{ "Event": { "published": true, "date": "2026-08-20", "threat_level_id": 2, "info": "URLhaus IOCs for 2026-08-20", "timestamp": 1787271322, "analysis": 1, "event_creator_email": "urlhaus@abuse.ch", "distribution": 3, "uuid": "96cdee59-e302-4db0-ab1a-2aec79bdebd8", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ce1ee42-7fdd-11eb-99ee-ac162dbe2a66", "comment": "Malware payload (Mirai)", "timestamp": 1787184735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787184735, "uuid": "9b14189f-f8c2-489c-9f62-47a8702023ed", "comment": "Malware payload (Mirai)", "value": "eec5c6c219535fba3a0492ea8118b397", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": " Mozi", "colour": "#546ca1", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "bashlite", "colour": "#942e2b", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "eilf", "colour": "#10ef2b", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#a35340", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787184735, "uuid": "3dd5c3f4-0949-428a-9bbf-ef6ecf0f642a", "comment": "Malware payload (Mirai)", "value": "12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": " Mozi", "colour": "#546ca1", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "bashlite", "colour": "#942e2b", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "eilf", "colour": "#10ef2b", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#a35340", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787184735, "uuid": "35e8b56d-bfac-49c5-a21f-50037b532a98", "value": "13643A8AFD81AE25D5C126BBFE2F4289331317B8D2EB71029D145F2876CA94F0F7A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787184735, "uuid": "62fbe483-6e8e-424c-b8a6-767fe92ba724", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787184735, "uuid": "55abddb8-fc92-4dc9-8caa-0ffe234ac752", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2854b459-9c31-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787187036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187036, "uuid": "5927558f-d247-43db-9077-a6ba0148b7d1", "comment": "Malware payload (Mirai)", "value": "10dea37f55e9d29b6ce7979835311b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187036, "uuid": "e0b25679-7e01-474e-a140-0d61967e6151", "comment": "Malware payload (Mirai)", "value": "3f205f6073c62cd2e6f5499f07c0fb3ed269d3494a2bb8668d80fb3d95b28fc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187036, "uuid": "fb0cd766-2f69-4832-b629-5b93d46ad5a4", "value": "T1E374B40A6E228F7DF27587708BF34E20D76D73D616E1D684E2ACD5050F2068E651FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187036, "uuid": "f9e034a2-295c-45b1-89a0-fa95292a48f0", "value": "6144:znpXAQQbytzcFiJrxKnHjwmVQ3Kf15jA7Mkw3YDPC6vsyylCC0V/QOLjHqVkH5DR:z0YQLydQqHqY5Dmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787187036, "uuid": "2ad8f46e-1561-4089-a60d-6600b024bce5", "value": 345012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187036, "uuid": "a1c71f42-a698-4b8a-90f4-9ac6ac51a31c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60088012-9c31-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787187130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187130, "uuid": "3cecc6f4-aa78-4cb5-94f2-8e011f6e4b3e", "comment": "Malware payload (Mirai)", "value": "77ceb458ea7e232481101b6e0f21bed4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187130, "uuid": "7203889b-0da1-4407-906c-d7606f78cdb6", "comment": "Malware payload (Mirai)", "value": "f8439179f9c964fbefb1ffef0a6749a772242fee4b9432976bf6b587b786a2c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187130, "uuid": "18ff5389-65c5-4c64-975e-e4e196298ee3", "value": "T1C7357C9CE3C7D4F1F26341F1021ED7B75534A1299023FAF6EF4A2A6674327522F1A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187130, "uuid": "d330a6ea-0a59-4589-9fec-a23b9258c7d7", "value": "24576:mV7H2HJ/STXhknh69PMFBn2q9ggdTlmw5x6:pEhknh69iBnt3D5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787187130, "uuid": "d189f951-ce11-4541-aa3d-3f57564cb12c", "value": 1120120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187130, "uuid": "77638555-cae9-42ac-ab82-4ecb3424969f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6024f41f-9c31-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787187130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187130, "uuid": "92c53f23-0905-4694-a105-a4e697ccb15d", "comment": "Malware payload (Mirai)", "value": "b8afa498b51ac428a6026f9a7aa7fd30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187130, "uuid": "2d03fc65-ae32-401c-9599-7484b1b8eee2", "comment": "Malware payload (Mirai)", "value": "a2a18c18182243ce6b54481ae362535871b4111a9204b39aab6fb8a46d93255d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187130, "uuid": "29a774b3-bf99-4df0-b0b4-0026e289802f", "value": "T125559F07B7B374BEC053C435879BD662AA32B42502126E7F61C4DA343E17EA45F1EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187130, "uuid": "37959962-725d-4dfb-b2f3-97512877fbe1", "value": "24576:g/YhjwaBLzgC0oj4sak8R7ioMTR4Qn7040/Pf7tsURQXn/ZGNZncGmpY:YYhjXgCpj4sake6sTLtsURmZGNSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787187130, "uuid": "0a5f3a6a-61fc-428d-a371-8f4e30946e69", "value": 1354560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187130, "uuid": "3180ba02-6035-4a96-982b-ae828aff3340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d82b06e-9c31-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787187152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187152, "uuid": "446c91b2-86df-4607-b64d-a9a53adef532", "comment": "Malware payload (Mirai)", "value": "e33a0aa3b871ded56b78bf7ab050ec98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187152, "uuid": "b05f228b-97f0-46f0-ba99-2c8860300ca1", "comment": "Malware payload (Mirai)", "value": "87d14d2c5609cefb229cd3fff7a708e7bc357a92ae4348382e2bbdd3d3b7ae4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187152, "uuid": "4bde5345-6921-4a94-9be0-5945c2def6e5", "value": "T17A343C62BD41DF93C6C12AFBFBAE824837172B7DD5EE3102DD146F61239A8960E365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187152, "uuid": "33517dc6-b0bd-4d8b-9ced-d5d5f3b18ba5", "value": "6144:7M+iSbcCFXBU6voZYi7Pn8L0FLelAuneQF+aZvM6o2N88Dx0y:7riSQIe7P8selAuneQU4vMj28yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787187152, "uuid": "66ef6142-e68f-43f1-94c8-5b07ff5cb80c", "value": 250904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187152, "uuid": "5de04573-1372-4c09-8400-20534521ad52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcd62d1-9c31-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787187156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187156, "uuid": "b5c45001-6c8a-45fc-bf99-2c8c288303f1", "comment": "Malware payload (Mirai)", "value": "4d0f3bbf605a0b5f03ba8c41f9c0e70b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187156, "uuid": "65bd9343-3ee1-4058-902a-ce8f674bf01f", "comment": "Malware payload (Mirai)", "value": "57ba0c6c3195857e972d9764566e57db25a5e49de4efb8f7ffb545f74740b123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187156, "uuid": "cff234d1-3ec4-4e4b-a6f7-3440b59c1519", "value": "T14C443C66E841DB92D1C11ABEFF6DC14933172F78E3EE7202DD146F60678B89A0E7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187156, "uuid": "8a07c1d6-e37e-4225-a25f-3fb6745f0f5d", "value": "6144:NIcvL+V1sshDIR/aR+N4I0STXAMt5ZJ04a1gou5y29I1NWN:OaL0hDYNISTXAMt5w4aaJ5y29I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787187156, "uuid": "b0665b88-0e07-47eb-a095-6ee50b4171f1", "value": 261544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187156, "uuid": "84fea8c1-aa2c-4056-9c13-945ae892ebc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cc4bda-9c31-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787187163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187163, "uuid": "0414188f-98e3-4083-a655-c7c8e8e3e90a", "comment": "Malware payload (Mirai)", "value": "43d865aee32f1a6760eae078e2b9ff9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187163, "uuid": "a880770d-9953-4aad-a447-db313f1a7be6", "comment": "Malware payload (Mirai)", "value": "8182fb0126fe3f44eaf12f065a054a64ecfb73b884f68969ebbdc15cfeffba29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187163, "uuid": "37fa4e0e-3001-418f-94cc-02f185e72cc2", "value": "T189443B02771D0F43E2A32DF0373B17E197AEADA124E9E584690EBEC65371D721189A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187163, "uuid": "3bb0ed1f-8523-4a07-94ba-a4ead4fefdcd", "value": "6144:7fNcCfSWzC/wL7PzU6u6GaolUg3Ib8RQzwTO6e9dZff/B2sF:7fNcC6gvjg7Gf/B2sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787187163, "uuid": "bf50af94-63fd-4a1a-95f0-dc3afe0da242", "value": 263460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187163, "uuid": "1d5cf109-0596-41c2-8d9e-2b428b8fb01d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f2d050-9c31-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787187187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187187, "uuid": "0de412e5-3b28-48a1-9eaf-5fad17bb2c0b", "comment": "Malware payload (Mirai)", "value": "7d7848510bf397b229b7a928346cb3ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187187, "uuid": "d16a2eb4-37a2-4cb8-863d-7fc7e24cff01", "comment": "Malware payload (Mirai)", "value": "8bc94ede491e67b32af3789f9807b76bebe02f69bb9dbec17342c1e00bd6d7d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187187, "uuid": "77adf199-0370-490d-8b0b-ca8e0850fac0", "value": "T155443B66E9419B91D5C12AFEFF6E814933172F7CE3EE7102DD145F2067CA88A0E7A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187187, "uuid": "2a304d0e-0f5d-4e6b-9d66-c22ce12fd6e7", "value": "6144:DqFgJ7+xwX6V9ZCx1g7C1p3TK9RhCZYp7aFFdLeMo16ZSfvYp47aS:m+x+V9Sgm3TK9RhCSp7afdLeMo164HYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787187187, "uuid": "6b8c0318-85cb-42d7-bfbc-3c3a05421119", "value": 276220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187187, "uuid": "25afe99c-d81b-4820-9905-909d661aa17b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843bdb21-9c31-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787187191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187191, "uuid": "bc984ee1-ec4c-4dfb-929f-283ab8db402a", "comment": "Malware payload (Mirai)", "value": "c5bda1237720b21616e5cf44fa18b40a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187191, "uuid": "98498388-f577-4cc4-bf7e-c391c08018c9", "comment": "Malware payload (Mirai)", "value": "c897c15850310c244a6d8f27a6c0387d6359b1326120c8eca9ee27d4c6a6ff3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187191, "uuid": "501d4ae3-7f9f-4747-9463-d2eebaa9a16f", "value": "T118343D52BD41DF53C6C12ABBFBAE824837132B7DD6EE3102E9146F21279B8960E775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187191, "uuid": "16570c87-9b92-4cab-9eb5-b7dc6cb4c273", "value": "6144:nq8XlCVDOxnzSXYjNgzZGLfFGlB2xY4iuhMB5BZEDTcsy:qKlCqlxQGLfFGlBQzhsDZEDTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787187191, "uuid": "f677bb3c-b94f-459b-8182-bb37a0d37690", "value": 247276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787187191, "uuid": "b8cc87ff-55bf-490f-909f-f4ac22c411b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfda0c6-9c33-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787188252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787188252, "uuid": "2677c3f9-865b-4a8e-88b5-33f10c9ae31c", "comment": "Malware payload", "value": "41a7f45f9e9ac3078aa026753137f040", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787188252, "uuid": "86261a6e-76ad-4316-b2ea-3161226fd5b5", "comment": "Malware payload", "value": "3615a57af1621f5729b3ab3f3604014cdd5fa3f9df0b67ae426c65893ec21006", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787188252, "uuid": "e2bd6e06-f7e0-4e58-922c-9825a3e71c48", "value": "T18FD523C5B5F22CF0E436C7BB9F52E46CB12473A50A349CAB76CC2A149C679682D363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787188252, "uuid": "755315bc-6fb1-4c9a-a6e3-da8abf50e253", "value": "cc678ea372003a91fefb68ce6b422039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787188252, "uuid": "d5c20634-e0d4-4c7f-9148-a3bb3c17b7d3", "value": "49152:AIudLVXNkPuD3WRjSdd4xJUi48cp5embqhwJhoh4VVf7G9owj2gQDJOsQQRhg:A9kgGlWdM5ypvbqhoh6oRwj2ZoFQvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787188252, "uuid": "fdc563aa-a06a-4886-98af-2128a390703d", "value": 2944512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787188252, "uuid": "d85957f6-24f4-408e-9c49-e8cbb6ac5a20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7d46a3-9c39-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787190748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787190748, "uuid": "9e6a676a-9d70-4de2-9a9d-e5a5d32db97b", "comment": "Malware payload (Mirai)", "value": "f7586b2d50c5ef0f8978c5751cf7dc88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787190748, "uuid": "c5e8348c-1c0c-470e-ba5b-c9575a5f75f5", "comment": "Malware payload (Mirai)", "value": "3483158612bc5a4446d895f4c02be10c528108c4b0ccaf26e625daffc2c15a2a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787190748, "uuid": "59e6e4ee-6e9b-4371-8bee-5df688a4475f", "value": "T19104BFA7B3072C60D86002F41FDB4BAC2BEB51054D6BE9E36C7E763A25774EA25063", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787190748, "uuid": "adc49a66-befe-4071-91d8-3c54559dbc9c", "value": "3072:pHOuKhYcfkosr2BAsdWR1/bCVHUzOKfZjdI5/YxgVCa6tTEPwxsHjefq:hOuKhYwk1r0UdbhzVxJIZYKCTpEuCefq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787190748, "uuid": "0eb53e46-a00a-46e6-a5cc-4ce99ff8c9b5", "value": 181740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787190748, "uuid": "2c36a650-a263-44bc-8354-f4ba71a5c979", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be3f23f-9c3a-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787190988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787190988, "uuid": "1fe2179f-846b-481b-a16d-dade40c5beac", "comment": "Malware payload (Mirai)", "value": "0085b6a1c72fb684532cabf196f85bb0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787190988, "uuid": "985836d1-5aa4-409b-92c3-c7e9846d3109", "comment": "Malware payload (Mirai)", "value": "0175cc4595194d7be09f80df0a202a78706127cd8046596323ff95505615eac3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787190988, "uuid": "142ffc5c-cb56-4fcc-95ee-fa609a3e6466", "value": "T105530233E299C0DBF161113170283C0D2C1095CE5284D9E6FAEED077EEA3E587B5AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787190988, "uuid": "fd64781c-cc68-4ba9-9f61-296f3c534b70", "value": "1536:EgVSdfHd0JEjscR1tAd1cOaFC/dUNjo+cnouy8Lzkkn:EQAfHd9dR1tA8OaqdUteoutUkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787190988, "uuid": "4fcb70d5-30cd-4c17-a091-e25c8d9c64eb", "value": 61128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787190988, "uuid": "e8a9e9f4-5bb0-403a-9d64-11ce92848643", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92757197-9c3a-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787191080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191080, "uuid": "d231b422-f9d9-4c4c-92ce-f3c5d67639a2", "comment": "Malware payload", "value": "4499ca8e709189ffd9e29694e91c7270", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191080, "uuid": "3078ca8d-6a9a-44ee-aa85-1ec6ec381549", "comment": "Malware payload", "value": "3356f8d2f7c1b4de737efbf767ab48bd817625e06981ff9006dddb6e8016b751", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191080, "uuid": "28399254-8ec9-43fa-a8d7-5d565184e712", "value": "T1FBF3E85EBBB23276721B8309FAC1B768916DC153EA011EE7BDB5F118CBC229201736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191080, "uuid": "1f1cc741-474c-4cce-9f58-c010e00ef038", "value": "1536:japAr5lURr4kjofmmkWl0Fr/vqLBavZWkOA4YThJgTnUX0vZI:Gd4kyA4qJgTtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787191080, "uuid": "cad0d2f2-61c1-4c32-bc0d-0d7638b8c740", "value": 157652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191080, "uuid": "67cecde1-31da-40aa-9cf9-2d7f523081d0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f55d5f-9c3a-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787191081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191081, "uuid": "e8fbd59b-3582-4577-8115-98d93af31fdf", "comment": "Malware payload", "value": "da5fc222059dee6a77849525900122c7", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191081, "uuid": "89eeaaf9-9500-4b02-a22a-16791e064013", "comment": "Malware payload", "value": "e83e5a3f4f59c9554181eca40e934ebc88c211c15319c802a3e6e8550ffb3b7b", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191081, "uuid": "51f8c5ed-34bd-4627-bb63-68afdab60680", "value": "T18AB186234829AC721157CAA4B146772DC0EA8277F342C65A72FD815C9BD3DD281E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191081, "uuid": "61ebb5f0-2e62-43bf-9546-b1fc2bea5f72", "value": "96:MJlH7n472wO36VvLb9NE0kNUmgHwrSUx9PGbq/GNt7sG7Exml51pOT1pV8Q3O3NZ:MvH7n472wa6VvLb79GUm3H9PLGNt7se1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787191081, "uuid": "f7469090-02b5-4219-9f33-c24e9ec581d0", "value": 5413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191081, "uuid": "75e0d021-5f15-488e-a4ff-c7ce13653965", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe229b45-9c3a-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787191261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191261, "uuid": "74770b5c-ea68-4cbe-a78f-06ef968580f5", "comment": "Malware payload (Mirai)", "value": "d4e9afabf74bd0e2a2676a3e2af6fd54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191261, "uuid": "67324fd4-becd-4bbe-9971-6bce35da1a34", "comment": "Malware payload (Mirai)", "value": "904e49f31e210ade789e3cfad4ad2d3e0c20b990fb7f57001cbad8071bea6cbe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191261, "uuid": "6da742f2-5a84-4206-a27d-6a911d164136", "value": "T1D3630254F4264A97EFEDBFBD9E9211C53B9D695E330294227A83B7C20344A3A774D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191261, "uuid": "45e16741-706c-47db-b623-dbb5e362623f", "value": "1536:WyflHW9mcnLceTS/TX7ZCZU9IK6wQhLnd44NuCGRl2UFP4u+qgw097:Jfl29nnzTYRqUp3Q9dTNmXFP4u+qgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787191261, "uuid": "99f2d836-f829-465e-9b3b-dfdcc6ea5253", "value": 69072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191261, "uuid": "844ace9c-7cb5-4b08-9f6b-8c323c17332e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6c2c18-9c3b-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787191281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191281, "uuid": "503d1892-6f46-4c16-b2ca-dcc64bc8e1b2", "comment": "Malware payload (Mirai)", "value": "f90d023e90cac4b497376851a6b9907e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191281, "uuid": "6b0219a0-1bb6-4840-92bd-a8599f7f4b16", "comment": "Malware payload (Mirai)", "value": "a0a2beb18f9334564860acef1a8d9754dfcd2e94cb90cd878308f12cb5bdf264", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191281, "uuid": "0f83a0c6-4ec0-417e-9bb2-7fb61b3e0e37", "value": "T1A76302F5973BF9F1C331463019BE5795D521323E134B076AA8CA931A8ADF6853834C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191281, "uuid": "4e4a0e7e-d507-46c5-9e6f-b933f64453b9", "value": "1536:rX72qIES03U2lXOnWJcF9cDYaSzKQW86P6ZlOd/a7xQ:MIBXlfSzKE6+lU/uxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787191281, "uuid": "d8fcf61b-a8ad-4de4-9765-a3cfdd7cd45c", "value": 71308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191281, "uuid": "fc288a8a-93e9-41c3-bf25-d8b7b41095fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7919bef-9c3b-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787191625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191625, "uuid": "a8f9a105-5a68-4820-a98e-cf15f827e34b", "comment": "Malware payload (Mirai)", "value": "b5a5c5c1303652fd3a664066bf1a1a97", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191625, "uuid": "17d2e468-ff63-432b-a2db-0cd3c6d017dd", "comment": "Malware payload (Mirai)", "value": "cafd6cc41f5ae446d21bc2aafdb9f6de5a862dd87ab07dc660c5f3fc6d17c391", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191625, "uuid": "91f574af-fed2-402e-a23b-56c064cb554a", "value": "T1F163021431C5BF66C280203EDD5569C3A2240772C3F6B08F769549B0C3CF15BAAA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191625, "uuid": "29004d28-12a7-429c-895c-67cded32788d", "value": "1536:nVfAbXo0bbXAXNDqcpKVmknCVR1IjORjLVw6U5pyA+bOMezWc:4XoWoVUHCVsO86Up+bQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787191625, "uuid": "43e1bee1-5e73-4491-a99f-7aa6c6fd83c6", "value": 69424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191625, "uuid": "d904fe8b-6b8f-4e9d-973d-3801c0497f6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcb598f-9bff-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787191634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191634, "uuid": "aaf7a742-2b31-4568-8c47-97033989737d", "comment": "Malware payload (Mirai)", "value": "b8662f614e16e71d08c00d3b3fc9fb90", "object_relation": "md5", "Tag": [ { "name": "69cnc-duckdns-org", "colour": "#a340b0", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "www-69cnc-duckdns-org", "colour": "#1fdad7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191634, "uuid": "316ce08b-888b-4df5-bfb8-7d6ffc8d89e5", "comment": "Malware payload (Mirai)", "value": "88a1d3a4b48679023f740e25593ba6c7618b342b29a3d5a9dfd90c508b2e49c2", "object_relation": "sha256", "Tag": [ { "name": "69cnc-duckdns-org", "colour": "#a340b0", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "www-69cnc-duckdns-org", "colour": "#1fdad7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191634, "uuid": "85c08722-4617-414c-898a-a147165aa035", "value": "T1118302FDC88E7059E4F7E07DA8AC8B667F321FAD737520119C4047946BB42A663690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191634, "uuid": "5aa3e2ce-491d-45b8-a229-f924bf66bef4", "value": "1536:CnM/CYoOM1v8DbetvF5DeJYtFUXed+U5dZ2+X0Bymy5EghncGI7DTfC:X/EOM1BvbtMed+UN2+EBymXgBIPTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787191634, "uuid": "e3cfd4cb-2a13-4f6d-9b72-38a2032ed88b", "value": 83848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787191634, "uuid": "fe7f6fb9-b89f-47ff-bbf7-c5085a369fd6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "debbe78a-9c08-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787192155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192155, "uuid": "4c1fe4ae-f473-4cd9-b8ae-d06bc2baa623", "comment": "Malware payload (Mirai)", "value": "ff291fb408afc5129efadfe13a780802", "object_relation": "md5", "Tag": [ { "name": "69cnc-duckdns-org", "colour": "#a340b0", "exportable": true, "hide_tag": false }, { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "www-69cnc-duckdns-org", "colour": "#1fdad7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192155, "uuid": "310366d8-0725-4593-8c74-d887df31a3c4", "comment": "Malware payload (Mirai)", "value": "8dfc0d4d635338474f65c1c6aaecd9238761a669179d9bfc70341e5c8b7ae6c5", "object_relation": "sha256", "Tag": [ { "name": "69cnc-duckdns-org", "colour": "#a340b0", "exportable": true, "hide_tag": false }, { "name": "botnetdomain", "colour": "#d2f2bd", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "www-69cnc-duckdns-org", "colour": "#1fdad7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192155, "uuid": "9e96d605-ec77-4e97-b292-9fceea381e93", "value": "T17CD31270AC00C2C4CA5B7D315B54BEEE9C3B857DA9F98A13D285895C1A664DF3B140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192155, "uuid": "b6f43631-6ea0-4bc5-a568-4aea34fa7cff", "value": "3072:wUhYgLxuzN9HoKKGthKSfkc9bEsgPVMkMXnui2n4C6j3IG0x:wzrvIKKGthK+kibETzM+GrIGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787192155, "uuid": "08db1b5e-ead1-4869-88d7-6f11bbdf04e4", "value": 133344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192155, "uuid": "b416d92f-1fd0-4bc4-a13e-504f0f91a46c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210e97a3-9c3d-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787192178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192178, "uuid": "589fe0a1-98b0-47ce-9cf6-adb42e646a23", "comment": "Malware payload (Mirai)", "value": "c4186f37674f777782deba2e3a492fa2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192178, "uuid": "35b5278f-71ea-4802-8772-81a816f6aa9c", "comment": "Malware payload (Mirai)", "value": "f2c37a20f2f9d78483388f2888715b042aa3a85490522de557ff0de1ade7f852", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192178, "uuid": "3d1c584e-af69-4721-8df7-0e7bbbc75bbb", "value": "T1C5630259D2D85933CEB080B8FA7B59076291DF6DB1B81427E245831CFBDB11927F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192178, "uuid": "46c0356a-e0b6-457e-878f-3e7890b7202c", "value": "1536:1FjIcIOskYJraSoxTVmv5QxFv6buulpy3noiEFJPS2pydiRJFEuczOzI:1KOskZSo6v5QApkoDy2p3FoOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787192178, "uuid": "357b1fa0-455c-429b-a65a-b16b38f277fd", "value": 67728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192178, "uuid": "631f5278-0278-4047-9945-f248890e8139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158156f8-9c3e-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787192588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192588, "uuid": "9a1dcc14-d647-4498-8f68-d6d7f71b8719", "comment": "Malware payload", "value": "ce6b7538c7997f9ad2f2243a96ee53d8", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192588, "uuid": "4afdd54f-d822-429e-b8b0-eae8d295232a", "comment": "Malware payload", "value": "3f686801f43cc6e60cc7bb884d208361b31dd44349ec6ffea3172cb0d213bd2c", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192588, "uuid": "7477776c-5788-481f-9306-7fbd32164886", "value": "T1DA7393B13D8B2C29210F029FA057321CA4DACEE4E513A5E8F1FF912467F5DD076976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192588, "uuid": "1b6e8dfb-a527-409e-b1d3-12647d73f3e6", "value": "1536:PaNJuu59f5splEc9lGzvEQYM1tAZa/dP+3mT6j:6n9f5spdkzvEQYM1tAZa/dPCU6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787192588, "uuid": "579706dd-09b5-47d9-b992-3772c525e87f", "value": 78729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192588, "uuid": "19a6f66f-1191-4e1f-96cd-51590d08585f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7672e840-9c3e-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787192751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192751, "uuid": "85373519-ded4-43cf-9548-baa117c400bf", "comment": "Malware payload", "value": "bfa6548c3a89398f275da26bed6c603a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192751, "uuid": "60b8393e-8ee8-4b19-ac8f-75160e0cfb34", "comment": "Malware payload", "value": "7f0adf5c68e6d09361b3aa37532fc083c7b375e8e1f604af878c5fa41fcbe037", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192751, "uuid": "1918811f-7d6f-4285-9341-8c3c8d59c1d1", "value": "T17ED097B6256300B850620968F9C2EC00719A17BF4C47C20EBA4F68706F40388F0E03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192751, "uuid": "fa31478a-b1e9-4ab1-b404-6a70e4519077", "value": "6:hTrfRrILkeAulNXYq4HvXDG+NjVsNXYrkJ:Vr52pPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787192751, "uuid": "090866f5-ae2f-4da4-a359-a0cd545eef94", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192751, "uuid": "f0274706-3132-4a80-b807-33dbc760e274", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f6646d-9c3e-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787192852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192852, "uuid": "82b81004-2d70-43a8-9e36-25495689ca77", "comment": "Malware payload (Mirai)", "value": "4708d1dc75dcc6fa5846220ea51db5d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192852, "uuid": "3a34ec85-8d35-4cfc-a469-61d3fc9ea5a4", "comment": "Malware payload (Mirai)", "value": "5e4e09d652f233e7d7054dc338f26029bc920e199534c23006ec341015e01e61", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192852, "uuid": "3d4bf89a-d02e-4c1f-9ac1-b3cb81626736", "value": "T1BC1439C3F900EDBAF84AF33744170919B130B7A214425A376257357BED7A19A193BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192852, "uuid": "8e23395a-c654-4aa0-90d9-a513cc3d597f", "value": "3072:f/S59jpLHIOqbtFdWYmtqyeyCOcc1nZ7gfFPQi6qbVVLjbi7L8qJg9vf+Vge/:jHQBgyCbc1n1gy7qb0L8qe93e/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787192852, "uuid": "8e77dc4e-5ffd-44f8-8f31-9160b0c1eeae", "value": 199640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787192852, "uuid": "de07bb61-60ed-4c9a-a4af-2cadc0d76430", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46209ad6-9c3f-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787193099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787193099, "uuid": "f5260772-5071-43bf-9bdf-26d30b2eaed7", "comment": "Malware