d0d3ebcd78ed842b563895e7ff599b62f84c4bb1d78", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745700711, "uuid": "1caac19d-28bd-4cf0-b2ba-d4354e428ae3", "value": "T1535533A416C895D6C45E85C86F56D367982EBCFB4BDB40A7C838D2E0075FB0AB40DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745700711, "uuid": "1ff96552-9ee2-4d20-b29b-53d643ba13b8", "value": "24576:3N2dQXh52WCfiZJcRcjhUStJ56RHLSo3mr1SbUcWxODi7b0S5OeKQsJ0nHsJaE0y:3d+fisRcjhUmHo3mJS2b0EOev6Hn0Thw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745700711, "uuid": "02c819e7-7ff4-4740-8387-aff46f9210e8", "value": 1343383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745700711, "uuid": "5226ab5d-b717-43c5-9d15-7de3b8ab62fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dead5b61-22e0-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745700965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745700965, "uuid": "9e9bf376-384d-4b92-a6c4-12de9a3a6432", "comment": "Malware payload", "value": "01ab8171ed8ab0a22bb3d6e286a9ec9c", "object_relation": "md5", "Tag": [ { "name": "Encoded", "colour": "#ef1c92", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745700965, "uuid": "a2afea4d-a6a6-4fa7-b9ea-f3779217fadb", "comment": "Malware payload", "value": "5b3e8b7d2a88eee248172142d10089d7f7a10b72d6561daa863ba4462a1fe151", "object_relation": "sha256", "Tag": [ { "name": "Encoded", "colour": "#ef1c92", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745700965, "uuid": "06866dde-3c44-493b-b526-69341a3e1d28", "value": "T1FA517A50AC91D604FA6232369481FBBDFA3AA41F437455A0FB85DE74276C3B1212FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745700965, "uuid": "c2c5b564-1fa9-47c8-85d8-74440a2f9212", "value": "96:sXHywbcUZvt2WZvvzi4gRzpD1XOR3HJsMtvU4W/J8+WdOs+/5OerYThZ:sXSUHZFnZnzd+1RaXJsv4Wsrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745700965, "uuid": "6baea156-d2c5-4885-a8b2-946e3b9d3ebe", "value": 3153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745700965, "uuid": "62de2548-f60a-4c88-81eb-814c5d1da79e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9873bb-22e0-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745700991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745700991, "uuid": "cb86df47-542e-498b-a535-305504f36e15", "comment": "Malware payload (Mirai)", "value": "e04c7595d099a248ce8204a30bd95c48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745700991, "uuid": "87d79f11-6ad3-48fb-888b-c6c78849c67c", "comment": "Malware payload (Mirai)", "value": "a49772cb76b5eae281f92f4561e2e95c969e9de2e7d4a0bcdce020808395ddee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745700991, "uuid": "d6a0a783-042d-408d-a072-029073d93097", "value": "T188233A99F8029E2DF80FE57D54554E0DBE6063C162831B2667BBFEA32C331666D12F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745700991, "uuid": "20d3c310-2c18-4c60-acdc-0702d910cc51", "value": "768:BaeB3nciH0rN7MsT0/LoBadaQurNpdFU8tWzVkaku4lDJntI8N4GP:YkaMsTMLoBadaQurNpo80JMu4l1ntI8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745700991, "uuid": "0bc53404-713d-4a07-9ccb-df4d518a1100", "value": 46612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745700991, "uuid": "ae2a8aad-7daf-4fe4-ad29-41060a6eb148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f050a5f8-22e1-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745701424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745701424, "uuid": "2ff90b2d-26dc-411d-b660-ae6daf0fe415", "comment": "Malware payload", "value": "0972fafbaa9e9912bd3deada723a59af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745701424, "uuid": "16a7a2c7-9a46-4651-9677-5ef0c7c0fa14", "comment": "Malware payload", "value": "96014d18eb7ebf3663603e2e8ac3898ffb81d3fa6b734ffe94f5dbbb6566a5ee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701424, "uuid": "4b8c4978-1281-4a28-8ecb-d35884e13c58", "value": "T1BD95331F1E8737D6E6BC4731E76709FB3EC9366A01EC79BCAC61F445D041050AAAEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701424, "uuid": "993a474c-a796-4072-b247-8c6c8e2dbddb", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701424, "uuid": "83f4b4af-c68e-4634-9b81-7b1a0a83ef2b", "value": "49152:uvFJ4i7Ffe6Eq+DkUzcD0yb/+CM3K/itLT:utJ1VeL8FbfKK/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745701424, "uuid": "fb608f05-b35c-411b-9495-c6fd809b0979", "value": 1879552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701424, "uuid": "0a8830c8-0a8c-4d6a-8c34-79b92ecb227b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6744920e-22e2-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745701623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745701623, "uuid": "64ac331d-625c-462f-a6f6-490b51c41136", "comment": "Malware payload", "value": "91e127daa64471f7914f58ee7704fed6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745701623, "uuid": "ff79e4b4-ce4e-4b85-befe-05aab57d2ebc", "comment": "Malware payload", "value": "a7dc3ecfbdaa04c99047d64a308c2e6ef04894c17c4237e78ae96a96d581278a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701623, "uuid": "e1f6ed80-ca56-478e-8900-353a6de83591", "value": "T128118CEAD433A701E56AED2934EEA570F0A6CB881862CF4E9494593384CCD1DA255B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701623, "uuid": "6cb847cc-cdb6-4d89-9745-65ad6a65f66b", "value": "24:uvDVvRv+NNIRnvJvhvNvbJnvMNorTvpvZv/vvvh:ubVpBhZl9MwTBxXnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745701623, "uuid": "60f4a192-1b37-49b0-bee3-0551f2c4af01", "value": 917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701623, "uuid": "bcfe6d0e-c9bd-4025-bb0f-50a4f81444c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68fd9f5-22e2-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745701783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745701783, "uuid": "f4685d84-d21f-4845-aceb-ec19fb4b4b29", "comment": "Malware payload (Mirai)", "value": "6a62d3bf0448b678b04c17c9fb3edc69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745701783, "uuid": "16494f00-4634-4d6c-832a-b4f73c55028c", "comment": "Malware payload (Mirai)", "value": "11eba24847b383c773aa94407f5c734e6648f573335c61d6250ca42775ed6971", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701783, "uuid": "54dc3977-4873-4016-baf4-caf5e81ad856", "value": "T124A2E03F5327E39FDDC1BD300CD64427BF837DB9FB94591D89E216864988AB1A0192", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701783, "uuid": "144a16d7-edc6-4b15-b99e-de6e470b23da", "value": "384:vywVho93/j0MWiXpuPbz7XUY1LDyMHizyLIlTL6Q3afz13feLU5akdfDpd9O5jxm:3VeX5qbz7X7/yMHi+klTO52LU/1d9OHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745701783, "uuid": "8ba74acf-6165-4686-be22-1137d9128063", "value": 22292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701783, "uuid": "150481a9-0561-40b0-ad10-43a596d1e34f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016e9ef7-22e3-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745701882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745701882, "uuid": "388c9a38-05f7-4f36-9fc3-68dc7c1b74f0", "comment": "Malware payload", "value": "ed40c2a645fe4331500aecd5321a02cb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745701882, "uuid": "88f17c83-8353-42d1-9de5-e21da2838196", "comment": "Malware payload", "value": "6e17b5f43fdb079e8a224d51ff0fa746f76ba0ed38579e01786fe3bf8b4d778e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701882, "uuid": "09e2ece3-cb31-488d-a73f-2f82fe679b18", "value": "T11DA5330BEBFC4023D96257B419F60AC30A367F6058B5469626CD6C690672BB4F9383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701882, "uuid": "f66aca23-6f84-413b-a4d7-7cdd9d378f74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701882, "uuid": "f9ca5a1d-c445-482b-a53f-9e59d23cba1b", "value": "49152:wT75CFqHREtwarvBopgmSzn11MOXrKmvoZwSHjWkNg6Q3YZwH:dqxparvBopg5XuMonjWkZh6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745701882, "uuid": "0db5307d-69c0-47ac-8b4d-9d768aee56a3", "value": 2186240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745701882, "uuid": "da71f28a-77d8-450d-87d5-85bdb29e3344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c59eb4e-22e3-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745702035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702035, "uuid": "6bc8b0a6-d085-41de-bd59-135a63f54e80", "comment": "Malware payload (Healer)", "value": "167c631bce44b13cdd3510ee69ab7ae6", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702035, "uuid": "f9c6146d-7b51-4fed-90ef-8e003080b99d", "comment": "Malware payload (Healer)", "value": "99349d1e362e00c27edc1cf81e2948ebbb0be59549e7053e18a6e2d22da7d914", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702035, "uuid": "5da0474a-ef96-4439-8c67-7d817157c07b", "value": "T180853343CF740D3FC4AA64B3ABE899D42337ACE2949ACAD35B52C916717F9452FC90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702035, "uuid": "487dc464-be1c-4c02-8d66-bb7054f74507", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702035, "uuid": "d7a83fa8-efd4-4312-969b-3c6e6bfa891a", "value": "24576:KHVdWue1jjA2y8/ZbQdRAvblZ1kEIRMAx+Th/KZGS1isZVKf7bID8u1m6MKEn6N4:S5Sz/ZbQABUpRMAxm/mLLpwW7Mg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702035, "uuid": "01f3b79f-fbfd-4d82-aab4-8126b272ec4d", "value": 1743360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702035, "uuid": "2cca6428-1d09-4cca-983a-f1bca248766f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde9b165-22e3-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702225, "uuid": "78fa7e4b-8390-4681-8201-094dbe9d6247", "comment": "Malware payload", "value": "96ac98cc84a76942850ff2ce11844f9a", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702225, "uuid": "94d81ef0-3514-49fb-975b-c9692b26b16b", "comment": "Malware payload", "value": "8318758749c6f8a79833bd6a823241cb556ee3a663db1a605153dbc17415c11d", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702225, "uuid": "815532e8-908b-4c1f-b598-085dc9eeeb6d", "value": "T1EC315319711682A0C2B1A39EEEA3D042D707416B1017BA0A398CD9A23F302B5CBDDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702225, "uuid": "f5cae067-a6d2-414b-9794-be3c1e7dba7a", "value": "24:ORl1NCIVMt0MP9NUeN+EYU7hOTPdrzgFQSJgp6r6VUIHvtzc/rtIjvFP4dD:AnN9deNvN5SPJzmQZp86uGatI6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702225, "uuid": "d3e20181-6322-4a8d-b27b-ab3f3cdb6d96", "value": 1777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702225, "uuid": "06c1ac9d-d4c1-4d44-90e7-348d912977a0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f5a108-10d3-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702225, "uuid": "63dafbd2-1679-44f8-93f5-186345e0fd0b", "comment": "Malware payload", "value": "a0eb3bc3a9359ba1f2f7e5f10c24a0ad", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702225, "uuid": "c38d9d2b-5684-43d1-8c6a-b80eedb355ce", "comment": "Malware payload", "value": "b8f6ea39b4ae776fedfec9bc98d0df9a38c13ae17bb237ba3f4b68d8c4142307", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702225, "uuid": "9b9b3a0f-15da-4368-a644-ba8fa8e36718", "value": "T1DA31102616F40235D2B78A3A5477F3229632F892AE029E5D4085528C0852625FDBAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702225, "uuid": "4c3e0eb9-6d8b-49b0-b301-a91ef2f4d631", "value": "24:8G/2Jq0+SN2aizJPAM8+rZdY5rYqVlPIlCHHoqaIc9SCZ+Pmi:8Gew0lAJ4M8uYFBvPIuHOIJw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702225, "uuid": "624c27c0-e052-42f1-b8c1-9c6a4fd1c584", "value": 1511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702225, "uuid": "d70cbc58-1df0-45bd-aa55-ee8db4155a85", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790d19fe-0f14-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702225, "uuid": "3c5bd703-e033-46bb-8441-502d0effc7f2", "comment": "Malware payload", "value": "d6c471d75a7d9e707349988639f9aa69", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702225, "uuid": "dfd6d930-916a-4605-88b2-5cc55ee81460", "comment": "Malware payload", "value": "deb98936aad91a2805108a839ad5083a043efa1045dd92869d7a00036bcd771a", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702225, "uuid": "0365f851-ebe0-4daa-ad1e-be3fb4e00d6e", "value": "T1BF41E2262BF51320D3BB8F7198B9F61147757C21DD568BAD018481CD0825919FE35F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702225, "uuid": "abe43b32-11da-4692-9af5-685c912dac80", "value": "48:8kryrp1OkZP66L7T8r39bILvvalLq+ucU:8kryrp1x66L7or39b2Iq+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702225, "uuid": "98507047-f4eb-40c7-9d86-37f1b97385ed", "value": 2425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702225, "uuid": "bcd0f0a5-d42c-4e52-8c89-325832137bf7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca670caf-10d4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702227, "uuid": "2c2a78dd-75f1-497a-8339-bde7c50d520a", "comment": "Malware payload", "value": "6df21bfbe3d0d22175b4355869bbac63", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702227, "uuid": "83d466e5-7e83-46fd-97bc-8da42bbbcd7f", "comment": "Malware payload", "value": "f6ef2310bfc795cd078341578ce96f89e8be86e7269575d209eea3993cea612a", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702227, "uuid": "9d5052e9-211d-4b34-9be0-03374cd3b21c", "value": "T18731F11A16E90324D3B78F3190BBE6014A7BBC55ED228F9D41C092881892625FE36F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702227, "uuid": "8489456d-fb0b-4be4-84aa-ef423e6cb981", "value": "24:8NUJgcrxPWtmAlPAg+/J+vZujfrYqVPqOYbXQaR3+P/R2SRHe06N+/fm2:8NUmEWtd25lTBZfYbXv3yR2Sr6N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702227, "uuid": "084a544b-0e2b-4bdc-9eb0-c3a3d3b0c873", "value": 1642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702227, "uuid": "e21be26d-9da5-42f4-b427-f08cffe3da45", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790d5772-0f14-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702228, "uuid": "927021c1-77d1-4dfb-a840-8833af0f0b86", "comment": "Malware payload", "value": "c498ec828bc8f082a5f43215db42a4b6", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702228, "uuid": "90333f19-105b-4af0-ae31-3579c135b92d", "comment": "Malware payload", "value": "5720662d40be94b68735a96ef056f5a777c879db3af470c01ad2297a15a1d06a", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702228, "uuid": "c50cc1df-8eca-43c6-88dd-0809ea0962d0", "value": "T13B416E085313E645D8F0231AA8729044FF27E0BF3A4A261030CCA5895F344BAE7B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702228, "uuid": "2e9a7dd0-085c-404b-9d29-ea03ea57061a", "value": "48:c4kjd6jyjIf3SgzgZFvmfZHCkUNO807wmANO5+Djbx:0i6iv8AwmrQDjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702228, "uuid": "46bc8585-1fe7-40cb-bfa4-d8690892ea46", "value": 2363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702228, "uuid": "8ffa855e-1517-4318-b6f4-0f788cbc2ed0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bde4009-0f14-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702240, "uuid": "1e1fe0f3-581b-4ff3-b387-d2d42cba90c6", "comment": "Malware payload", "value": "d9b8779e964491b8f0546f5aab566e53", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702240, "uuid": "5f904fb7-fdc2-4aab-a3ba-a6a4bcc174d1", "comment": "Malware payload", "value": "b64db24eb8a3cf78b0ef48664e6f8b47ff8d8b5108cc8b6fb40ed0821a27980f", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702240, "uuid": "89669ba3-40d3-4926-bb6e-64f0c6b7582d", "value": "T169A63390FFA82CAAD633203717546B59617A21A3BD836A2ADC70819146E73C077F7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702240, "uuid": "a98b070e-d944-4590-b2ee-378c13da217f", "value": "196608:9pJ2cHSM2o2IQ6IGnmy/WaEuyxpW8AnqRTDTwHBJ2frlSkSoCfgXSZ69RD87lH:zJYMQIgCuxASTDTwHBQlrRUyr9J87N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702240, "uuid": "a4a1753d-0271-4290-9b1d-94dccd930c8c", "value": 10064858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702240, "uuid": "50f96be8-763b-45ec-b2ee-50336e58887e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fc59ed-22e4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702541, "uuid": "85065940-57d7-4f60-bcfd-e82d429173fe", "comment": "Malware payload", "value": "56d0406cdf1a89bb1c21b3f56f6cb378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702541, "uuid": "31a0401a-b877-49b4-b62b-1c4b45bad47a", "comment": "Malware payload", "value": "dde5c729a016f1e03a7f85b0fe98a3aba1af98b4011b91df6e48c0bfc135089d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702541, "uuid": "d84aeb8c-d7b8-46ec-ba3a-839025363b24", "value": "T154A533190AB2617FEA8D2A349C47F71C7F20220956F8957E1E6191373E9B31F5EE04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702541, "uuid": "561986a3-0830-450c-8ede-6a4a6dafc863", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702541, "uuid": "2fa51bf8-4977-461c-b15f-252a4eb0ae91", "value": "49152:Hphn4uRLd+2yCNYZ9jjnTX3FFR/vz9sN:HphBRJ8CNYZn/vRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702541, "uuid": "093a25ee-f0ee-4599-9724-c1cb9a99446b", "value": 2064384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702541, "uuid": "24a772df-744d-4dbd-b1c9-162a12d324e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa09414f-22e4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702594, "uuid": "9ca2ce53-0676-4694-935c-58f701e39a1a", "comment": "Malware payload", "value": "12b4889c3ae92c6e37d8cfc195b41c7f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702594, "uuid": "03a1f933-b91a-439c-91ba-880eb329b4ce", "comment": "Malware payload", "value": "4205c6c28ddc38688c7bf09f4512b1b2ec325d4854d792a3817e94d9278d2353", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702594, "uuid": "fc77719f-799a-46c8-bb3e-0cf48a1f19c6", "value": "T14B9533325CB655F8CE49013258CFAB992FBE8309D179397D5D26B63EC60BAAF0F590", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702594, "uuid": "404596df-8a1d-4760-be3e-41c7575748a8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702594, "uuid": "2f2d54fc-b6de-4faf-8def-0c0f857d7eba", "value": "49152:16vfVi3IOX9AKj/uco4BQY2C0FsXAnX3OvXxcPpl:sfViYmAKxo4OYdN8uxcPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702594, "uuid": "bd9ef54c-1dec-4237-8da5-4c75838ce38a", "value": 1899008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702594, "uuid": "8d1f99e3-c16f-4d32-bf72-1377da655a30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bf0d62-22e4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702641, "uuid": "50e0dd2f-ed1e-4575-b671-ad7d41c85196", "comment": "Malware payload", "value": "4369bbdd10f8578eb1c6fdaa8e453d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702641, "uuid": "7c650602-5c07-4fae-9159-2a429bb1f812", "comment": "Malware payload", "value": "4657fd57e5b11b26a89beb0455d2eba765bd5a814b0807f818226be410a4aab8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702641, "uuid": "e9127488-8daa-4f5b-a123-7c6da1c75b65", "value": "T1E5259E0273C1D062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702641, "uuid": "89b60ae1-d1c3-4e17-9ffa-31f3b7edf91e", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702641, "uuid": "8b1ddd86-eccb-4e08-9e41-4dbb96789e19", "value": "24576:+qDEvCTbMWu7rQYlBQcBiT6rprG8aX++ewN:+TvC/MTQYxsWR7aX+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702641, "uuid": "1cc036a6-8104-4602-9152-8dc612ac3e31", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702641, "uuid": "034200e6-d716-4e6d-be6f-201e8a86adca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636b494c-22e5-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702905, "uuid": "d2038670-2e74-4fa4-aeb1-c25a3d336190", "comment": "Malware payload", "value": "6b3635092a48e5baccb7f7863d4672af", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702905, "uuid": "7dd0b9df-eb66-496d-9b33-649ef628358e", "comment": "Malware payload", "value": "50ffe8bb33bb031cbb8dfde9e58e97e1464e99b87ee3ef73baef19c3c770b734", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702905, "uuid": "f4b22acb-6261-46a3-9d2a-c45ec2a4c151", "value": "T15C159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702905, "uuid": "35fa9b79-2137-459c-9faf-50b0588d0293", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702905, "uuid": "90e0c056-6117-4d59-9e84-24d3e13f81f6", "value": "24576:hqDEvCTbMWu7rQYlBQcBiT6rprG8ae7V:hTvC/MTQYxsWR7ae7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702905, "uuid": "88c48c35-e83c-431e-ae4f-57e2604cd5d0", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702905, "uuid": "c3ce5025-c532-4b7d-8046-2579c18986fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab6cd3d-22e5-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702945, "uuid": "fe8c04d7-7cfb-406c-8811-9857e78bccbd", "comment": "Malware payload", "value": "e8a264324ee50fb5821a6e2ee1b8a7d7", "object_relation": "md5", "Tag": [ { "name": "encrypted", "colour": "#726a10", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#9937d3", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702945, "uuid": "dc6661b4-6483-4db8-8bb8-fd94e106de44", "comment": "Malware payload", "value": "a039c7998829ba2b96ab814db380fe8478a278797d6b6272d87128710f7490e3", "object_relation": "sha256", "Tag": [ { "name": "encrypted", "colour": "#726a10", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#9937d3", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702945, "uuid": "08e542aa-2855-4c6f-a9e1-a4be4af02d8f", "value": "T146E2F2A37427BE7A84BA7806CFC251F0871AC9DCD106DE37B6F1B5621C2C58A54407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702945, "uuid": "40fdaf64-2244-4b7b-9438-3fba3bb738fe", "value": "768:2bDJEF+4EqBDuT+kpgUv0F0LLmLAYDdXIRlwxpSz3l769:2SF+4EKDuT+k6d0wxXnSz3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702945, "uuid": "ff63b6f2-b6ed-44b7-971c-6f981025a3c6", "value": 33856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702945, "uuid": "e8e8c3ab-556e-4044-8ac7-5dae6a417dd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3c25ad-22e5-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702945, "uuid": "2b794dc3-3a53-4a69-b2bb-966b91df641d", "comment": "Malware payload", "value": "cc4b8da90ff0fde4c28c71fa47703ac3", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#ef1c92", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#9937d3", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702945, "uuid": "b9b26bfb-919d-4d6e-b282-3a315414b36b", "comment": "Malware payload", "value": "e52a51ebe48af8194602a498e6d93167f33616a9144d87f81f25c45df10834e4", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "Encoded", "colour": "#ef1c92", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#9937d3", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702945, "uuid": "10f661c9-e257-4f27-8400-17b1b9d95b39", "value": "T1E2D479721561DF1C99969DCC5DC05FCEBE41868B881CD5B094883AAE7CE19323AEF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702945, "uuid": "a4c1d55e-1c5c-4c29-bbec-eb8751d05d7d", "value": "12288:JiOe9xKeBU+RKa1BcgC1nqt4AETAYTwRq+MpzRpjOs7ReuMTnJbsf69ex13VYwv/:JiOe9xKcRDcgmnqSAhYb+MxRAwmsfHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702945, "uuid": "ecd4fd30-9c42-4606-8e82-2718613ceb2d", "value": 605004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702945, "uuid": "765d7bbe-778a-48af-8161-bfdb6a3a855d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4883dd-22e5-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745702947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702947, "uuid": "ffde1c4f-a535-4892-8cc0-61d68407d8e4", "comment": "Malware payload", "value": "b3134f195c98cec66151d4effe37f26f", "object_relation": "md5", "Tag": [ { "name": "decoy", "colour": "#d8f87a", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745702947, "uuid": "02bb9ffb-dd2d-4370-8d33-cf99dcfb5aab", "comment": "Malware payload", "value": "01a51e0e9725bd7aa3f51ae953b8f461684b31eb4b64ee44278800093c3aa8dd", "object_relation": "sha256", "Tag": [ { "name": "decoy", "colour": "#d8f87a", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702947, "uuid": "9bfa6293-9b45-485c-b4ea-bbeb5085a2d3", "value": "T12B0423DB4BCF85D99520595B0F2CB35EBB1688DAA57F7F00C411EAA8350C2DFE4502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702947, "uuid": "615eff86-4a86-45b4-b788-4c2fcc9068f9", "value": "3072:5pyJRR44xygueow32yO9XXJ3ivi6ITdrmWPMxdPDYw87p:ryJRR44xz3ow33k53ivirxbMxp8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745702947, "uuid": "1fbc45db-274d-4dbf-af32-ec0639b1db42", "value": 179563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745702947, "uuid": "06911dc0-5276-4cc6-8fd6-9dda1191e6cc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a1ef2e6-22e6-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745703292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745703292, "uuid": "b9ed8748-35f8-471e-b483-30a8732ff9e5", "comment": "Malware