payload", "value": "8d795aa86eaf3587b73c8716d006fb7e", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787193099, "uuid": "51ce077a-b112-4e02-88b6-bd8d5eaf0b15", "comment": "Malware payload", "value": "bb46487f4fa39f1e63d20af4a962ae8efc5a5953deec9f113813cebf4bae03a8", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193099, "uuid": "4982716c-aa7b-4324-bb13-9b08537e97d3", "value": "T19B63F97378C6142A311F028F6107732CB5BA99D6DA01D9F1F6F661285BB4FA136F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193099, "uuid": "266cf767-ae3f-4c2a-84de-7e56e55fe781", "value": "768:uNZdypGVU1pupU0nMF/FbD3tKAD27p+EeLSJb9ee7xTqa1PWuo0sCy:uFyp4UKMpxD3tKAD2VDeLSJbnTqa1PW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787193099, "uuid": "87b01bba-b1ec-43f5-b7c6-b14eac2d39af", "value": 70350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193099, "uuid": "8ef81bde-83b8-4f11-9785-8fb656aa550f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d410a1b-9c3f-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787193138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787193138, "uuid": "e800b85b-c439-4cba-879d-51892bbd0549", "comment": "Malware payload (Mirai)", "value": "81dc372ede9bcea645a7fce119cbffad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787193138, "uuid": "c2a977a9-a20e-481e-b12b-78ad33772aeb", "comment": "Malware payload (Mirai)", "value": "149eb0387f2e80fe2ce3dd8ae5e8ff7d9609615f7758d72a84281b9877b3e7d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193138, "uuid": "bdef1628-4294-48ee-b003-4fe9dc9a933b", "value": "T116F37B73D82A6EA8C524D5B1B071CFBC5B639560518B1FBA44BBC2788083DCDFA453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193138, "uuid": "15fdac80-7ba5-49de-9ac1-012fbf7d2fbb", "value": "3072:zpptXRCK8T5itWk/TJejyd0U5vaWeMgo7PXHB3:zpfs5sWk/TJV5HeM7Px3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787193138, "uuid": "ae5de33f-5281-40e7-9aa1-b4cb2e3ada57", "value": 159032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193138, "uuid": "c2482625-fb16-4103-8e7c-958177cbebaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602beb84-9c40-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787193573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787193573, "uuid": "825e1546-0577-4f10-b548-a69b84cf0f96", "comment": "Malware payload (Mirai)", "value": "23e9c7c120d2b6a39cd6050d671edef7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787193573, "uuid": "1be00bf2-d7b8-430d-8f4a-6dd0530b6eaf", "comment": "Malware payload (Mirai)", "value": "602d1b06bb60e635f2b3568bf6c3296f5e75e101744af9bc960cb4a93055891b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193573, "uuid": "7abed88d-9491-4cdf-869f-6fbfb883df62", "value": "T13973F2F10183BE254C737E264A778D80715A9FBB81BB274B3440897DAB40E9A37A17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193573, "uuid": "6de46da5-a891-494e-be5a-5ad3a161c3ad", "value": "1536:dTaciv4CODtgWZMEQJOo4G1b3PFec2Hze+DdSZUbLQ:tNDasaJOo4+rGHzkyLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787193573, "uuid": "33575822-740e-4604-bb8b-e5c56a29ba87", "value": 73544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193573, "uuid": "14e1c307-ed37-4cb1-8e77-1be9e52bd763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b750e32-9c42-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787194370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194370, "uuid": "bbb0ac3a-abd8-4742-a840-b3e01e4bc106", "comment": "Malware payload", "value": "00ba197cee96b933c68987de5ecdc2ec", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194370, "uuid": "714d6d38-283f-47be-9469-a1727417772a", "comment": "Malware payload", "value": "da037c205d92f643522e0f80fadf9fb24492a8434ed86f03271003cfbde3d92d", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194370, "uuid": "7f069c75-4c08-4c16-a7b3-222cafd8b0a1", "value": "T1D693E871348DA839224F818FC253370C70DEDED5E212A5E5F2FA5238A5F9D903AB36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194370, "uuid": "3a46dcc0-042b-40b5-9f10-11b4e68b7512", "value": "1536:dap9kuEEwH8kw0PMqpYJKNoE+pTYeGf8BqLv3Tli0oRGpNuqYPPXPIH8LutVWw:MIuEEwH890j+pHBqv3Tli0oRGpNuqYPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787194370, "uuid": "68300884-c59e-4a4e-99bd-a0ebb5162759", "value": 89613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194370, "uuid": "3420038a-267c-4009-aa71-375fc9fe8cab", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a56db1-9c42-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787194526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194526, "uuid": "ce640d47-6ed6-4376-a87c-cc6dbcbc2f92", "comment": "Malware payload (Mirai)", "value": "8c6e6b80b65bd8581dad444e424cf3f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194526, "uuid": "cd596448-93ae-4f06-872b-0ff770e55863", "comment": "Malware payload (Mirai)", "value": "6767b2c18b2662c21ef60aacf015c9cb70d3b2f877839bda8a75312d8d3bbae7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194526, "uuid": "5aea45fa-b609-4032-bf4a-5b0c7089bdd6", "value": "T1C7A312A7AAABB7D2CDF0B4F2C91254465993777B7C06916D6B05D4633948CC213238", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194526, "uuid": "37357a65-daaa-4015-84b2-a50c90cd72ec", "value": "3072:my+AyFodu6ZCTvnZxmdbwiT0maa+tEq/7sOUu:mZBFYu6gD8Otn/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787194526, "uuid": "06fa5fb4-fec2-4d3b-8103-824861fabd33", "value": 100168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194526, "uuid": "881f0495-619b-4aef-bead-71a4e11c5301", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ac4964-9c42-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787194674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194674, "uuid": "53252e32-2bc2-4eaf-9d57-f62b64bb6175", "comment": "Malware payload (Mirai)", "value": "3ab1026b605a0ecbe06b4bc58b630083", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194674, "uuid": "ef757773-9d4a-4db5-ac1d-0c3cf3f4b359", "comment": "Malware payload (Mirai)", "value": "a2d644c45cc5d927beb506dc417934189baf99a52cd68d541c0bbe8c0dd7c9fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194674, "uuid": "010bcdc2-9afb-4990-a4ec-bc8f163a4b20", "value": "T1A17302CDFAA0E283CE8F1935022F77410B39E59673BA5FC813460E90A56E54B7D2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194674, "uuid": "d2893634-28cb-454a-9842-63ff1d99744c", "value": "1536:MjXzal1s3KfgxvJoewJKh8O7FPM1ZEgwGmu/rJ9iUnA/:MjXz84s2vPwJiy1ZE8msXi4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787194674, "uuid": "737f8c12-50fa-4b6a-9636-bda1621b52b9", "value": 78096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194674, "uuid": "7d78d758-9609-4adf-b67f-99e31b77ccfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2afa1dc-7fdd-11eb-99ee-ac162dbe2a66", "comment": "Malware payload (Mozi)", "timestamp": 1787194698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194698, "uuid": "b26429e5-feff-4353-9d5e-753bf2b33b62", "comment": "Malware payload (Mozi)", "value": "59ce0baba11893f90527fc951ac69912", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arc", "colour": "#0d6598", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "bla", "colour": "#FA8229", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#b6b48d", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#4d4007", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#fa4634", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#15a23a", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#8b9939", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "PowerPC", "colour": "#ff7a12", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#36e61e", "exportable": true, "hide_tag": false }, { "name": "SuperH", "colour": "#25a3d8", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#0fa3df", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194698, "uuid": "6558c0bd-5bf3-4c9a-94b4-b0c5aff475b8", "comment": "Malware payload (Mozi)", "value": "4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32", "colour": "#6ed3c3", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arc", "colour": "#0d6598", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "bla", "colour": "#FA8229", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#b6b48d", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#4d4007", "exportable": true, "hide_tag": false }, { "name": "ddos", "colour": "#fa4634", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#15a23a", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#8b9939", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "PowerPC", "colour": "#ff7a12", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#36e61e", "exportable": true, "hide_tag": false }, { "name": "SuperH", "colour": "#25a3d8", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#0fa3df", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194698, "uuid": "c67bd0e3-14fe-439c-b0c3-d9efbf761d95", "value": "E5D3128BEF36DC1ECF001EB226DA5B9E9C6D756B41CBF0A4B9C1818F13A01C97D52215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194698, "uuid": "168a5145-bc2d-4f9a-9e60-b229fa69681a", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787194698, "uuid": "26f1856e-32c6-4303-bdb9-35f4d5b6c142", "value": 135784, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b15ca3b-9c43-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787194799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194799, "uuid": "697df708-846b-424c-8451-bac4fe2ee0d1", "comment": "Malware payload (Mirai)", "value": "e5c65b2ac9ffeb64b1b93f5ade41ce30", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194799, "uuid": "7e35069b-7c10-497d-bab2-de2e3cf0ae08", "comment": "Malware payload (Mirai)", "value": "efea9e156af94f633941357ad696a346d640ae33c8a6cca38defb54520cb69fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194799, "uuid": "51a3e93b-514c-46ff-a912-369c46fa5845", "value": "T129835D13D5BDAD0ACAD0797702EB03E2D1EA5B445298DA4FFCA00E7DDF1B3902D266", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194799, "uuid": "a60855dd-9403-41f2-a900-c2538b313f75", "value": "1536:Ae5r9n4nEWh3r9n4nW9L2O/vj0XHyqK4fJCn8QHc+DFYZtnamB+3GfurHqToFmVE:Ae5r94Ek3r94WfnjEH1KOCn8EjDF86lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787194799, "uuid": "01a4bfce-ac41-44ba-84c1-d95d9fee3efc", "value": 85008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194799, "uuid": "ea78accc-0305-473d-8630-89b5d52d0a59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a7da27-9c44-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787195145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787195145, "uuid": "f88598f1-e2e2-4657-ae39-bf70f56e7367", "comment": "Malware payload", "value": "32bfd7d5583a02af7c95dcb624f6ec08", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787195145, "uuid": "ad53fbc3-a5a9-48c0-b07c-b7ba7539d0ab", "comment": "Malware payload", "value": "df4d94161034bc089f3c070179a0440fd08d3266d35425c0fc01fc03a6e30eb7", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787195145, "uuid": "32f7c6f0-969b-4d95-9a35-a71495055579", "value": "T16AF3E85EBBB23276721B8309FAC1B768916DC153EA011EE7BDB5F118CBC229201736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787195145, "uuid": "bd30afc8-3ab8-4090-a12e-eac9104dd961", "value": "1536:5apArYlURr4k3bpnIPMAyCJ/Wg+jrF0o1iF4BYhYTynUX0vZI:Ym4k4F4iYTytW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787195145, "uuid": "88b8158c-f1ac-4e78-aaad-ae41ea8db47d", "value": 157603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787195145, "uuid": "26c0e854-1624-4aad-86e7-9300e9af29d0", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e1ac53-9c44-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787195456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787195456, "uuid": "17dc5a4a-4363-4785-9b5c-8ee864a25b0b", "comment": "Malware payload (Mirai)", "value": "548130fffb462075da54f3a55a6b0fe7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787195456, "uuid": "7af0517e-830b-45e4-81de-fd365cbcb8eb", "comment": "Malware payload (Mirai)", "value": "80cd1c5bb361a547da71d18683fed939d7bc64cd226567793aa805105190edb4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787195456, "uuid": "8e3fff05-23e7-41ca-b7a4-532340df9453", "value": "T1697301AA184315EED4F5667423CE876ABF168952F513FC0E58C0BE478952036E903E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787195456, "uuid": "8691ba83-5e57-43b9-900c-fbc519589673", "value": "1536:WHiD82bcJMcC3juaGVEaycX/EmkJd7YRPv81c1Oi+Zr7dTZb6VJu8:WHiD8rJMczaGVmcXRv31Oi+Zr736VQ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787195456, "uuid": "fecbd5c0-7d21-4849-8087-543e9fcad2d8", "value": 76272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787195456, "uuid": "fc7f48e4-2986-4fb3-8e33-5414a654435e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad763cc-9c45-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787195604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787195604, "uuid": "106c9f73-78d8-47b5-8d73-56ef2c754959", "comment": "Malware payload (Mirai)", "value": "406b3906f3ea188aa83026ddf88b009c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787195604, "uuid": "3f01ca14-d7e0-4ebf-b314-e85a19ab89e1", "comment": "Malware payload (Mirai)", "value": "dea2b9053cc7569589530ed855fa917478ec5ee5940c55843f3e3e8debc4efe4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787195604, "uuid": "919d54ad-bb3e-408f-b665-1570cd3e6a04", "value": "T1C46302FDC062AC53CF11E874EA52A581253A4D75F2FC28DA87A05C35A53D6A1D3C66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787195604, "uuid": "e85a2a3e-55d3-460e-84c4-b18a2ea67cac", "value": "1536:2ljkVcQ7Wc0UqB9KG07XV44ity4em2IcvA94Gg2ylaJx03uqLt:2lw2c6Uqo7S9tRe1vA6EJx0hLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787195604, "uuid": "b8b5c065-4250-47fc-abcd-82d2470ecef8", "value": 71780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787195604, "uuid": "b4d392a9-226f-4f09-a596-bd1a87ad6ce7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9d3708-9c46-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787196087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787196087, "uuid": "1dc5ee9c-1cf4-4301-8a01-a7f42d9f9191", "comment": "Malware payload", "value": "89e13d53438f6e4810e8656d5367f7e7", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787196087, "uuid": "3d999182-175f-4a23-9c31-a8dc40a476d5", "comment": "Malware