payload", "value": "ddcdde392d0a77200c0dfc83d3a822b6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false }, { "name": "redirect", "colour": "#71ba89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745703292, "uuid": "5759ad23-ceda-4514-9446-d79e4028e35f", "comment": "Malware payload", "value": "e82ccfcc9b20b9d4b97af7265f81c2bc4b0a3bace8470cbe4c17e27ed3fa2e2c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false }, { "name": "redirect", "colour": "#71ba89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745703292, "uuid": "039157da-28ec-4ae1-a8f8-cdebf943166f", "value": "T12053F97766623E0D9233480CB8C5B6C87718C453D4075AEDE9BAA62CC3CBDC691727", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745703292, "uuid": "ac20b1d5-95e5-403a-84ce-dad8cf22a457", "value": "768:aA1fho1SnvHgRNv+f5AfpUxnHeob4f1u0eJwO0H+UJF/d+aR1X1t1RB1p+d52sAw:aA1fho1P6n2IaR1X1t1RB1p+d81G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745703292, "uuid": "5011db13-c0ca-4349-893f-c0148e644efe", "value": 64433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745703292, "uuid": "4e4df447-7643-4139-b954-aa25811d3aac", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d44cddfc-22e6-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745703524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745703524, "uuid": "a0ce65c1-dcb1-462b-8e34-c86d03664a44", "comment": "Malware payload (Mirai)", "value": "a372e2e745abd754e6ea2880a22846d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745703524, "uuid": "9ec148fc-2035-4859-8c2f-bc488873e196", "comment": "Malware payload (Mirai)", "value": "fccee8bbf30e3b02b47c65103d9db1c30adba6b6eba933b3fa8a4609127a6615", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745703524, "uuid": "8c2095e4-24ea-4cff-853d-308693c07c28", "value": "T19DC2E192372EED34D17038399E918CC6656A6E7454BF7C75B7B41380BDC50CA99F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745703524, "uuid": "4c335770-0094-4661-b6f5-a4d59ff2c347", "value": "768:8xjpTYxpXMogBve7GhMu8K8ioptUCnk9q3UELjj:8N4F5uVspuOLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745703524, "uuid": "e919d8e5-3d70-4aac-af8b-19061fd41c16", "value": 26996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745703524, "uuid": "43b28441-62c0-46c9-8f5a-79bd20fc16f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a165221-22e7-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745703615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745703615, "uuid": "924fb483-10ea-4195-aa72-19f66a8913b6", "comment": "Malware payload (Mirai)", "value": "4656895438d475c18677ea96401e1ead", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745703615, "uuid": "16492265-7d46-4627-8254-f685cfca1fb4", "comment": "Malware payload (Mirai)", "value": "de63763c61a1ce155b819796b007131a28425056ccee565c9682ffcbb1581b6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745703615, "uuid": "8d99b190-51ef-4535-a8b3-7ea6038d9dd9", "value": "T1C692E0D0EA64B9D4EBFDEBA82518C5C5333C8F4E37EADDE225944F4005A9237A221D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745703615, "uuid": "56af1c8f-bb92-425b-9aed-9d4f6b3b7fb5", "value": "384:tD9j23WbSf/94C9Nh5l4FzR8f5y7McFwAvSa/pM4uVcqgw05VxJ4:d12vf/94UrDYCxNcX7/G4uVcqgw09S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745703615, "uuid": "d64d6af3-707d-435b-8826-925d14b02250", "value": 20512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745703615, "uuid": "c887217c-baee-4345-a0bc-55e274df65b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e2d79f-22e9-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745704522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745704522, "uuid": "b180cd66-6a04-4c50-9868-ace953467aca", "comment": "Malware payload", "value": "ae9e1f9eb15adf43fb97177e91544018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745704522, "uuid": "801b6e3e-0722-4c0b-876e-7a011a097ab4", "comment": "Malware payload", "value": "263fc17d2022524bb8703d8e85be9c04ea4414ca20ce8f37d4234e4bf2275960", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704522, "uuid": "5776c682-f0e9-4cb7-bad6-410c8f3d79c2", "value": "T14F25AE0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704522, "uuid": "be03b260-807a-495a-bdca-3c49ccb2c16f", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704522, "uuid": "c65ee0d1-b8df-46c3-a934-dd4b28c5ec7a", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8aU1Dm/:WTvC/MTQYxsWR7aU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745704522, "uuid": "42c8a1d2-6683-4073-92c0-669ebd4ace14", "value": 970752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704522, "uuid": "38765028-2816-4e7b-8c24-1eccb1cd7288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7015ca55-22e9-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745704645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745704645, "uuid": "c569178c-9d87-49da-bc7d-1f8cc3cfeb19", "comment": "Malware payload", "value": "7b3463a3288d8350cc252f3b19fc76fa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745704645, "uuid": "96970c21-62d4-4c9f-8400-cf3ffb777fc5", "comment": "Malware payload", "value": "4feb860c5e7c9f51b28565be3aa1febeeed05637ad37ef98010e0adf82708d52", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704645, "uuid": "6c800bcd-fb92-4189-87f9-3d32875586e5", "value": "T17036330FA7DDD72AC4511AB3186F99B12330BD21DD5F8E9FE94832B8EDF984106520", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704645, "uuid": "c138d544-a882-41d7-a576-b1f58df4a39f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704645, "uuid": "efbfe62d-a58a-4b98-9a59-1e93fac7a0ce", "value": "98304:LY6+y0oDjqksLT5djniO2sbA4BmQv3Ar47EQub7u8Lfct9S0I+W9:LVuokddDEdXrtbCgfU9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745704645, "uuid": "e3d69bba-2158-4c51-9a8d-40194a336bf3", "value": 5059072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704645, "uuid": "c4b45248-01c1-4f84-82d4-72ddd4f638cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ab5a6f-22e9-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745704706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745704706, "uuid": "a9068af9-8f2e-4bf2-970e-facd12376c93", "comment": "Malware payload", "value": "3bc6e5127cd19ec88896b2b3663dc206", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745704706, "uuid": "03d48cf7-1749-478a-b69b-6b122fee9b59", "comment": "Malware payload", "value": "1bbc268bbbf92acebedae9d31332e1b502887a580677ae33b0728e9b5b1ef848", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704706, "uuid": "b2986073-ad5d-4770-b64a-1248c0e859e9", "value": "T156A5330BFAE99436E86407B00CF703C30679FF815B25D7890B8E9D1928746E8FA657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704706, "uuid": "db98ce24-a25a-4ec1-b039-bdd9ae8ebcf4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704706, "uuid": "671ed1a2-0470-44d5-995b-5e22284d7fb7", "value": "49152:mk75CziLdN/08J9A0Wjv7+4mRGtWIdCpBxuTCTh6R2fyQv:vdN/xJ9oXrmRINspBxeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745704706, "uuid": "887f0e60-9cc4-4a38-be9e-b4cf17b61a93", "value": 2227200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704706, "uuid": "3e3d178e-1ffb-4f9c-9518-d175f89dc4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56cbe33-22e9-11f0-82df-82aee05be84a", "comment": "Malware payload (Healer)", "timestamp": 1745704788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745704788, "uuid": "7a0e9046-b280-4cfb-9a4d-8e704fe03943", "comment": "Malware payload (Healer)", "value": "0a62b89fe941b88bf3dd55310479846b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745704788, "uuid": "429aa5ae-97d5-4529-b939-f3dd64e6b216", "comment": "Malware payload (Healer)", "value": "420837664c5d64a0c8ade0893df2f6189031ebf09df01e6c667737a085efae80", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704788, "uuid": "dd08096a-5bbe-4c73-a39b-747fa830ec6e", "value": "T1568533CE0C57B879C6B84A7C2AFE0C6E5FD4ED18843E863CF5C065165867458A6FFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704788, "uuid": "6fd7b35b-bec8-4828-9531-c84bfeb197f9", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704788, "uuid": "f470bac7-e347-4f1b-a01d-beb7de4b6581", "value": "49152:klA7y+M8dwBrIi3cHE3DJ0wpWtKOUwWzVh5OxV:MAuXlgMJ9pWttar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745704788, "uuid": "0037c293-0afc-464c-8b4b-ac9cd2e61aef", "value": 1736192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745704788, "uuid": "7d7f1571-e7c0-43c8-b141-bce39518830e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1324ae6-22ea-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745705264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705264, "uuid": "fef93275-eb79-4e83-b18b-1224ab356eab", "comment": "Malware payload", "value": "18eaea222e5d96c008bc5ca142b17741", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705264, "uuid": "3dd93240-938b-469e-a866-d302e7f073f8", "comment": "Malware payload", "value": "047fbea603c1cf4afffcfe260adacf28c9258b24d44ce908aeb7cf473acd458d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705264, "uuid": "9cf14863-fd0e-401c-adda-93526db453d6", "value": "T1AE9533BC3D45A63ADA10863F35EBDB5CCB29837155A5A7348E738C321E87C0876583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705264, "uuid": "30cccdc6-8323-4e72-a606-1429e29b1a26", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705264, "uuid": "29e6f640-5beb-4800-9620-d7827176455e", "value": "49152:oLYA2XfTvCLt1sQSkotpsaebGDlKB4jgayU:oGXfi9SvtpxebGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745705264, "uuid": "0dec689a-be96-44e0-b094-feb58908020e", "value": 1920512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705264, "uuid": "280bb27c-acab-439b-9b5a-91ad2f0e6200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e690aba-22eb-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745705555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705555, "uuid": "32cc0951-44ed-48f0-b1eb-eaa23e359c93", "comment": "Malware payload", "value": "880caa25391b36b73c61d7b1a48a0271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705555, "uuid": "3aba686f-735c-4b7f-a43c-90b15c72acc9", "comment": "Malware payload", "value": "586143c44e23346b3d18d696c73d92add9c6b3a5f75244b0b33e83a18dcaa35c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705555, "uuid": "202b716a-bed7-42de-baf5-db84c14e77f3", "value": "T1C1A522DA37EBDAB5FAC16B3B3E257808CC55A934405F460C299460E2FEBF48C24585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705555, "uuid": "5ef37012-6c33-40ce-80c8-bd9f505677d2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705555, "uuid": "6f394fcb-8d94-4fe9-a121-160be82ac9fa", "value": "49152:17CJT5hKbk9rp2QBrC95Ixz/R4YpiJ4M/lqz:1M5hdVp2QBQ5Iltqdqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745705555, "uuid": "313d25a5-9fe1-44cc-93d8-fb9a53d6c6a7", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705555, "uuid": "30c7251f-3325-439a-9b36-b2f112e4d4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e62f55-22ec-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745705854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705854, "uuid": "ce32aff3-e248-4650-9a69-8194ca3c4cd0", "comment": "Malware payload (Mirai)", "value": "ef68a4fd0d7cef14fa9a2f603bc5db04", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705854, "uuid": "0da9bbb3-4dd4-483c-b629-b92f11864534", "comment": "Malware payload (Mirai)", "value": "c4d16978520d56e90b65bb8f44c6ab9d3ae9a6f1fac9c20c1f85d01dab805f1d", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705854, "uuid": "7e7bae2d-78b9-4917-9298-c9b286d48680", "value": "T1BC638E73C8676E58C05486B4B4F1CF7867A3A4809A874FFA2599C2759043EECF6463", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705854, "uuid": "09344b91-6fe4-4c47-8f37-4be9ddd94c28", "value": "768:7M2DB6UhSidM/ySQEC5W0QlqKLpJviM7japo4nbaIC4R1p60DdrfqcFCSA5kNI:7Me9hEp0zKLpJh7Ou4uIC4ID2hAaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745705854, "uuid": "307f3270-7246-4f40-abda-e2a256ea36ba", "value": 68124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705854, "uuid": "33ad34b9-2c10-400a-a370-11a9fc290374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557cf318-22ec-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745705889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705889, "uuid": "517cf5f4-6f27-41fe-b7bf-389d88bc19d6", "comment": "Malware payload (Mirai)", "value": "2d20b98cf51c983583f1c38006ed3ba0", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705889, "uuid": "7587947b-ebfc-44d8-9477-7486f8b97621", "comment": "Malware payload (Mirai)", "value": "9a3a7be8fa40081f36c43532427e354720e465dc32e38fbe31e1764a3d6f285d", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705889, "uuid": "bab4ab11-a063-4dd1-a140-1687b1dcb405", "value": "T15F83A60E6E219FEDF26CC33447B74A31A76923D622E1D685E2ACD1141F7034E585FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705889, "uuid": "72d6f1c8-ecd8-409f-b7e4-fcda8adaa48f", "value": "1536:IC0GxRiwm9zm9Uu9ZvyUBi5cNHBAsehse//kbPZ:IvG7iPUBiwHBABkTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745705889, "uuid": "99eaf65b-232d-4c9a-ac3b-771bcd9bf80e", "value": 82016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705889, "uuid": "957bd3ea-1fd2-4cc2-b4aa-cda8d78b4834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0000c5-22ec-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745705925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705925, "uuid": "0d59e1cf-b507-4786-9f95-d7edd67a2902", "comment": "Malware payload (Mirai)", "value": "35c8614595a9586851a2f00ac8f4ccfc", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705925, "uuid": "5ee2f411-c801-4d87-92db-4b056d1686ed", "comment": "Malware payload (Mirai)", "value": "c44c4ff70ebb5af28e2313f273f627c7cb5011e5cdee8627febc5b521b29db60", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705925, "uuid": "eea20f7a-a1de-44ce-aa45-8f2181316d5a", "value": "T173A3C70E6E219FADF768C73447B74E31A76833D622E1D685E26CD6001E6034E585FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705925, "uuid": "1bc85a65-ebc6-41a2-aa42-e4c0599235e2", "value": "1536:VLbElg/mLYgjEqWFbWFxsFIZREDqGPpDF2C6eiLa7y73Dk:lbESuLYYEeEGGPD2CVy7zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745705925, "uuid": "caec215a-0edc-44ba-b2a2-b448086949ae", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705925, "uuid": "5326c9ed-715b-411e-88d1-e0510cceaa06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dec1e3a-22ec-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745705956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705956, "uuid": "479fd04e-2bbd-4748-8368-3f89d59d0792", "comment": "Malware payload (Mirai)", "value": "b807242ec915cbdb9595b11e2acb4845", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705956, "uuid": "2be23d71-6523-4103-8d87-867b87e10bb0", "comment": "Malware payload (Mirai)", "value": "47448f75df05d3d0cb335bc7fe7d26a39402002117a15d8c75e6586a1cc91c02", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705956, "uuid": "4d477016-3eb7-4147-a09a-d7d23cfff1da", "value": "T10A635B17B58190FCC489C2B44B7FB63A9933B57E2238B26937D4FF226D99E111E6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705956, "uuid": "fad6401e-4d76-4c89-bf56-358e3ca32046", "value": "1536:xMoCwc6AXKBE1O3uT8rZhn6gC1cQPag5Beub6KYTSi2xYX:xMlZXKBEQs8NhnC1cQyxub6KYTU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745705956, "uuid": "ceca0d98-404f-4907-90c0-8fda990fa525", "value": 67600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705956, "uuid": "c40dc7ad-98cf-44a8-a73a-920bbeb4e2d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8924f89c-22ec-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745705975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705975, "uuid": "2901422d-2525-4eb1-8b76-c6423b753b65", "comment": "Malware payload (Mirai)", "value": "839594d5651b347b0633013c39c20957", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745705975, "uuid": "9186f5ae-a2a0-4897-be33-8ae3ff4d1226", "comment": "Malware payload (Mirai)", "value": "100d35a4ebbe1318d044f5fea360a3b5cd22170af7db83180e6914c93e815cee", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705975, "uuid": "120d421a-6a1c-415d-a1bd-ea379b673559", "value": "T1E9732A81BC819A12CAD1127BFB6E428D772613A8D2EF7203DD256F2137C781B0E7B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705975, "uuid": "88c48be0-c7e0-44be-be3d-5e944e0ad436", "value": "1536:YMJWjX9FxY5kBFiaP55QNR/1OlLhs75IskGblwOcYuYPLMtpvqq:YMJIXY5wx3QNIy75IsZjWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745705975, "uuid": "afc62a60-7e3e-4dd4-b2ad-dbfbda671c59", "value": 79164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745705975, "uuid": "0288449b-1648-4a37-999e-38f697c541f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0241897-22ec-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745706041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706041, "uuid": "c319d76b-8a39-44b2-84bf-b4668586deec", "comment": "Malware payload", "value": "79cc14b6c431d56af69f1aa815a8e5b7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706041, "uuid": "a97fdfdd-c137-4da4-ad47-24ae2f416440", "comment": "Malware payload", "value": "e6be3d4dd97f9d653dcb0ece3ca622ccde3a2a214ca95e02f4279dc79da0925f", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706041, "uuid": "c1de1383-d3f0-4a51-852d-35abb2649b9e", "value": "T12F95335869A39C9FD6AD4573823E8FF1EFC871CE913D804BDA53177E970AA320549C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706041, "uuid": "dfa50e6a-24d6-4a52-b628-b7694b83ba2d", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706041, "uuid": "f9c413d2-c06d-4d5c-adf7-55df3bd79add", "value": "49152:RwW9fAeuco0R2zBqvuUV9RFs0y3g2AxFWSkIM:RwqRqcvuus7gZx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706041, "uuid": "ab4a01c7-12f1-4255-9cdc-a8031f0043d7", "value": 1889792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706041, "uuid": "1263da71-6336-483a-9122-6f564e0105b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6988ae1-22ec-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745706051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706051, "uuid": "cc0e9e71-e3c8-45f8-ab8e-28e79311d8c1", "comment": "Malware payload (Mirai)", "value": "fd796ef86e24f8d544fe2099db9aa2a2", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706051, "uuid": "fe3b294c-e1d4-42c5-94fe-9ea052ef7b3c", "comment": "Malware payload (Mirai)", "value": "bbd19ac73824cbbbc1cdbc0dbeb8c3a929510d5c520f33cbad86de4b9a571bb7", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706051, "uuid": "51b97917-6e38-450b-a87b-6c1ec4e5b60f", "value": "T1E9831956B8819B11C5D112BAFE1E128D33131B7CE2DE73129E246F247BCB96B0E7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706051, "uuid": "2b5fc634-5e8b-446e-98a9-c7efdf9bb16c", "value": "1536:l8VnYBULdok38ZLq5bdHKDBJ5MSZQEa6DO3PELQ1MGiBhv2HHG7Y75WYSf:lbULGk3hBRKDBJqSZQEa6Thv2HHGM7Ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706051, "uuid": "55824168-9a63-41ad-afa3-a62d66dfe345", "value": 85068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706051, "uuid": "b2fa3d03-6244-4236-a34f-975dea4e10c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01f7486-22ec-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745706067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706067, "uuid": "502cd0ba-b711-4c54-bd02-6c32f3d9973e", "comment": "Malware payload (Gafgyt)", "value": "29d6e56abb8af23fdfb8b7e789299b00", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706067, "uuid": "7079efd1-d188-40d7-893b-667e675e0a63", "comment": "Malware payload (Gafgyt)", "value": "71b72cd1a57789dccc0d292ec3c4c8559bc4aa0bcc20f41ae7493995e10e9886", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706067, "uuid": "d881d05f-17c7-4a96-aacd-51cad8af4ebc", "value": "T14073C84E6E21DFEDF769C33447B74A21A69833C626E0D685E26CD2041F6034E645FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706067, "uuid": "066a20d7-3fe2-4895-9b85-3ac9052abaf4", "value": "1536:ox+CD5+7Cm8ybO6pn6pSypq+97ASip3vgexK57:o+C07CQbS7ASW3vY57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706067, "uuid": "b41aac94-09b3-43de-b1dd-9ea8e4faf830", "value": 76664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706067, "uuid": "e4613239-d801-42ac-a2a1-af1fc6d2ad28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b4e24d-22ec-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745706124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706124, "uuid": "695a50fd-ca90-4571-8db6-70c92cc860aa", "comment": "Malware payload (Mirai)", "value": "75daa84520a90f1f95b232b6ce38b4be", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706124, "uuid": "234efac0-656f-4bec-a4d2-eb30a3c1b16a", "comment": "Malware payload (Mirai)", "value": "ea68590b3d5df7675f94c271d382e52a2197abb215c8a9a5965ba2af00f40f0e", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706124, "uuid": "89794162-7572-4aec-b3be-f316d105c18c", "value": "T114734C02B70C0947D1635DB03A3F27E093EEA9D021F4FA85655FEA4A92B1E3255C6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706124, "uuid": "a24eaed5-f867-4dfe-a146-1ccc90f7fdba", "value": "1536:CZ1UYJ85Io21AjJ7GcuIO+hUMfjhIgUjsuN8U51Ze9N9:CZ1UBIjgAnkdhI/s4k9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706124, "uuid": "42f381a3-4585-4702-81b4-ef52d0cfcfe6", "value": 76632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706124, "uuid": "a9dcea4b-f315-4b2b-ac85-c819ea8c29fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39107534-22ed-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745706270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706270, "uuid": "ee77874b-02cd-48b8-9a4a-83610591fa36", "comment": "Malware payload", "value": "c3ca05d7aa4c75ad91763900abb5e7bb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706270, "uuid": "f43b8297-4065-4a67-94ba-6505c43b14c4", "comment": "Malware payload", "value": "74624d9dfb5188376d13a93b7bb76321666c1371ec6d1fa7c2eff5284ad658d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706270, "uuid": "b542365b-414b-4ae7-8f11-17f07d6b1830", "value": "T1CA159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706270, "uuid": "9f7b7487-d192-41f4-8cff-9babe4735026", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706270, "uuid": "067f4627-2b5a-4291-a5a8-8ea3b5308ccc", "value": "24576:HqDEvCTbMWu7rQYlBQcBiT6rprG8aeBV:HTvC/MTQYxsWR7aeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706270, "uuid": "50a37b6b-5449-48cc-92bf-6600542667a6", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706270, "uuid": "19e885a5-8a2e-4316-8d26-f1381aa8aa30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d38f8b3-22ed-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745706331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706331, "uuid": "d979bd64-1a84-43ed-baa7-61c282e355f9", "comment": "Malware payload (Mirai)", "value": "e869f0b8c8d8e6fac264cf3154b300b8", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706331, "uuid": "1450670a-5364-49c3-b8d1-f2ebcbc0bed8", "comment": "Malware payload (Mirai)", "value": "4b3008bb55bf8b8d54918ff23420f678f0bec5434ad05ca8146aba049d8dcd3c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706331, "uuid": "9d725827-7056-4add-931a-277c606f7c25", "value": "T1F9A3E61ABB610FFBDC6FDD3706A9070635CC554B22A83B363574C928B64B64B4AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706331, "uuid": "e880bf11-7b1b-484b-bb60-cf5d18ab8e10", "value": "1536:+8JUj8nEbZTgTHVb1snZgTi0wEBZrwBe2tAFOTRjecX:+kUjkxwgT1BuSIE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706331, "uuid": "046c051a-44c4-4bc7-967c-e169e61e575d", "value": 101712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706331, "uuid": "4c6c5ad8-53d0-451f-a6d3-c79ea221f6c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8cb9b20-22ed-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745706458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706458, "uuid": "dbbfc0a9-766c-49d1-82ec-cc3c1c04586f", "comment": "Malware payload (Mirai)", "value": "efbad556eb569092f70dc1a109a3f797", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706458, "uuid": "e98fb14c-c212-4c70-9be5-be85d16044b4", "comment": "Malware payload (Mirai)", "value": "f586b9e9aa11193fc056701e18b2c779caedbc7631ecaf9c4b10722f72268935", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706458, "uuid": "88007cee-71f2-41ac-babc-d8b8465d4949", "value": "T181633981B9815B12C6D1127BFF5E42CD772613A8E2EA7207DD266F21778B81B0E3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706458, "uuid": "9a1bf03d-aaff-4b2b-92f4-8a4810d512a9", "value": "1536:b3Pq76PTRBIc1ChGPJK64RGQTTl/20O4NZomj+oyvR:b3P7VBIc1LF48QTtGFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706458, "uuid": "37853a0e-f76e-4b5b-8017-382218e237a8", "value": 72648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706458, "uuid": "4400bb90-92a3-4ccd-857e-dc68437ab0f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af37e745-22ed-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745706469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706469, "uuid": "5b21480b-2dca-4847-aebc-ae9a7f55e3b8", "comment": "Malware payload (Mirai)", "value": "62cc930bde76e4319dedae931e730bfd", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706469, "uuid": "ff51a14e-00a9-40e1-9eb0-9cba1db7319b", "comment": "Malware payload (Mirai)", "value": "9f497f2417d1a8eecf4b36b6145d64033ed2027c0aebc6c98e3a3d68ea9029e0", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706469, "uuid": "3abb3faf-d416-42e8-bac2-d6a917155703", "value": "T19D830946A9819F02D4D631BAFFAF414933136FB8E3E97211D9206F5027C69DB0EB76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706469, "uuid": "7b73be06-78ba-4b53-a680-b0c079b53533", "value": "1536:HcnHK8ZsHqSrTBkNZ0TGSRahrhWFKXhZsCa9l1qiuwxMNRFY7dQHO:z8Z6qSrTqNZ0TGSRaRhYKXhZciwxMNRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706469, "uuid": "73332c33-b701-41e6-99ea-470a08f65712", "value": 84376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706469, "uuid": "129b5a84-46da-4fba-8f9d-9076378e2d0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8c2943-22ed-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745706488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706488, "uuid": "016f32a7-1817-49e3-92c9-9eccc5d96364", "comment": "Malware payload (Mirai)", "value": "c6bada9c184cab9f3dd7acb0b45cb641", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706488, "uuid": "4a31eb3b-87a1-4e3c-b8fc-eb94e1714d49", "comment": "Malware payload (Mirai)", "value": "a9489e6cfe3eb9954dc3721dcc0b423fa4020169cd7d161987174e49496c34b8", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706488, "uuid": "0810ed70-7f55-473e-97a2-7659d3980213", "value": "T150834B22BE761D2BC4C4A47A61F34361F2F6478A24BCCA1A3DB10D8DBF6564032577", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706488, "uuid": "08e9b3df-510d-4051-9782-aa7ccf911a7b", "value": "1536:MI5gyI+40/e9lyyyv8tKK8o+5bNYzhStVdXm:M0IecQK8omBjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706488, "uuid": "0cd70434-5542-4f73-8a7a-d95c20f75e49", "value": 83272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706488, "uuid": "2e3aa5e4-f9a9-48da-9ec0-98abbefed9c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf76e8d2-22ed-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745706496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706496, "uuid": "998d9ac2-d16e-45ed-a1d6-9e07f60e9466", "comment": "Malware payload (Mirai)", "value": "b96f960582418a0e0213047cbd5042ef", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706496, "uuid": "b7cf5d26-ffba-4a5a-bd16-02bfc62815a6", "comment": "Malware payload (Mirai)", "value": "e988ef7bbc4b45b21d5b179c43afeb49387a500c8b2a885158d2b50c4e7833e9", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706496, "uuid": "1f670699-64b7-47d7-92b8-b38cd37acad5", "value": "T16D732A51BD819A12C6D1127BFF6E428D372653A8D2EE7203DD256F2137CB85B0E3B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706496, "uuid": "e985ab49-922b-417a-a85d-71cb49270447", "value": "1536:RnGmRJjJSARU5JKBtpmyaz6yb1FCKzlWO+BGW23mBIzaJq:RnGmUrfKBzHyb1FvVmaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706496, "uuid": "c45b704a-efcb-4b9c-b051-23a82e8cdb95", "value": 75240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706496, "uuid": "981cc405-4055-4f4e-9f8c-f44271effdfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5156e6aa-22ee-11f0-82df-82aee05be84a", "comment": "Malware payload (Gafgyt)", "timestamp": 1745706741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706741, "uuid": "6edbd37f-6ad7-4460-9c08-def1a0e3d071", "comment": "Malware payload (Gafgyt)", "value": "60dd76fc80b5f863fa42aea78b01e135", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706741, "uuid": "6c7562ef-38cc-4da7-a1e7-46c74e239c71", "comment": "Malware payload (Gafgyt)", "value": "8ea2870713efb6e5b7788eac4b759ca2945f427e133d3e058bd5794007645af4", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706741, "uuid": "89903ebe-d8c0-4826-a6a6-5a4c3179ec45", "value": "T1EF73B516BF610FBBD86BCD3706A9070535CC951B22B43B3A3974D928B54B64B4AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706741, "uuid": "ca3cc409-efa8-4418-ad41-fdbd7d446fc7", "value": "1536:lt9ZA/bdjlOMNSDqSAx+4ZEhVacxLlEKzZzzo/tJ1qFh:3rA/9McSAMvacxjzoJcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706741, "uuid": "cdd33a69-2e74-4c81-bd59-6b32dc462c19", "value": 76664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706741, "uuid": "104d6d85-642b-4f43-b655-18b5f2c3f538", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d529a2e0-22ee-11f0-82df-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1745706962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706962, "uuid": "22eef30b-4b52-4710-89fc-35bf5e84e2bd", "comment": "Malware payload (Mirai)", "value": "272213e42408a38bb2db01b6ec72f927", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745706962, "uuid": "227a316b-067c-408a-b551-4a5c7449db32", "comment": "Malware payload (Mirai)", "value": "fc121aaa6b1c59944f2339db216f4f763c35cec18277190d433ae5ee31d0b8f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706962, "uuid": "fece1058-d2cd-46e2-bf7f-b66ae1b6c2bf", "value": "T12D137C79D41B5E58C09A0234A8A48E341F63F2C8D3625DFB37D146B29447E68F90AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706962, "uuid": "6127bf4b-b452-4020-b5fd-8470887a1813", "value": "768:NUalLr6vIRp3pcjtPfibuQ2Bgf1DQ/+RZARCegoqTLV32w:NUat2vG+N0f1DJARFPqV3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745706962, "uuid": "f42b31cc-c5f1-4d36-9619-7195ab90ab5c", "value": 42236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745706962, "uuid": "a3087634-ad18-44e2-8dbc-4d85adc4a773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c1ab92-22ee-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745707015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745707015, "uuid": "a71844d4-3927-4bed-ba38-b864006d8bcf", "comment": "Malware payload", "value": "659d9843660282112241c53e5a9c74c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745707015, "uuid": "70bab837-a993-430f-905f-5452fe4a83eb", "comment": "Malware payload", "value": "cbc22ca48dc37364b0a9c1fbcfc592e1f70cb3633af2efa501fb0b4d95344c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#f4ae28", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745707015, "uuid": "9e416547-db99-4865-a281-2b7c8d3f94f8", "value": "T1F5953302FEA0D659C5CA95F45C578A0A2CD817F23A7D389A4751D0BB32F339BBE312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745707015, "uuid": "6b01b953-c087-4402-adba-a27f8753aa50", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745707015, "uuid": "2f08f216-01f2-4db0-928a-4beea60b8982", "value": "49152:v/U7jDd/HmdXLjMzYbvxLNEwRwP95W4yOV7ql:k7ZHmhLMixKwmW4yO9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745707015, "uuid": "f948ec8a-51ff-4166-8ff7-5299e0508789", "value": 2049536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745707015, "uuid": "7a59f603-ce79-484d-acaf-3a820665d193", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb5a7ac-22f2-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745708481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745708481, "uuid": "04019002-e525-4584-8f10-6d3a8d701023", "comment": "Malware payload", "value": "dd2c5d0ec7d6ce9255ac47eb78a11920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745708481, "uuid": "fb43ec66-6dc9-4fce-b80c-67a2f5c75b03", "comment": "Malware payload", "value": "4e3bba574a8f9900cdca0071bcda699250b58b51f2b75131b154469d6fd71d4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745708481, "uuid": "b62bf7d2-80e6-4256-9db0-ad9a3e0d3d28", "value": "T1D9259E0273D1C062FFAB92334B5AF6515BBC69260123E62F13981D79BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745708481, "uuid": "4d44ebca-038d-42f5-b6fa-b306352d3737", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745708481, "uuid": "cb0e06f9-1a63-4425-b2ff-0ad59151dfce", "value": "24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8asJN:wTvC/MTQYxsWR7as", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745708481, "uuid": "cb7bc4de-07ea-4d14-be10-d9d66a01b558", "value": 973312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745708481, "uuid": "bcc0a6b4-2cd8-43f3-9dfd-fdce47e4d986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbf2d29-22f2-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745708692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745708692, "uuid": "d79b744e-e538-4435-b3e8-f187ab3ef408", "comment": "Malware payload", "value": "dd50efa6b2155687c5cb79258c3870f2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745708692, "uuid": "cc3e19c8-216f-4441-9648-2ae320c85cdd", "comment": "Malware payload", "value": "4d3a2a60043a7eeb4d00eb8c512c63831989829c39a7103f9c67dd62ac802976", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#f1c814", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745708692, "uuid": "c7dab25e-776c-4db8-8fbc-bd4c1157f05f", "value": "T1C3A53302F6F89131C1F65BF018FA0BE312333D106E7C05567D4E65AA28B2AB6A5757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745708692, "uuid": "ca5756a3-d9f6-46a4-b273-c018a467cd11", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745708692, "uuid": "778b9874-12f5-4013-a251-2d986ef34944", "value": "49152:MB75CYHZPZfGFxqinjH+S7sl+v4NhptKhTDy9ezCXBndA4UOK/aQ:8QFkinjeS7sQv2hO4ee84vEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745708692, "uuid": "effe6143-e015-4ee2-bf34-15c09d9586fa", "value": 2193920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745708692, "uuid": "8d6eab42-c4b1-46c6-a7f8-5e2c8ea90fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2ec398-22f3-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745709123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709123, "uuid": "f2ea6320-e4ee-430c-bb33-b79890c97b9a", "comment": "Malware payload", "value": "4a0d49852a0be9253c10e5aa021085d7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709123, "uuid": "e4aa4068-80a0-423b-8b3f-ed058fd2db59", "comment": "Malware payload", "value": "a61fc5857c1e4bbbda60b3032c8df5f659c61a568232087b1624b553a79ed077", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "healer", "colour": "#118a4e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709123, "uuid": "da8914f1-137e-43da-b40e-f25fdcacf9a3", "value": "T16C8533828DC46253F7FEBA3F94B745A7C37422CB61E816EF2C59C21619D416B81EC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709123, "uuid": "157d9311-9a2a-4347-8149-f3da2148a24f", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709123, "uuid": "f0ef5474-d424-485d-ab2c-e310cd269bc4", "value": "49152:jK+hgF/+Zz9G9lV8R6hZhwNcoupPytrhtI:jlLMV3pscBKtrht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745709123, "uuid": "7fea79cf-847b-40ea-8d35-d80d5463806b", "value": 1753088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709123, "uuid": "5e6c996e-855c-42c7-b1a1-c8477d816798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6af6430-22f3-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745709165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709165, "uuid": "ddda7e7a-f540-40af-ac5a-9a52b6337f6f", "comment": "Malware payload", "value": "7de77668982dc22b371198aaf370d0ac", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709165, "uuid": "b9aea500-006b-44d0-b57f-39632b1a5e42", "comment": "Malware payload", "value": "b326a05df55e58530d68b1319c12404a8acb5b182f5d4ef5f5aca0e9311b50c9", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709165, "uuid": "557d0361-faa6-4082-b956-22e04ed23a4d", "value": "T1ADE53385F3850E91F9ABBE7F1C8683814FE18CA27C3C4216D691C51AD571DB8BE096", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709165, "uuid": "62a644b7-78d4-4ec7-94dd-b0764a2d2c71", "value": "d89f3dcdac0c8dba11dc1162435bedbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709165, "uuid": "ec338090-3f42-4012-9ab9-403b6d02b402", "value": "49152:yY7Qhq7VDTXZLSTYXA58pbeqfEmTpc8iYMKC4f0xw4K/k/iYYBBM1YGtLIoTNxT8:dQcJDTpLS0AOpbe4VTFMKpMy57YYTM1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745709165, "uuid": "35746f35-1f47-4bc9-9475-29c04d694afc", "value": 3123589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709165, "uuid": "10d6505e-1990-4049-851b-a75551f4fc08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee720f6-7fdd-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1745709365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709365, "uuid": "01e72275-35bc-46c2-afd7-08c85ea2ce32", "comment": "Malware payload", "value": "a73ddd6ec22462db955439f665cad4e6", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "Mozi.a", "colour": "#ab09a0", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709365, "uuid": "d5b72c67-2a1c-421e-b41e-cc8d5e99348e", "comment": "Malware payload", "value": "b5cf68c7cb5bb2d21d60bf6654926f61566d95bfd7c9f9e182d032f1da5b4605", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "Mozi.a", "colour": "#ab09a0", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709365, "uuid": "a2c2fb7c-5b46-401f-b2fa-acd344737fd0", "value": "79D312B3C639E3EAF471E4B0B66C23CC101462D9C958BAA0774C54661B5439B1B6F3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709365, "uuid": "857302ea-93fc-43da-90f4-849469f7ba03", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtoM:2IIKXhZtL7jOTyIG87Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745709365, "uuid": "3d6a7783-1aa5-4ef8-adfe-d4259f3e0ff1", "value": 135472, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d057db24-22f4-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745709531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709531, "uuid": "489e78c6-1cb7-4ac8-bfd1-c617c1f631b5", "comment": "Malware payload", "value": "eec13773d94623d1ebc674efcc0a1607", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709531, "uuid": "9fb25abe-87ac-46ce-8228-f469216d5fca", "comment": "Malware payload", "value": "21181bd4afe88cdab5b44fedca0d8d00e7ff1328abfb2602bc347e174bbc6cf3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709531, "uuid": "f450e631-d29d-4d78-81ae-65e95e00b2f6", "value": "T14695339A314466A2D769E0707FE0B20A5869D21FEDF05E9BEDBF03A7944EF34210F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709531, "uuid": "e40d008f-3123-40a4-bee3-f691999a8d8a", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709531, "uuid": "d1704949-04b7-4f92-b908-9107f6ca914f", "value": "49152:ZsjJN9qfyAwvuPIBlhOPQoWSHAY33Vz5daHKyoIcy:uN9qfyAwvAI90QXSHAYnVldaH9lcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745709531, "uuid": "1b405a54-5431-4638-837f-990070676a67", "value": 1887744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709531, "uuid": "702236f8-bcd4-4e2a-a5fd-96b59065f819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfd4a62-22f5-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745709928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709928, "uuid": "4fa8bad5-390c-4c06-8960-77494d6e5c9f", "comment": "Malware payload", "value": "b69deaf435963dcc38cafd0ebad5fd65", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745709928, "uuid": "0b017346-2c6e-42ce-a944-4158ecd97041", "comment": "Malware payload", "value": "5f231720a0083d32633dd7f578271301583568c9a59a8535b3c851c859de46e6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709928, "uuid": "72ee8490-ec63-49c2-97ba-d1dd3a3696b1", "value": "T15A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709928, "uuid": "46d9821d-1926-4bf5-9e25-3610aabbe43a", "value": "279daa640d9140f9842860a738abd363", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709928, "uuid": "b1378655-d042-4cf1-be5e-736eaf7c82c6", "value": "24576:TqDEvCTbMWu7rQYlBQcBiT6rprG8aeXV:TTvC/MTQYxsWR7aeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745709928, "uuid": "d5dcb86f-4852-4f94-80b1-e4d3ee66b953", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745709928, "uuid": "d3eb9770-d253-451c-b4ed-afe5a99385d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8d1fa6-22f6-11f0-82df-82aee05be84a", "comment": "Malware payload", "timestamp": 1745710412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1745710412, "uuid": "2fdc77dc-afb8-4be8-887c-81f77a2388de", "comment": "Malware payload", "value": "eeb651aabe3bffdc0eb1103ecd7c07e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1745710412, "uuid": "343b24e3-3f0c-4206-8efa-62cee8c6cdeb", "comment": "Malware payload", "value": "e01c380244540384454716bec5d878168b24bbf62379cb2e63bec830c4c5868a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1745710412, "uuid": "df144f22-1ef5-4d7f-92c7-82427d5573b3", "value": "T174A5224F0A1C7FA3E14042FFA9B5F754ED30F05AE95AB8DD1D0D92BAA31918982674", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1745710412, "uuid": "0d86ad49-776b-4f2a-9255-9f9fd13d69b2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1745710412, "uuid": "93d13845-3a6d-4ff0-84fa-a9a2368385ee", "value": "49152:jxsrDidcibrqOuFfGQiWj7ChYr02RMlZaEs1ND59ebe14Hp:jxsvkPbr/QiWjGir0YMWEYT9ebx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1745710412, "uuid": "551acfa9-6317-49ad-85a5-7be53be4e9ce", "value": 2080256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1745710412, "uuid": "d29a4f12-89a6-408d-b88b-3437184b8e91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ], "Attribute": [ { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625666, "uuid": "8d258915-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://223.13.81.29:42166/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625725, "uuid": "b061b1b9-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.55.26.132:34972/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625786, "uuid": "d485b5fd-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.185.171.41:41148/Mozi.m", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625787, "uuid": "d5242815-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://179.87.13.89:44388/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625791, "uuid": "d75ffa7d-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.84.158.190:55748/Mozi.m", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625791, "uuid": "d7d14283-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://45.115.89.123:46753/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625813, "uuid": "e4e9ea76-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.55.130.142:57988/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625813, "uuid": "e4ec76bb-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.12.21.220:43924/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625814, "uuid": "e512647b-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.77.42.117:34590/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625814, "uuid": "e517451a-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://102.97.197.150:53671/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625814, "uuid": "e51aec58-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://102.97.134.184:48772/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625814, "uuid": "e51af204-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://102.97.69.163:58049/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625814, "uuid": "e5308efb-2231-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://45.64.226.171:54069/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745625861, "uuid": "015bc738-2232-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.81.70:34548/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626025, "uuid": "6357ab25-2232-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.224.188.111:55596/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626085, "uuid": "86beed9e-2232-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.209.28:45300/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626207, "uuid": "cf670f9b-2232-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.85.85.19:42806/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626228, "uuid": "dbfd8797-2232-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.221.50.25:43648/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626445, "uuid": "5dbaa3c6-2233-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.226.90.190:41196/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626565, "uuid": "a4f21e61-2233-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.247.216.49:54882/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626684, "uuid": "ebe07ea5-2233-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://qeqek.press/", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626685, "uuid": "ecc12379-2233-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://223.13.93.255:52268/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626773, "uuid": "20fa7ee4-2234-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://72.10.10.146:60195/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626807, "uuid": "357cd1df-2234-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://120.61.65.9:33436/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626867, "uuid": "5910a31e-2234-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.211.154.224:42078/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745626925, "uuid": "7bb61b4b-2234-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://116.138.185.75:45400/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627106, "uuid": "e75dbe05-2234-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.54.234.178:44142/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627165, "uuid": "0ac6a9ec-2235-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.141.36.191:54933/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627225, "uuid": "2e57d1e9-2235-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://223.13.81.29:42166/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627466, "uuid": "be054d52-2235-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.221.50.25:43648/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627526, "uuid": "e181bbec-2235-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.200.84.115:57781/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627823, "uuid": "930cbb15-2236-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://77.247.88.79:37940/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745627853, "uuid": "a463d73c-2236-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.0.192:47820/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628185, "uuid": "6ac8a7e2-2237-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://120.61.65.9:33436/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628245, "uuid": "8e544f37-2237-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.211.154.224:42078/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628252, "uuid": "92634ad4-2237-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://72.10.10.146:60195/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628365, "uuid": "d6163ec3-2237-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.54.234.178:44142/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628426, "uuid": "fa364f8d-2237-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.153.129.47:54115/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628426, "uuid": "fa56f96b-2237-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.61.123.215:48501/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628441, "uuid": "0333b524-2238-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.245.3.249:43009/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628486, "uuid": "1dd0b148-2238-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.121.78.102:37431/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628546, "uuid": "41f1934c-2238-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.0.51:37252/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745628732, "uuid": "b0d35784-2238-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/pv4wds4y3x.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745629085, "uuid": "8337c692-2239-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://111.35.78.2:51491/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745629145, "uuid": "a68f5491-2239-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.200.84.115:57781/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745629324, "uuid": "1178b380-223a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://77.247.88.79:37940/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745629865, "uuid": "53c52216-223b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.61.123.215:48501/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745629865, "uuid": "53e33503-223b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.121.78.102:37431/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630045, "uuid": "bf05e4ad-223b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://111.35.78.2:51491/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630166, "uuid": "07442a55-223c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.3.216.80:52302/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630286, "uuid": "4ef3769b-223c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://120.28.160.78:33685/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630345, "uuid": "71f52331-223c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://45.176.101.111:51563/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630626, "uuid": "19c8072b-223d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.221.253.219:45758/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630734, "uuid": "59d41586-223d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.145.223:54462/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630766, "uuid": "6cc8b7cc-223d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.0.107.168:51544/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630839, "uuid": "986c7d09-223d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.241.94.227:32989/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745630944, "uuid": "d73f2b5a-223d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.153.129.47:54115/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745631333, "uuid": "bec1eb4b-223e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.81.70:34548/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745631726, "uuid": "a8e528d8-223f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.226.72.238:60184/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745631792, "uuid": "d062598e-223f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.221.253.219:45758/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632145, "uuid": "a335e52b-2240-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.157.252.198:47654/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632325, "uuid": "0e5aa74e-2241-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/zeoeviquag.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632343, "uuid": "1937b8d0-2241-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.45.112:52897/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632385, "uuid": "31ca76e5-2241-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.206.181.40:41493/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632445, "uuid": "55af06b9-2241-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.0.107.168:51544/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632506, "uuid": "7a07a24a-2241-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://111.178.121.26:45199/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632686, "uuid": "e52cf1a4-2241-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.189.169.175:35002/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632746, "uuid": "0909706d-2242-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.184.252.138:53024/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745632985, "uuid": "9798aa54-2242-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.89.6.92:58801/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633289, "uuid": "4cad72d5-2243-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.45.112:52897/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633705, "uuid": "44fae404-2244-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.157.252.198:47654/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633766, "uuid": "68ebbb8b-2244-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.226.72.238:60184/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633843, "uuid": "97122095-2244-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.241.92.113:55758/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633912, "uuid": "c06d373b-2244-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.206.181.40:41493/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633946, "uuid": "d440886e-2244-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.155.171.89:33908/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745633964, "uuid": "df3cb287-2244-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.204.98.223:44805/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745634006, "uuid": "f836e06a-2244-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.163.158.253:36090/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745634245, "uuid": "869dc836-2245-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.89.6.92:58801/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745634306, "uuid": "aaf301db-2245-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.184.252.138:53024/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745634545, "uuid": "393ec15d-2246-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.55.208.61:42160/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745634680, "uuid": "89e2be47-2246-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.26.209.164:50650/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745634934, "uuid": "2158722e-2247-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.189.169.175:35002/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635025, "uuid": "573b378d-2247-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://200.6.91.47:54908/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635025, "uuid": "577b5d19-2247-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.204.98.223:44805/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635110, "uuid": "89ef03bb-2247-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.213.118.254:47546/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635445, "uuid": "51c274bc-2248-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.163.158.253:36090/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635453, "uuid": "567f7886-2248-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.23.239.105:49186/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635565, "uuid": "99489ec0-2248-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.155.171.89:33908/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635628, "uuid": "bee63a84-2248-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.113.47.215:59533/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635745, "uuid": "04d4a8ca-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.196.248.14:54813/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635745, "uuid": "04e3d1aa-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.98.127.117:56425/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635806, "uuid": "28d19f86-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.241.94.227:32989/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635925, "uuid": "7008b9d5-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/au28vdsv27.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635986, "uuid": "944bf90f-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.81.158:59088/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745635986, "uuid": "9464e6b6-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.205.89.137:53369/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636044, "uuid": "b711f5a3-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.234.233.224:54586/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636045, "uuid": "b7589edb-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.110.162:51530/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636045, "uuid": "b7a24ec9-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.245.208.139:55737/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636164, "uuid": "fe902ca0-2249-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.55.208.61:42160/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636225, "uuid": "22f282cd-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.216.27.0:44872/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636406, "uuid": "8ea8964b-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.209.28:45300/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636465, "uuid": "b18bcf7c-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://78.92.32.218:2913/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636466, "uuid": "b240a923-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.212.8.28:42203/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636466, "uuid": "b24fe898-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.208.90.87:11992/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636466, "uuid": "b2795a37-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://81.23.169.236:64004/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636468, "uuid": "b3ccc397-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.173.77.80:59009/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636468, "uuid": "b3dfcaf5-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.163.100.113:57583/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636468, "uuid": "b3e3ee11-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.221.74.231:22599/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b40d02ed-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://114.239.58.58:20028/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b4343441-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.9.165.217:1375/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b4343adf-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.221.26.233:17667/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b435832d-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.221.85.183:32577/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b435b1fa-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://1.70.11.188:8268/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b437228e-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://106.41.83.176:12677/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b439c95c-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://58.47.104.162:12537/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b449eba6-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://49.86.107.30:5520/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b44b4329-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://183.138.193.202:10541/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b44f5322-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.26.55.93:52690/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b4504eac-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.161.2.230:48883/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b45123c4-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.219.55.105:58545/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b45e699a-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.221.36.30:57319/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b4615a50-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.25.132.79:47553/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b462ea23-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://110.182.113.52:26428/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b4647ce1-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.26.179.67:27019/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b466031e-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://110.183.19.123:56065/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b4671fb5-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.9.164.88:58023/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b4679604-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://2.179.46.191:63177/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b4722c54-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.26.60.54:10661/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b47ba11e-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://110.183.24.231:57725/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b47c3916-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.115.84.198:30988/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b47c3cf3-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://223.15.10.146:21104/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636469, "uuid": "b47e3608-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://114.239.150.215:21959/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636470, "uuid": "b48e92f3-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.185.16.73:53461/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636470, "uuid": "b49841a3-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://121.237.76.217:53113/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636470, "uuid": "b49d961e-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.116.223.45:4891/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636470, "uuid": "b49fc57c-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.175.70.158:65370/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636470, "uuid": "b4a6db44-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://121.237.166.129:54445/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636470, "uuid": "b4a8009b-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://114.228.239.24:3513/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636470, "uuid": "b4bb4f6c-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.175.103.146:16948/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636470, "uuid": "b4c986b2-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.19.217.10:12952/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636471, "uuid": "b55d1d46-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.116.255.52:3063/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636472, "uuid": "b5df53ae-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://186.159.15.2:49130/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636525, "uuid": "d5afaaa6-224a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.213.118.254:47546/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636645, "uuid": "1d363268-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.196.128.35:36614/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636647, "uuid": "1e3239c4-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://106.41.83.27:42113/Mozi.m", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636653, "uuid": "21d65213-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://139.5.10.252:37815/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636655, "uuid": "22f75cb4-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.213.254.136:36269/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636656, "uuid": "23779e1b-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.207.125.155:49505/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636672, "uuid": "2d71a0f0-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://45.164.177.175:11386/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636672, "uuid": "2d76287b-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.107.1.186:39332/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636673, "uuid": "2daf9e98-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://102.97.209.61:50864/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636673, "uuid": "2db187be-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://102.97.202.162:36847/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636673, "uuid": "2de51812-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.115.183.125:55718/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636673, "uuid": "2de93788-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.228.238.149:40266/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745636946, "uuid": "d0ca08fb-224b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.205.89.137:53369/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637125, "uuid": "3b343661-224c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.98.127.117:56425/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637306, "uuid": "a74f091b-224c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.247.186.43:53112/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637307, "uuid": "a788e7c5-224c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.216.27.0:44872/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637307, "uuid": "a7f112e4-224c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://114.216.92.223:61417/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637485, "uuid": "1208aeb4-224d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.81.158:59088/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637665, "uuid": "7d0826e2-224d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.138.79.20:58542/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637665, "uuid": "7d32909c-224d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.113.47.215:59533/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637666, "uuid": "7dc01f64-224d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://58.245.3.201:60517/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745637968, "uuid": "31af918d-224e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.89.192:59883/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745638265, "uuid": "e2b72d16-224e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.134.132.196:33745/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745638385, "uuid": "2a463702-224f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.146.78:43630/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745638565, "uuid": "95a4262e-224f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.235.62:54789/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745638626, "uuid": "b9d375c2-224f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.247.186.43:53112/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745638685, "uuid": "dcd8fafb-224f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.214.235.142:52638/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639105, "uuid": "d7a7c9ea-2250-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://58.245.3.201:60517/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639165, "uuid": "fb1714da-2250-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.141.78.34:60822/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639345, "uuid": "66662694-2251-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.254.96.142:56796/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639345, "uuid": "6681f749-2251-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.84.202:51489/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639552, "uuid": "e21ac898-2251-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/0i1otdmbc9.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639566, "uuid": "ea5d46f3-2251-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.214.227.204:37248/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639706, "uuid": "3d797725-2252-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.134.132.196:33745/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745639765, "uuid": "60c96d5e-2252-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.58.123.255:30831/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640125, "uuid": "379c15d8-2253-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.235.62:54789/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640246, "uuid": "7f319848-2253-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://110.180.139.3:40012/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640606, "uuid": "55dc2b34-2254-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.19.105:59198/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640725, "uuid": "9cd2d226-2254-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.126.119.255:51815/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640740, "uuid": "a5e03a14-2254-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.225.136.176:38152/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640905, "uuid": "084c055b-2255-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.141.78.34:60822/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745640906, "uuid": "092262a0-2255-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.84.202:51489/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641085, "uuid": "7376f354-2255-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.254.96.142:56796/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641205, "uuid": "bb353c3b-2255-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.138.79.20:58542/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641206, "uuid": "bb7de97e-2255-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.190.195.192:44446/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641210, "uuid": "be2c0fa5-2255-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://120.61.65.254:53797/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641268, "uuid": "e08d2838-2255-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.89.69.204:39402/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641625, "uuid": "b5b03262-2256-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://110.180.139.3:40012/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745641985, "uuid": "8bca1ace-2257-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://83.219.1.198:47584/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642106, "uuid": "d455fae7-2257-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.157.215.132:51561/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642165, "uuid": "f778ef02-2257-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.144.180.134:45349/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642224, "uuid": "1a852f58-2258-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.225.136.176:38152/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642240, "uuid": "24031aa3-2258-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.19.105:59198/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642465, "uuid": "aa4749e7-2258-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.146.32.8:58445/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642526, "uuid": "ce7724b8-2258-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.89.69.204:39402/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642705, "uuid": "394f654a-2259-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.190.195.192:44446/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745642889, "uuid": "a6c28909-2259-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.50.233.112:34692/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643127, "uuid": "34777d3c-225a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/evytu3ne24.