payload", "value": "384418cedc4a09e4b2a2ce68031f885c347f50659ab397a2524991f55adbf4fc", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787196087, "uuid": "d00cc17b-3d49-4af1-9e85-5be51947910b", "value": "T1D2733CB1826C687B312B97DED1B1B714B0915631CF462991F3FE82B84FC9E906875B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787196087, "uuid": "64b2ee4b-9d1d-4fe6-834c-68d597ae1c62", "value": "1536:HWCypGRZeFmN262HfeFi6CpKkR0b1KDjYCMRW:HW7kZeFmN262HfeFv4KkObcDjYCMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787196087, "uuid": "99215ac7-a393-4e70-bef5-cefadcb49027", "value": 75454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787196087, "uuid": "400b3eb2-b8d9-4f54-ab07-4edca2c2808b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d571021-9c47-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787196467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787196467, "uuid": "2f8cef1c-89d5-44eb-a508-afce1d2f5b9b", "comment": "Malware payload (Mirai)", "value": "174dd0bdad60dbd505879e545f6f2c17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787196467, "uuid": "8b99b7e4-ab96-48cb-984a-a87da4848000", "comment": "Malware payload (Mirai)", "value": "fc63d1bf597dfa26b660453e57e5bbec5df9b3dd2ebb112e7750215f6f3cf68e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787196467, "uuid": "0fee5cd2-082c-45f1-9791-2547439cfb49", "value": "T1EA057D58FE8E3D52D2C7F27C9E4DC7E1722B7195D26391B23A82024CD5CAAE8CBB15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787196467, "uuid": "fe302b11-8ae1-4f73-aa51-09bb0968c5d9", "value": "12288:QhMBrG/SbYhW1pOKknGMMGnlbmlX3+2jLrDBxFTJjHJ46yELvgK4w5X7tFqR2Udl:QhyS/jhWWKknGE8bjLrDxvwOIu/Urd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787196467, "uuid": "d0f872d5-dfee-453e-8f06-db5f47473284", "value": 853648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787196467, "uuid": "e9ce1cee-3917-4152-8087-d0400387905b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c007146-9176-11f1-8d7b-82aee05be84a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1787202849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202849, "uuid": "7935d5d4-dad5-4f11-b1e8-3a1b1e0a5f69", "comment": "Malware payload (RemcosRAT)", "value": "b975547dd90e06f19a66d324a70c4a32", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202849, "uuid": "a1124c5a-2fa5-40fb-b2c2-5cd963c7c72b", "comment": "Malware payload (RemcosRAT)", "value": "70c0c96ab942433b8a5965ce46ff9a582e7f532ee19f865d1131aa688f178da1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202849, "uuid": "c0e90877-ae9c-4954-9690-6cc1fe262c91", "value": "T1D6528CC57C285C4448B0737E18E1D45A8157679062012A21F0CC74A70FAAB68CCE35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202849, "uuid": "ccdaf7b6-6d44-44e9-bf2f-ec3470297e55", "value": "3:PouVKzEHjJXUIk+OgIlqFbWR0MBqBcMBh0udCmX0aH/HWAIMwWKBcWWGb:h4I3ighWGWqqMZX1/uMwWXfGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202849, "uuid": "e78f0271-a372-4df7-a3cf-0af94e5dc6fb", "value": 14133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202849, "uuid": "f5d2e916-53a3-467e-9a22-eeb302aaa206", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88122f84-91a3-11f1-8d7b-82aee05be84a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1787202850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "90ba0aa9-9b59-44ff-bc36-18a97a624a74", "comment": "Malware payload (RemcosRAT)", "value": "9f3598ecaca6bf44c275fddd58a778b7", "object_relation": "md5", "Tag": [ { "name": "remcos", "colour": "#9984a9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "725705c7-031b-4858-a54a-7e21aec20bab", "comment": "Malware payload (RemcosRAT)", "value": "6b56330453cc8a4b161ac71d6a9438d0aa8b9ff9971e42e64e2645e313445dbc", "object_relation": "sha256", "Tag": [ { "name": "remcos", "colour": "#9984a9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "6ed7c18d-41e0-4414-abd0-fa16da77c590", "value": "T149628CC66C285C0A84F073793CE3D419E025268022402611F0CC68AB0FE9B14CCE36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "e34a7832-f841-4e89-b55d-13bbef2c24ed", "value": "3:PouVKzEHjJXUIk+OgIlqFbWR0MBqBcMBhc7FgrpB6MH/XWAIMwWKBcWWGb:h4I3ighWGWqqMcKP1/+MwWXfGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202850, "uuid": "6b522634-369b-46b8-bd37-d0b2616ff59a", "value": 14625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "2a384171-ef9c-4919-9774-829c95c3c33d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85b2ff8-9039-11f1-8d7b-82aee05be84a", "comment": "Malware payload (CoinMiner)", "timestamp": 1787202850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "8dcc46f4-4f38-4566-8021-5c7a8bffad37", "comment": "Malware payload (CoinMiner)", "value": "9be51f221795ed8ff192a5eee1777f70", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "a3e6660c-8069-45b9-bc89-a3e3364f22c9", "comment": "Malware payload (CoinMiner)", "value": "e865ccdc55aad38dbbabad97e930951b379d8a51e31ed4163999876343f218b4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "c4a6825b-6c0e-4675-916f-534fd020f906", "value": "T14AD52369A38772DCD13784B40D9902EDB3B977A0CA835AEA1BC3B7316E531D57E163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "3b998238-cfbe-46ba-8547-6597ef0642b7", "value": "36dab651ebd71b404011f23a733060ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "81c7de86-2c12-44c3-a71f-2113919bedac", "value": "49152:XEWLjP1tR+varaPQRN0CWG14fCot2vbExxOkan8AVqAKE52:XEWLbMCrLNxWGuFgEgka8KK62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202850, "uuid": "35745054-e2e2-46af-9544-329082ecf125", "value": 2758496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "a0eed1c4-16dd-478d-89a9-bc20ca629bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d6b18c-7fdd-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1787202850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "293c9dfe-06fc-42a6-b7c0-04e7688d921b", "comment": "Malware payload", "value": "3849f30b51a5c49e8d1546960cc206c7", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#4d4007", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#15a23a", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "19a4c95d-0d80-4f91-a9cd-22d3c7ede66d", "comment": "Malware payload", "value": "f6c97b1e2ed02578ca1066c8235ba4f991e645f89012406c639dbccc6582eec8", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "bash", "colour": "#978035", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "cowrie", "colour": "#4d4007", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#15a23a", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "e7f4c2a1-2cfb-4fc1-8eba-45385e7d9d90", "value": "59D31322D3130C4FC02579FA7A2BE62A39873E6A24CE449C45F5D66A2FB7084ED71753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "be22da60-22a6-4a07-b237-fab800c093dd", "value": "3072:biMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:fYFJvwe1gKCYVl2szN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202850, "uuid": "3a295f25-919e-4f1a-b42d-66b4d4633952", "value": 137480, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da384b70-9c08-11f1-8686-82aee05be84a", "comment": "Malware payload (RemusStealer)", "timestamp": 1787202850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "28c255a9-81c6-45bb-a010-be769bda5156", "comment": "Malware