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643244, "uuid": "7a7d1cc4-225a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.157.215.132:51561/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643430, "uuid": "e9035ea4-225a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://218.61.230.116:51901/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643608, "uuid": "531eca70-225b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.155.208.107:45359/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643672, "uuid": "793edf00-225b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.86.28.47:60131/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745643672, "uuid": "7963cbd2-225b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.242.16.20:60144/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745644026, "uuid": "4c4c47d2-225c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.84.205:54785/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745644026, "uuid": "4c53c3b9-225c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.203.68.33:46592/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745644162, "uuid": "9d82b030-225c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.90.21:51934/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745644444, "uuid": "45d3e07a-225d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.50.233.112:34692/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745644582, "uuid": "97ce924b-225d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.7.119:54654/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645044, "uuid": "ab7823f3-225e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://218.61.230.116:51901/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645707, "uuid": "36584a40-2260-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.97.254.198:32828/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645767, "uuid": "5a20c0b9-2260-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.179.230.225:55125/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745645953, "uuid": "c9608b9a-2260-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.3.132.188:55145/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646065, "uuid": "0bb26284-2261-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.52.38.220:56439/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646069, "uuid": "0dfe10b3-2261-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.182.72.213:53539/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646246, "uuid": "777afbdb-2261-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.95.85.199:33027/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646486, "uuid": "069bba02-2262-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.203.68.33:46592/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646684, "uuid": "7cbf9a8b-2262-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.95.119:42805/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646725, "uuid": "95770673-2262-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.93.183.188:60812/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646726, "uuid": "95cc0485-2262-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/fsv09dm869.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745646785, "uuid": "b90efd92-2262-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.121.136:41127/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647026, "uuid": "48c067b1-2263-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.33.126:60479/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647145, "uuid": "8f74c88d-2263-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.179.230.225:55125/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647385, "uuid": "1ede5595-2264-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.182.72.213:53539/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647445, "uuid": "42a505aa-2264-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.83.142:47029/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647806, "uuid": "19cf5972-2265-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.95.85.199:33027/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647926, "uuid": "615009a5-2265-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://furoroargub.fly.storage.tigris.dev/blinglyfunrukv4.html", "Tag": [ { "name": "FakeCaptcha", "colour": "#d08580", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647985, "uuid": "84224539-2265-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.180.42.218:46785/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647986, "uuid": "84d2e03e-2265-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://223.15.24.17:55768/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745647986, "uuid": "84f27061-2265-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.33.126:60479/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648165, "uuid": "efcfd16d-2265-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.121.136:41127/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648225, "uuid": "134b78af-2266-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://120.28.138.13:58331/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648346, "uuid": "5b718e24-2266-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.44.90:33407/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648528, "uuid": "c7b84c8d-2266-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://70.40.36.137:52922/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648766, "uuid": "55d9bcf1-2267-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.174.89.185:50321/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648772, "uuid": "5991e9ea-2267-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.83.142:47029/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745648885, "uuid": "9cb8eab5-2267-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.97.254.198:32828/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649126, "uuid": "2c5dd325-2268-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.93.183.188:60812/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649185, "uuid": "4f6b53a9-2268-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://223.15.24.17:55768/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649430, "uuid": "e1ccc5b7-2268-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.148.159.74:53465/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649611, "uuid": "4d93049c-2269-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.178.152.105:54254/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649665, "uuid": "6de867e8-2269-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.96.138.24:57347/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745649726, "uuid": "91eeda09-2269-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://140.255.137.224:39959/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650025, "uuid": "448093ff-226a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://70.40.36.137:52922/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650326, "uuid": "f7c3909d-226a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/xi4sa8ij90.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650354, "uuid": "082bd2b3-226b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.192.233.133:54853/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650392, "uuid": "1f0b3f18-226b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.210.214.134:49929/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650685, "uuid": "cda7e400-226b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.227.197.252:60255/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650685, "uuid": "cdaefc8d-226b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.140.160.252:46696/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650686, "uuid": "ce1afa78-226b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.26.89.136:40891/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650746, "uuid": "f1d93fc6-226b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://110.183.21.3:35687/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650835, "uuid": "26fcd6cf-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.254.100.105:47102/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650863, "uuid": "37fa470a-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://80.104.17.226:62042/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650864, "uuid": "380eec5c-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.173.78.144:59009/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650864, "uuid": "3817e629-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://223.12.189.146:20655/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650864, "uuid": "381c16d3-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.221.78.18:45040/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650864, "uuid": "381d4416-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.221.24.63:45698/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650864, "uuid": "385683d5-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.246.90.15:13883/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650864, "uuid": "38657c9c-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.115.70.35:32472/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650866, "uuid": "39b6cde7-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.13.1.191:10631/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650866, "uuid": "39cc0d09-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://1.70.165.252:38362/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650867, "uuid": "39d37d29-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://46.42.86.116:31914/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650868, "uuid": "3a770680-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://78.38.90.177:16513/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650893, "uuid": "49aada8f-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://124.234.239.233:48439/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650893, "uuid": "49abe26a-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://110.182.224.145:38042/.i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745650927, "uuid": "5d9e5ff7-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.49.6.119:53486/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745651105, "uuid": "c815527a-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.148.159.74:53465/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745651106, "uuid": "c849b82c-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.121.47:38491/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745651106, "uuid": "c8738b79-226c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://125.46.202.113:55789/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745651345, "uuid": "56ec97da-226d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://110.183.21.3:35687/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745651585, "uuid": "e6315352-226d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.236.106.181:54876/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745651766, "uuid": "521fe619-226e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.225.200.167:42841/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745651945, "uuid": "bceb9202-226e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.210.214.134:49929/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652065, "uuid": "045c6679-226f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.94.65.88:50264/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652185, "uuid": "4bf69232-226f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.26.89.136:40891/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652307, "uuid": "942127f2-226f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.254.100.105:47102/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652320, "uuid": "9c4ebde6-226f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.213.251.61:51428/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652365, "uuid": "b71a2f66-226f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://221.200.107.85:52301/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652485, "uuid": "fe6230af-226f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.134.162.113:42909/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652545, "uuid": "22326179-2270-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://125.46.202.113:55789/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652753, "uuid": "9e61a46f-2270-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.178.152.105:54254/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652905, "uuid": "f8c33ac7-2270-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.126.119.255:51815/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745652964, "uuid": "1c4d7a22-2271-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://1.70.22.187:39983/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745653266, "uuid": "cfecdfed-2271-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.236.106.181:54876/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745653325, "uuid": "f312f24d-2271-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.134.162.113:42909/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745653326, "uuid": "f381f33a-2271-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.26.181.222:42095/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745653386, "uuid": "17682489-2272-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://221.200.107.85:52301/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745653925, "uuid": "58a3f26d-2273-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/6i4td0u1wh.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654105, "uuid": "c45cfe50-2273-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.92.193:52143/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654319, "uuid": "43627d26-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.221.253.237:32802/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654345, "uuid": "52ee10c4-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.183.127.231:59100/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654443, "uuid": "8d86efc5-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.159.161.211:56329/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654466, "uuid": "9b7dcdd5-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://109.87.136.70:58451/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654467, "uuid": "9bbd1eae-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://149.241.40.177:25590/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654467, "uuid": "9be1da72-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://80.191.100.167:42434/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654467, "uuid": "9be610f2-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://89.114.55.217:29209/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654467, "uuid": "9c2112dc-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://86.84.3.30:18189/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654468, "uuid": "9c29a2d7-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://95.83.158.46:52175/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654468, "uuid": "9c2d5968-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://95.165.71.247:14513/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654468, "uuid": "9c5bbed8-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.117.34.254:20234/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654468, "uuid": "9c5df579-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://122.193.52.24:22882/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654468, "uuid": "9c6830ef-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://221.156.229.64:54273/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654468, "uuid": "9c7a09d7-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://91.64.66.59:35327/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654468, "uuid": "9cb48666-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://2.179.184.17:55147/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654468, "uuid": "9cbd03ba-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://118.233.240.6:20511/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654469, "uuid": "9cda0c6f-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://178.160.216.125:52826/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654469, "uuid": "9cf4c731-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://220.130.51.182:31983/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654469, "uuid": "9d3da245-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://122.97.155.222:15974/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654469, "uuid": "9d47902a-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://68.33.50.184:5365/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654469, "uuid": "9d4a0674-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.218.160.96:3208/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654470, "uuid": "9d7602b1-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://121.171.162.63:17945/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654470, "uuid": "9d79e05e-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.240.130.119:28866/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654470, "uuid": "9d8a8890-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.250.50.240:29180/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654470, "uuid": "9ded4a68-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://203.203.85.226:36291/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654470, "uuid": "9dedf1fc-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://121.181.234.240:59928/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654471, "uuid": "9e52b90d-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://203.203.85.98:33553/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654471, "uuid": "9e5f5672-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.252.35.90:60127/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654471, "uuid": "9e849786-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.236.20.49:60120/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654472, "uuid": "9e99a0a5-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.237.80.140:60126/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654472, "uuid": "9e9c0bc2-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://8.210.245.58:60143/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654472, "uuid": "9eab0357-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.236.243.143:60102/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654472, "uuid": "9eb047f6-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.86.176.50:60145/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654472, "uuid": "9ec39fd5-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.237.86.186:60147/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654473, "uuid": "9f78a0e6-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://122.193.52.227:26979/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654474, "uuid": "9fe4de5c-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://153.37.252.29:4440/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654474, "uuid": "a00f905e-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://202.55.82.250:60140/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654474, "uuid": "a0409e7a-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.57.166.174:60118/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654475, "uuid": "a0db857d-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://8.218.125.202:60147/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654479, "uuid": "a3413bd3-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://8.217.21.175:60109/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654481, "uuid": "a42146df-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://8.218.240.255:60114/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654493, "uuid": "ab14a6db-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://101.126.16.216:60137/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654502, "uuid": "b0854830-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.76.211.88:60131/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654585, "uuid": "e230d751-2274-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.84.159.141:50097/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654644, "uuid": "0531c830-2275-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.225.200.167:42841/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654645, "uuid": "060e674b-2275-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.93.190.255:45671/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654705, "uuid": "29ccfce4-2275-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.26.181.222:42095/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745654884, "uuid": "944618b6-2275-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.91.3:60018/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655066, "uuid": "0126fafc-2276-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.134.121:48986/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655069, "uuid": "0263360b-2276-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.121.47:38491/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655306, "uuid": "900ef26f-2276-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.191.36.167:53103/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655666, "uuid": "666a8a12-2277-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.165.87.46:44848/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655666, "uuid": "669718e8-2277-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.22.86.230:53026/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655966, "uuid": "199ca829-2278-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.221.253.237:32802/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745655984, "uuid": "23cffe65-2278-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.235.114.186:46512/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656026, "uuid": "3d5cab06-2278-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://190.103.67.54:43577/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656143, "uuid": "83182929-2278-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://cabym.press/", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656266, "uuid": "cc178ac9-2278-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.52.38.220:56439/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656385, "uuid": "1312e491-2279-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.134.121:48986/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656686, "uuid": "c6a68ae0-2279-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.91.3:60018/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656745, "uuid": "e9eaf31a-2279-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.191.36.167:53103/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745656865, "uuid": "311662f2-227a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.226.65.77:41487/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657166, "uuid": "e472168a-227a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.224.7.198:38081/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657360, "uuid": "58803d62-227b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.165.87.46:44848/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657406, "uuid": "736ecf55-227b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.235.114.186:46512/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657407, "uuid": "7483b6da-227b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://190.103.67.54:43577/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657526, "uuid": "bb3268e7-227b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/lujh0omd8v.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657765, "uuid": "49b6506c-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.22.86.230:53026/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745657886, "uuid": "9175d5e6-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://118.69.225.219:33101/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658066, "uuid": "fcc615f6-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://89.114.31.204:23066/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658066, "uuid": "fcfa9b71-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://46.39.251.94:1238/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658066, "uuid": "fd0046b1-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://204.147.190.13:25279/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658066, "uuid": "fd0708e4-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://85.95.183.178:23157/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658066, "uuid": "fd338a35-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://87.221.208.152:62383/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658066, "uuid": "fd41117c-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://85.95.186.231:31952/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658067, "uuid": "fd5b4786-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://50.47.94.50:52181/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658067, "uuid": "fd7ac2e9-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://192.3.92.87:60104/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658067, "uuid": "fdb96d68-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://71.239.8.241:14603/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658067, "uuid": "fdbb1615-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://70.71.138.18:32251/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658067, "uuid": "fdda9a86-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://220.133.18.37:46406/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658067, "uuid": "fde4f15f-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.135.123.146:8465/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658068, "uuid": "fe69b333-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.126.225.205:26678/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658070, "uuid": "ff33a89b-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.83.124.121:60105/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658070, "uuid": "ff33ccb2-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.239.192.87:60143/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658071, "uuid": "ffc70138-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://8.218.169.20:60120/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658071, "uuid": "ffde3255-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://8.133.3.227:60141/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658071, "uuid": "fff2372c-227c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.76.210.137:60115/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658071, "uuid": "00288409-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://36.134.194.19:60147/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658074, "uuid": "01aa9de5-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.239.243.70:60112/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658081, "uuid": "05bc307c-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.239.193.183:60113/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658128, "uuid": "21ff62e2-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.198.196.94:46232/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658186, "uuid": "44556a0f-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.63.13.93:47775/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658186, "uuid": "447e9927-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.226.71.67:54886/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658186, "uuid": "449dd6cb-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.226.65.77:41487/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658187, "uuid": "44f7b9ab-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.95.119:42805/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658187, "uuid": "451e0c7a-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.221.14.116:46533/Mozi.m", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658189, "uuid": "4630eac2-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://197.246.74.253:38575/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658192, "uuid": "481b1efe-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.207.125.37:48846/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658192, "uuid": "48272def-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.207.124.237:54637/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658205, "uuid": "4fb7666f-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.203.72.174:48821/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658213, "uuid": "54def3ee-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.216.27.149:59643/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658214, "uuid": "555136a0-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.48.3.134:36509/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658214, "uuid": "5557f1ec-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.119.57.194:47616/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658218, "uuid": "57ab1e9b-227d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.207.125.233:50067/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658546, "uuid": "1af1b39a-227e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.224.7.198:38081/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658546, "uuid": "1b0e5e25-227e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://116.139.129.68:48686/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658665, "uuid": "621602a3-227e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.23.137.174:50303/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658845, "uuid": "cd80671b-227e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.53.243.108:42908/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745658907, "uuid": "f228094d-227e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://122.190.26.26:55959/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659025, "uuid": "38bfbca5-227f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://118.69.225.219:33101/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659026, "uuid": "394d8148-227f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.179.72.209:48781/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659208, "uuid": "a5f3c804-227f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://becel.press/", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659266, "uuid": "c83e3cc5-227f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.35.212:54995/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659325, "uuid": "eb73004f-227f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.244.66.32:49438/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659514, "uuid": "5be4e8f0-2280-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.198.196.94:46232/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745659988, "uuid": "76afe24b-2281-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://58.115.121.85:59960/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660105, "uuid": "bcab8777-2281-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.179.72.209:48781/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660165, "uuid": "e02bc828-2281-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.53.243.108:42908/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660525, "uuid": "b6ff2a45-2282-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.88.35.212:54995/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660648, "uuid": "002c95b7-2283-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://163.142.86.2:54002/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745660945, "uuid": "b1461a4f-2283-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.244.66.32:49438/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661125, "uuid": "1c8e487f-2284-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/gcjjkz8n18.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661365, "uuid": "ab52acb7-2284-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://125.46.143.94:39473/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661365, "uuid": "ab626620-2284-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.1.226.71:46749/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661485, "uuid": "f2b50fd3-2284-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.235.157.226:44177/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661485, "uuid": "f2be811c-2284-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.97.251.210:54904/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661727, "uuid": "82ee6fa0-2285-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://116.138.160.216:40602/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745661739, "uuid": "8a986630-2285-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.205.85.148:49629/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662145, "uuid": "7c27c81a-2286-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://163.142.86.2:54002/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662205, "uuid": "9ffd3fca-2286-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.235.157.226:44177/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662327, "uuid": "e8ab9ab6-2286-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://122.190.26.26:55959/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662386, "uuid": "0c3aae6d-2287-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.95.80.191:38004/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662565, "uuid": "7689fc2e-2287-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://125.46.143.94:39473/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662747, "uuid": "e331bea5-2287-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://67.214.245.59:34325/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662806, "uuid": "068f4277-2288-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.53.198.203:34252/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745662985, "uuid": "71181b52-2288-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.198.186.100:47709/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663133, "uuid": "c973c190-2288-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://116.138.160.216:40602/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663232, "uuid": "045e1734-2289-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.205.85.148:49629/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663346, "uuid": "47dfcb86-2289-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://125.43.91.203:43280/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663406, "uuid": "6bf5f088-2289-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://46.121.25.2:24550/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663705, "uuid": "1e52ad9c-228a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.95.80.191:38004/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745663706, "uuid": "1e756e9f-228a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.55.48.223:33785/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664188, "uuid": "3dc95ae0-228b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://119.114.61.100:60030/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664245, "uuid": "60346753-228b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://67.214.245.59:34325/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664306, "uuid": "84622a06-228b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.123.199:58188/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664366, "uuid": "a839499d-228b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://111.38.123.165:35888/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664546, "uuid": "137aee0b-228c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.213.247.229:36457/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664665, "uuid": "5a1e51ee-228c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.53.198.203:34252/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664725, "uuid": "7e44b5ba-228c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/myq92fibvl.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745664726, "uuid": "7e6928e5-228c-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.198.186.100:47709/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665025, "uuid": "30f7ece2-228d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.55.48.223:33785/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665085, "uuid": "54710d0b-228d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.191.20.187:42257/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665265, "uuid": "bfc19028-228d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.123.199:58188/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665387, "uuid": "08752682-228e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.200.179.150:35649/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745665987, "uuid": "6e567acc-228f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://111.38.123.165:35888/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745666406, "uuid": "68066f13-2290-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.213.247.229:36457/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745666646, "uuid": "f7125574-2290-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.38.93.22:54316/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745666885, "uuid": "859df272-2291-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.191.20.187:42257/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745667022, "uuid": "d727fdae-2291-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.3.143.118:44526/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745667143, "uuid": "1f56c891-2292-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.206.27.96:51237/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745667426, "uuid": "c7d735ac-2292-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://gameupdate-endpoint.com/api/getFile?fn=123.hta", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745667528, "uuid": "051d1e09-2293-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.221.173.251:42118/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745667725, "uuid": "7a491feb-2293-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.179.232.5:48360/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745667800, "uuid": "a6d26f39-2293-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://119.114.61.100:60030/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745667907, "uuid": "e69fc537-2293-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.244.75.9:50970/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668026, "uuid": "2d9b4d60-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.3.143.118:44526/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668085, "uuid": "50d6712b-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://46.227.184.211:34345/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668086, "uuid": "5127b007-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://203.177.237.148:57683/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668144, "uuid": "742da228-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://biwiv.press/", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668145, "uuid": "748179d8-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.82.214:57430/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668145, "uuid": "74ba3845-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.48.51.225:42214/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668206, "uuid": "98f031a9-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.12.44.46:55689/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668266, "uuid": "bcd9f6f8-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://14.188.142.17:47674/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668284, "uuid": "c765ba48-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.33.58:52897/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668325, "uuid": "dfda7693-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/dlixkvd5ym.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668342, "uuid": "ea3e2cd8-2294-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.85.230:52075/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668692, "uuid": "bab7e9be-2295-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.206.27.96:51237/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668926, "uuid": "45db5be7-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.48.51.225:42214/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668927, "uuid": "4668ee9e-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.93.31.125:38611/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745668989, "uuid": "6bafaf53-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.87.152:48573/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669002, "uuid": "7330c937-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.206.28.200:35306/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669013, "uuid": "7a4081e3-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://102.98.68.74:45923/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669013, "uuid": "7a408386-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://192.10.171.88:44701/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669014, "uuid": "7a8ed0ef-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.158.170.115:46480/Mozi.m", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669046, "uuid": "8d71d79a-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://47.62.162.43:38736/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669105, "uuid": "b0ed96dd-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.244.75.9:50970/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669165, "uuid": "d451a6ad-2296-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.155.208.107:45359/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669340, "uuid": "3cf72672-2297-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.22.28:60663/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669346, "uuid": "407978fa-2297-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://1.69.254.154:36810/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669586, "uuid": "cf7336dd-2297-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.115.165.164:61440/.i", "Tag": [ { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669646, "uuid": "f34703f3-2297-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://203.177.237.148:57683/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669765, "uuid": "3a21cb1f-2298-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.12.44.46:55689/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669826, "uuid": "5e774357-2298-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://46.227.184.211:34345/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669826, "uuid": "5e9d7022-2298-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.217.202.162:50127/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745669945, "uuid": "a5a2d35a-2298-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://14.188.142.17:47674/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670305, "uuid": "7c1b079f-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://125.43.119.79:34409/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670314, "uuid": "817db882-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://124.234.245.74:33343/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670424, "uuid": "c2b9f921-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://88.214.48.26/tpnl98/upx.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670424, "uuid": "c2babf71-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://88.214.48.26/tpnl98/gt.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670424, "uuid": "c2d1da23-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://88.214.48.26/tpnl98/nums.vbs", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670424, "uuid": "c2d1f1e0-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://88.214.48.26/tpnl98/pixel.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670427, "uuid": "c4d4d477-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.179.232.5:48360/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "c56a26a4-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://88.214.48.26/tpnl98/pik.ps1", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "c59cad98-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.241/0Bdh3sQpbD/Plugins/clip.dll", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "c59d5a0e-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.163/Su8kud7i/Plugins/clip64.dll", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670428, "uuid": "c59e6657-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.163/Su8kud7i/Plugins/clip.dll", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "c5f2b412-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.162/files/1401316133/FQdia1P.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "c5fa3da1-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.241/0Bdh3sQpbD/Plugins/cred.dll", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "c5fda608-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://88.214.48.26/tpnl98/ret.exe", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "c5fde190-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://80.64.16.35/fgg.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "c61cca84-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.241/0Bdh3sQpbD/Plugins/cred64.dll", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "c62175ed-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.163/Su8kud7i/Plugins/cred64.dll", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "c62beb42-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.163/Su8kud7i/Plugins/cred.dll", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670429, "uuid": "c63f9585-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.162/files/teamex_support/random.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670430, "uuid": "c6503f16-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.162/testdef/random.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670430, "uuid": "c6602030-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://88.214.48.26/tpnl98/op.exe", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670435, "uuid": "c9c166b5-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://banxo-av.app/banxo-maj.apk", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670453, "uuid": "d45dc585-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.70/zgrnf/gt.exe", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670485, "uuid": "e71d4e0c-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.241/0Bdh3sQpbD/Plugins/clip64.dll", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670485, "uuid": "e759c476-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://88.214.48.26/tpnl98/namen.ps1", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670485, "uuid": "e770d889-2299-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.39.17.70/zgrnf/namen.ps1", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670607, "uuid": "3044e81d-229a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://farav.press/", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670801, "uuid": "a39b1f4b-229a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.206.64.201:49107/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670906, "uuid": "e25eb83f-229a-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.226.71.67:54886/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670972, "uuid": "09a5dd65-229b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.205.165.153:46180/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745670993, "uuid": "160130b0-229b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.209.22.28:60663/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745671145, "uuid": "70aca214-229b-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.217.202.162:50127/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745671872, "uuid": "222ba9a8-229d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.211.208.241:40719/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745671924, "uuid": "412583dd-229d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "https://u1.pridefulamaretto.digital/zo4bjhbisr.bip", "Tag": [ { "name": "ClearFake", "colour": "#c772c8", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672065, "uuid": "94d5da60-229d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.217.45.255:35117/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672106, "uuid": "ad652602-229d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.206.64.201:49107/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672240, "uuid": "fd33c03f-229d-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.217.87.211:41933/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672464, "uuid": "829e07af-229e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.77.240.231/w.sh", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672466, "uuid": "843306f5-229e-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://171.37.60.15:50947/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672711, "uuid": "1601b2b3-229f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.205.89.157:35484/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672825, "uuid": "59cfe534-229f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.226.73.75:59166/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745672885, "uuid": "7dc8ac5b-229f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://177.22.122.98:60845/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673007, "uuid": "c6493e16-229f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.215.129.142:46913/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673065, "uuid": "e904b91d-229f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://111.127.227.119:34016/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673065, "uuid": "e9423e2e-229f-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.230.215.221:60033/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673306, "uuid": "78b5d753-22a0-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.141.175:35158/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673609, "uuid": "2d398eac-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.217.45.255:35117/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "baaca77d-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_ppc", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "baae2935-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_m68k", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "baaeaf8a-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_mpsl", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "babcdb8d-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_sh4", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "bac34d08-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_arm6", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "bace24f9-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_x86", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "bad24602-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_arm5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673846, "uuid": "bad8ba23-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://125.132.95.187:49448/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673906, "uuid": "de303df5-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_arm7", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673906, "uuid": "de3bdc58-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_mips", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673906, "uuid": "de442e3c-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://111.127.227.119:34016/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673907, "uuid": "debc7ea9-22a1-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.217.87.211:41933/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673965, "uuid": "01ba8932-22a2-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_arm", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745673966, "uuid": "0216dd95-22a2-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://177.22.122.98:60845/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674025, "uuid": "253f6d39-22a2-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.58.237/main_x86_64", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "moobot", "colour": "#ca42ae", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674387, "uuid": "fd535641-22a2-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://twizthash.net/tdrp.exe", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674387, "uuid": "fd6110f7-22a2-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://twizthash.net/32.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674388, "uuid": "fdaff71d-22a2-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://twizthash.net/x.exe", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674389, "uuid": "fe200b3d-22a2-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.156.102.175:50678/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674389, "uuid": "fe33b247-22a2-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://twizthash.net/64.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674461, "uuid": "290b1754-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://117.215.129.142:46913/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674566, "uuid": "67b4d35c-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.98.116.183:35525/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674626, "uuid": "8b8a9185-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.230.215.221:60033/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674626, "uuid": "8bd4571a-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.3.140.163:40808/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "d27149e7-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqar5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "d29bc780-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqsh", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "d29c8363-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqar4", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "d2a004a1-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mq86", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "d2a3b8ce-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqspcr", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "d2abbaa6-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqms", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674745, "uuid": "d2bb5aea-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqppc", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674746, "uuid": "d3218ab8-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://160.187.146.122/debug.dbg", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674804, "uuid": "f5eaf1e9-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqm68k", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674804, "uuid": "f5eaf2e1-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqi586", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "f60c86ea-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqar6", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "f613b932-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqar7", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "f61a0efe-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.141.175:35158/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674805, "uuid": "f64cdd01-22a3-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mq.sh", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674863, "uuid": "18b8d64b-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//games/nino.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "1c293a4f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//dobre/processclass.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "1c67bd52-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/scheduledllama.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674869, "uuid": "1c7f1abe-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/kill.exe", "Tag": [ { "name": "Smoke Loader", "colour": "#e04b0e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1cb6116c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/taskhost.exe", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1cc4e6fb-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/anticheat.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1cdabdd2-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/CompleteStudio.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1ce01f00-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/newbundle2.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1d0ee376-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/newfile.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1d13c9aa-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Operation6572.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1d192d71-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/cudo.exe", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1d2c2fc8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/ZZZ.exe", "Tag": [ { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674870, "uuid": "1d32b97e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Survox.exe", "Tag": [ { "name": "NanoCore", "colour": "#d0f361", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "1d88227b-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/clsid.exe", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "1d882664-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/2.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "1d8cc2f2-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/5_625370800488186288", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "1dac6f5b-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/XM.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "1db5acdd-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/4434.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674871, "uuid": "1db970fa-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//steam/random.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674872, "uuid": "1e2b40ef-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Edge.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674872, "uuid": "1e3fa80e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/dccrypt.exe", "Tag": [ { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674873, "uuid": "1ea688fc-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/gawdth.exe", "Tag": [ { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "1f2498d1-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/major.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "1f30d7b5-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/gagagggagagag.exe", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674874, "uuid": "1faa00eb-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/DOC.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674875, "uuid": "1fb3eb04-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/rorukal.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674875, "uuid": "1fb7a898-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/neon.exe", "Tag": [ { "name": "DarkTortilla", "colour": "#98530E", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674875, "uuid": "201eadf7-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//nemo/herso.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674877, "uuid": "21298a03-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqml", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674879, "uuid": "225291cb-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Unit.exe", "Tag": [ { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674879, "uuid": "22529b30-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/GIFT-INFO.lMG.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674880, "uuid": "232cf935-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/univ.exe", "Tag": [ { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674882, "uuid": "2454965c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/out_test_sig.exe", "Tag": [ { "name": "MetaStealer", "colour": "#ebffe2", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674883, "uuid": "2479eded-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/buildred.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674883, "uuid": "248856e4-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/XClient_protected.exe", "Tag": [ { "name": "VenomRAT", "colour": "#31D98A", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674883, "uuid": "24c964ca-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/contorax.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674883, "uuid": "24db83b4-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/3546345.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "25d2ebae-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/bundle.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "25f1a023-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Amadey.exe", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674885, "uuid": "2606aed1-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/new1.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674886, "uuid": "264c1a75-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/lummetc.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674886, "uuid": "265d3822-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/GOLD.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674887, "uuid": "27167340-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/explorer.exe", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674887, "uuid": "271870b8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/build_2024-07-24_23-", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674887, "uuid": "271995af-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/T3.exe", "Tag": [ { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674887, "uuid": "2738b65c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Rage.exe", "Tag": [ { "name": "GuLoader", "colour": "#9937d3", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674888, "uuid": "279f10d8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/AnneSalt.exeav", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674888, "uuid": "27ffb703-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//dobre/acentric.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674889, "uuid": "280c2ffa-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/InfluencedNervous.exe", "Tag": [ { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674889, "uuid": "281ddc5a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/request.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674890, "uuid": "290dd80e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/MK.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674890, "uuid": "291aa919-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/lummnew.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674891, "uuid": "29b48113-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//dobre/splwow64.exe", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674891, "uuid": "29c656b8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/crypted.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674892, "uuid": "2a1d954a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Mswgoudnv.exe", "Tag": [ { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674893, "uuid": "2a9c95da-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/5KNCHALAH.exe", "Tag": [ { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674893, "uuid": "2ad5624f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/LoadNew.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674894, "uuid": "2b19f322-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/surfex.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674895, "uuid": "2c0a90fa-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//cost/random.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674896, "uuid": "2c9b6450-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/PctOccurred.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674896, "uuid": "2ca2be1b-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Ewpeloxttug.exe", "Tag": [ { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674897, "uuid": "2cdd3015-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/12.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674897, "uuid": "2d5a5f75-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Microsoft.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "2d77fefa-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/OneDrive.exe", "Tag": [ { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "2da803c5-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/PharmaciesDetection.exe", "Tag": [ { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "2da9d6b1-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/xt.exe", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674898, "uuid": "2daf895f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Vn70wVxW.exe", "Tag": [ { "name": "MetaStealer", "colour": "#ebffe2", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674899, "uuid": "2e51ba4d-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/RMS1.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674900, "uuid": "2ebc248c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/build_2024-07-25_20-", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674900, "uuid": "2ec31b42-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/2020.exe", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674901, "uuid": "2f46afd5-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Ukodbcdcl.exe", "Tag": [ { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674901, "uuid": "2f520527-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/23c2343.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674901, "uuid": "2f756d8a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/RedSystem.exe", "Tag": [ { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "2fc9ac25-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/4ck3rr.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "2fde22ca-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/cookie250.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "3049b257-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/shopfree.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674902, "uuid": "3049bd57-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/jsawdtyjde.exe", "Tag": [ { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674903, "uuid": "309ea1ea-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/stealc_daval.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674904, "uuid": "31044d0f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/js.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674905, "uuid": "319c93db-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/PkContent.exe", "Tag": [ { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674905, "uuid": "31d1e7e8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/xxxx.exe", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674905, "uuid": "31d8bf76-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Ghost_0x000263826B9A", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674905, "uuid": "3200b9c7-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Client_protected.exe", "Tag": [ { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674907, "uuid": "32ddad00-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Setup2.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674908, "uuid": "33e2479a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/1.exe", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674909, "uuid": "344b216e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/ConsoleApp3.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674910, "uuid": "3497c105-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/crypteda.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "35e24246-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/test.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "35e68a11-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/LummaC222222.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "35f4b7ef-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/bildnewl.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "361a7ab3-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/stealc_default.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674912, "uuid": "36270977-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/NorthSperm.exe", "Tag": [ { "name": "StormKitty", "colour": "#9cf321", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674913, "uuid": "369a3874-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/SingerJudy.exe", "Tag": [ { "name": "VenomRAT", "colour": "#31D98A", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674913, "uuid": "36ac3f4b-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/1111.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674914, "uuid": "376583ee-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/seo.exe", "Tag": [ { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674914, "uuid": "3776f566-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/SVC.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674915, "uuid": "37d62611-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/uhigdbf.exe", "Tag": [ { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674915, "uuid": "37df23b6-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Armanivenntii_crypted", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674915, "uuid": "37e41f0f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Pichon.exe", "Tag": [ { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674917, "uuid": "38c47af4-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/broadcom5.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674917, "uuid": "38da3f5a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/creal.exe", "Tag": [ { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674917, "uuid": "38e3e339-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/octus.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674918, "uuid": "39a9870d-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//well/random.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674918, "uuid": "39ab743d-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/utility-inst.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674922, "uuid": "3c26bd77-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/server.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674925, "uuid": "3d7f8e07-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/cccc2.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674926, "uuid": "3e298896-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/exclude.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674928, "uuid": "3f8dd3a8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/build_2024-07-27_00-", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674929, "uuid": "404dbba6-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Installeraus.exe", "Tag": [ { "name": "MeshAgent", "colour": "#985f9d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674930, "uuid": "40859ea9-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/rstxdhuj.exe", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674931, "uuid": "414389cf-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/newbundle.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674931, "uuid": "41478ea0-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/25072023.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674931, "uuid": "4149a051-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/svhostc.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674933, "uuid": "425c986e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/5_619031755606301755", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674934, "uuid": "430827a1-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/msedge.exe", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674935, "uuid": "43813c67-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/CnyvVl.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674935, "uuid": "43d3aeff-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/file.exe", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674936, "uuid": "440b3dd8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//mine/random.exe", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674937, "uuid": "4531b769-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/kiyan.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674938, "uuid": "453d4af7-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/ConsiderableWinners.exe", "Tag": [ { "name": "CobaltStrike", "colour": "#6fc5e4", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674938, "uuid": "453e5f58-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/qqq.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674938, "uuid": "453e6c33-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/14082024.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674938, "uuid": "45ba63db-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/dos.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674938, "uuid": "45bf8dde-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/client.exe", "Tag": [ { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674940, "uuid": "468e1463-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//dobre/splwow64_1.exe", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674940, "uuid": "4691a9d9-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/ven_protected.exe", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674940, "uuid": "46e5b6f0-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//soka/random.exe", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674941, "uuid": "47732672-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/frap.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674942, "uuid": "481e45c7-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/LgendPremium.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674942, "uuid": "482e2366-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/LummaC2.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674943, "uuid": "485988e8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/xxl.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674943, "uuid": "485b0dc9-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/whiteheroin.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674943, "uuid": "48673b8c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/xxz.exe", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674945, "uuid": "49f8bd99-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/VidsUsername.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674946, "uuid": "4a1adc46-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.142.240.133:42228/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674950, "uuid": "4c95af16-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/winx86.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674950, "uuid": "4cb23d62-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/clip.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674951, "uuid": "4d3a4757-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/gsprout.exe", "Tag": [ { "name": "GlorySprout", "colour": "#40C3EC", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674951, "uuid": "4d5810c6-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/cc2.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674951, "uuid": "4d7bcad6-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//lava/ramos.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674955, "uuid": "4fee1c4d-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/softina.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674957, "uuid": "50d6d09e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/ubi-inst.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674958, "uuid": "5150274e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/splwow64.exe", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674959, "uuid": "51e021b1-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/S%D0%B5tup.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674959, "uuid": "5229db7a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/AI2.exe", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674961, "uuid": "5322b949-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/S%D0%B5tu%D1%80111.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674961, "uuid": "53289871-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/systems.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674962, "uuid": "539ccfc0-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//tuba/sorto.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674962, "uuid": "53fd365b-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/BaddStore.exe", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674962, "uuid": "540ed40f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/WinRarInstall.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "543870aa-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/main.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674963, "uuid": "5472b74a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/MYNEWRDX.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674964, "uuid": "54c36822-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/torque.exe", "Tag": [ { "name": "gcleaner", "colour": "#23a1c3", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674964, "uuid": "54d10e07-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/LummaC22222.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674964, "uuid": "54d1f6ef-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/DEF.exe", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674968, "uuid": "5722bfb4-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/ControlledAccessPoin", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674968, "uuid": "5732b52f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/ewrvuh.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674968, "uuid": "577a3add-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/ovrflw.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674969, "uuid": "57f2002c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/stub.exe", "Tag": [ { "name": "ZharkBot", "colour": "#326594", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674969, "uuid": "5800bfeb-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/zzzz1.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674969, "uuid": "5840a343-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/onlysteal.exe", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674970, "uuid": "58a8027c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/build.exe", "Tag": [ { "name": "PythonStealer", "colour": "#732E20", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674970, "uuid": "58d111cf-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//test/num.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674971, "uuid": "597b8943-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/soft.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674972, "uuid": "59a3fbfb-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/ufw.exe", "Tag": [ { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674973, "uuid": "5a3b3d52-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/setup.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674975, "uuid": "5b9d4d8a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/build2.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674976, "uuid": "5c0ab04b-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//num/random.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674977, "uuid": "5c8c5e90-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/svchost.exe", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674977, "uuid": "5cb08270-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//stealc/random.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674977, "uuid": "5cdd9384-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/drchoe.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674982, "uuid": "5fbf68cd-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/noll.exe", "Tag": [ { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674982, "uuid": "60010c53-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/pered.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674984, "uuid": "60a6b406-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/neonn.exe", "Tag": [ { "name": "DarkTortilla", "colour": "#98530E", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674984, "uuid": "60d1a3f0-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/freedom.exe", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674984, "uuid": "611e9e40-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/WindowsUI.exe", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674985, "uuid": "61bfbfb5-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/nano.exe", "Tag": [ { "name": "NanoCore", "colour": "#d0f361", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674986, "uuid": "62202e23-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/crypted8888.exe", "Tag": [ { "name": "MarsStealer", "colour": "#167f73", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674987, "uuid": "62d33eca-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/SemiconductorNot.exe", "Tag": [ { "name": "Amadey", "colour": "#6d0e79", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674991, "uuid": "6506c973-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/loader_5879465914.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674993, "uuid": "6681fa39-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/5447jsX.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674995, "uuid": "674b4169-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/vlst.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674999, "uuid": "69998053-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/pyld64.exe", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674999, "uuid": "69f1f08f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//shot/gizma.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674999, "uuid": "6a26c39a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/kitty.exe", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745674999, "uuid": "6a2a84e8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/06082025.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675002, "uuid": "6b6c9e12-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Launcher.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675006, "uuid": "6e13e078-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/windowsexecutable.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675006, "uuid": "6e2af51c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/DeliciousPart.exe", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675007, "uuid": "6e7b78dd-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/DiskUtility.exe", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675009, "uuid": "7022bbaf-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/DCRatBuild.exe", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675010, "uuid": "7057db52-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Dtrade_v1.3.6.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675010, "uuid": "70acafa0-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/PURLOG.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675011, "uuid": "7122b1f4-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/DIFF.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675012, "uuid": "7168909d-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/GoogleUpdate.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675012, "uuid": "71711d59-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Identifications.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675012, "uuid": "717305df-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//283", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675012, "uuid": "717315af-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//mine/enter.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675014, "uuid": "73120c3b-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/mobiletrans.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675015, "uuid": "73540b1e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Authenticator222.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675016, "uuid": "73c83678-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/stealc_valenciga.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675016, "uuid": "74047da7-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/vidar.exe", "Tag": [ { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675016, "uuid": "740b90d3-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//reno/zuda.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675017, "uuid": "745b0844-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//runo/sand.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675017, "uuid": "747c9132-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/robotic.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675020, "uuid": "76476e8e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Cbmefxrmnv.exe", "Tag": [ { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675021, "uuid": "76b4e459-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Amadeus.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675021, "uuid": "76eb21e6-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/postbox.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675021, "uuid": "7700e73c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/hashed.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675023, "uuid": "780ed7a5-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/3544436.exe", "Tag": [ { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675023, "uuid": "781cf8c0-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/legas.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675023, "uuid": "787207fd-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/coreplugin.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675031, "uuid": "7ce18ca8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mq", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675036, "uuid": "7fbf5a1d-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Vhpcde.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675040, "uuid": "82219263-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/30072024.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675042, "uuid": "8344186f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.51.28.70/mqi686", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675043, "uuid": "84249e3a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/cclent.exe", "Tag": [ { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675044, "uuid": "84c92d9a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/probnik.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675044, "uuid": "84ecd6bb-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Armanivenntii_crypte", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675045, "uuid": "850b1de3-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/runtime.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675045, "uuid": "850e858c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/penis.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675046, "uuid": "85d84c6e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//shama/leon.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675049, "uuid": "878fb58d-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/DivineDialogue.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675049, "uuid": "87cb549b-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/DecryptJohn.exe", "Tag": [ { "name": "PureLogStealer", "colour": "#81499D", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675049, "uuid": "87d41579-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/HVNC1.exe", "Tag": [ { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675049, "uuid": "87e88d6a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/winn.exe", "Tag": [ { "name": "PureCrypter", "colour": "#131792", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675049, "uuid": "87f487dd-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Authenticator.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675050, "uuid": "8805f410-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/svhosts.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675051, "uuid": "892aabc1-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Channel1.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675052, "uuid": "897c8ba0-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//ProlongedPortable.dll", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675052, "uuid": "898fe68d-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/install2.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675054, "uuid": "8a62162c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/cvv.exe", "Tag": [ { "name": "dcrat", "colour": "#75ce72", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675054, "uuid": "8a75e59c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/MePaxil.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675054, "uuid": "8ad310e2-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/armadegon.exe", "Tag": [ { "name": "DarkTortilla", "colour": "#98530E", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675057, "uuid": "8c39980a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Cvimelugfq.exe", "Tag": [ { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675057, "uuid": "8c5483d6-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Set-up.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675057, "uuid": "8c5844b5-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/support_app.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675059, "uuid": "8d98ab21-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/BattleGermany.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675060, "uuid": "8e855d92-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/bandwidth_monitor.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675061, "uuid": "8ed41bb3-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/unison.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675061, "uuid": "8ee9fb8a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/build9.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675061, "uuid": "8ef8f8be-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/AnneSalt.exe", "Tag": [ { "name": "VenomRAT", "colour": "#31D98A", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675065, "uuid": "91598164-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Identification-1.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675068, "uuid": "92d0da4f-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/300.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675068, "uuid": "92e65943-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/pyl64.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675068, "uuid": "933c15cc-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/soft2.exe", "Tag": [ { "name": "DanaBot", "colour": "#860d30", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675069, "uuid": "936b9b4a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/file1.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675070, "uuid": "941ebdf5-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/prem1.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675072, "uuid": "95adbc40-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/stealc_default2.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675073, "uuid": "96260f70-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/343dsxs.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675074, "uuid": "968aaecf-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/morphic.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675074, "uuid": "9692737a-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/needmoney.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675074, "uuid": "96b3a3d5-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Indentif.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675075, "uuid": "96ed4487-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/yoyf.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675077, "uuid": "98303aba-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/resex.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675078, "uuid": "98b25fe2-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/winrar-x64-701.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675078, "uuid": "98bc9beb-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/pimer_bbbcontents7.exe", "Tag": [ { "name": "Stealc", "colour": "#291416", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675078, "uuid": "98c559cf-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Opdxdyeul.exe", "Tag": [ { "name": "SystemBC", "colour": "#a79cf9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675078, "uuid": "98c65ee8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/clcs.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675079, "uuid": "998d5db1-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/blackload.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675079, "uuid": "9995fee8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/meta.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675084, "uuid": "9c87f2af-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/pyld611114.exe", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675089, "uuid": "9fc7f000-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/channel.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675089, "uuid": "9fc87146-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/out.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675090, "uuid": "a007afdb-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Identification.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675090, "uuid": "a05b83d9-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Team.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675090, "uuid": "a05dee53-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/8.11.9-Windows.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675094, "uuid": "a28bce5c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/worker.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675094, "uuid": "a298b3a8-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/Firefox.exe", "Tag": [ { "name": "LummaStealer", "colour": "#21806b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675098, "uuid": "a4bdf144-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.117//inc/BitcoinCore.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675104, "uuid": "a8b196d7-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.19//dobre/acentric.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675104, "uuid": "a8b1e5e2-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.19//inc/5_619031755606301755", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675105, "uuid": "a8d5278c-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.19//shama/leon.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675108, "uuid": "aaf8d43e-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.19//inc/vlst.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675108, "uuid": "ab10ea73-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.19//inc/file1.exe", "Tag": [ { "name": "cryptbot", "colour": "#96129c", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675109, "uuid": "abaa9886-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.19//inc/clsid.exe", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675109, "uuid": "abaf1198-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.19//inc/soft.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1745675109, "uuid": "abbeee25-22a4-11f0-82df-82aee05be84a", "comment": "Malware distribution site", "value": "http://185.215.113.19//inc/windowsexecutable.exe", "Tag": [ { "name": "RedLineStealer", "colour": "#23a11d", "exportable": true, "hide_tag": false } ] }, {