payload (RemusStealer)", "value": "656520f8a060f84253be72512beb3406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#ddd7e0", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "85ec276c-c039-451d-a7f5-a3673402888f", "comment": "Malware payload (RemusStealer)", "value": "4f92f1b658856b2662100c26dcd5f81525a74482b4fdebb16923ec27234f0a7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#ddd7e0", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "8a726838-f2b0-44e1-a247-804b89bc5201", "value": "T10E54CF05F7AA50ECE1778474C9554A62FB763E5643809B2F0360C772BF136A0BE29F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "1bc6f688-b548-4cd9-9cdf-f5d1746ce80f", "value": "905d6e2fd95bb9d68bb959ec7e8cfb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "e8a425f3-7f94-42a6-b124-349c7c413adf", "value": "6144:jknVrlmji8AypzUBAzL2oWAEqekzOqS0XmTUmpwnpD59+5NYAW:WVrlmjivy9VzRWAjaqhXmrINU5NYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202850, "uuid": "ad7672b2-0b9f-4016-86ff-30c06aab545c", "value": 294240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "d6cea69d-c9c4-43d5-80f1-8b46f9d86f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680df349-8a8a-11f1-9f62-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "c82f3364-2d0a-43df-a320-b06bfde5e12b", "comment": "Malware payload", "value": "7d25bee21215995458ca135ce67a7808", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#4f70a0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "52636857-c16c-4562-b225-beb3408ff906", "comment": "Malware payload", "value": "e59711c5e2e7d071d0810743998a21338951a33a96836a9861f08c58c6e07506", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#4f70a0", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "460c68b7-cb57-4a4a-a99f-afa3ad8db074", "value": "T1CB52463C4BF6FDC087CBE2B98049661340E4467B75B10B29F4EE85536B5C21D1E3A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "e1f203a9-6c51-468f-a68c-cdedb198efa1", "value": "48:32h4uuQ/Sh4WxuQ/Zlduuuu8QhOduwcePoyUGRg1h4KeNh4t/xxyIuQ/52h4nmG:ZuuQ/FSuQ/7wjkekzuQ/Th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202850, "uuid": "cfcb77e3-1af6-4949-a852-574659123389", "value": 14429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "8b162365-2935-4912-a580-6bfcdadfa82d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7669d9c-9258-11f1-ae6e-82aee05be84a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1787202850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "8ba90e88-360a-49f6-828b-acbdb46e5f31", "comment": "Malware payload (RemcosRAT)", "value": "99297ea01f05bb67bb2fe5002631efd3", "object_relation": "md5", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "be733fe5-5613-459d-9a36-6fdfff918e20", "comment": "Malware payload (RemcosRAT)", "value": "3461afab8272ce85521811748177f5f3289b53c252ed5c8b98a0aec80892b321", "object_relation": "sha256", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "e266f9a2-4167-4101-9815-c19fee8540e8", "value": "T14835630FCA3AD114DF39BEE1CCAF1AD1869945022770AA97F7CEA4C9B5194D40274E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "9d7cc1b7-6c93-4dce-ab5d-aa17b36603e9", "value": "384:9kB1SoJ29LDWICIig1WHdz4ZWUd13k8zUL6/LOxrRNoIKns70sAAFqosYsiH8:9egf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202850, "uuid": "dd5df979-17de-4ab7-8eef-299a3f4dd09f", "value": 1095295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202850, "uuid": "b0d42a44-d8cc-4a50-9981-dc2196ca83fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236cf05f-8fd8-11f1-8d7b-82aee05be84a", "comment": "Malware payload (PhantomStealer)", "timestamp": 1787202852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202852, "uuid": "1e8798e7-5a3b-4b2e-aedc-9675eb9a600f", "comment": "Malware payload (PhantomStealer)", "value": "c67f0473eae2e790676584b108e7ed73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#aaa46a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202852, "uuid": "cb579735-e042-4df6-b277-1b5d756f0dae", "comment": "Malware payload (PhantomStealer)", "value": "c0654ca707fd45d9563f46dbd51fc03b75f5a05ec0ffc26816bcedcd13520b31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#aaa46a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202852, "uuid": "30f5a557-3aaf-422a-9752-325f66b7f92b", "value": "T191F4DF5873E85A01F1FF6BB294B19D51AB35B513A961D71E11C081C80EB2B918F8AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202852, "uuid": "0344e9f4-084b-4f7c-8d19-b3ecaf5b7b32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202852, "uuid": "383d674a-b49c-4120-9550-074d5968a99e", "value": "12288:g9jVxqkqjVnl36ud0zR/6CtQ9PUHIG8DXjAGq2amJYeQab/3NUW6m:g9OkqjVnlqud+/2P+ATAS/JYe93NUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202852, "uuid": "fd625a35-dac3-445c-ad68-df51cf2f148d", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202852, "uuid": "93dc1a89-8df7-44ae-9350-01a6f7e63adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f29aa6-9bdc-11f1-8686-82aee05be84a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1787202853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202853, "uuid": "13a811b2-0a19-4f35-9ad4-cf247ef6d56c", "comment": "Malware payload (RemcosRAT)", "value": "6fe3c0b3a0cdecf91b9ff46b16faf2b8", "object_relation": "md5", "Tag": [ { "name": "remcos", "colour": "#9984a9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202853, "uuid": "347f333f-ecec-4088-9b98-d81b3ed22082", "comment": "Malware payload (RemcosRAT)", "value": "f0262f2f37f5557cca06d49b951ab28c49e5796fba28365a117abaed031aa53a", "object_relation": "sha256", "Tag": [ { "name": "remcos", "colour": "#9984a9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202853, "uuid": "d0391232-50a5-46cc-b9e5-f4b13813e029", "value": "T1DFF585B9D4E079EE2AC0FD2FF0F52C1254D64E2A2BA7E1D487D30A8F0D422798E549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202853, "uuid": "ca8f07f3-4083-44ed-89a8-ae1d78dc3a4f", "value": "24576:fndafxE/VRfnE17HB0QTAbJWIC9ahR+sy7fn8gGQKtDs0N36Y95jiNyS2HQRhr6L:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202853, "uuid": "46dcc500-f118-464c-860a-1f76e8bbbdb7", "value": 3562894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202853, "uuid": "470cc535-8a23-4cd4-9640-582904831f61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1180364-9bd8-11f1-8686-82aee05be84a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1787202853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202853, "uuid": "396dd4b9-3e7f-46af-b7e5-b7163de8fbb4", "comment": "Malware payload (RemcosRAT)", "value": "d525d94089544aad1276602cb9551c12", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202853, "uuid": "c0493f12-4dbd-47a7-acf2-aeadce4d7dff", "comment": "Malware payload (RemcosRAT)", "value": "cc2b96a6c355518992425086221902594f98c16b2825f517d961f35368bba14d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202853, "uuid": "f4b7525b-83b2-47f4-af0f-a71c5b0b78f1", "value": "T146F596F5E830E9D9239DEB589BC618F94EE204BEA86B91C8C47FA59713E3114DC63C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202853, "uuid": "afef581e-62b2-4039-8488-b6581e91e6da", "value": "24576:La9T9zyV0HWP8ASBDYcP3bvbqWfoV1mBij7akUt8HIXA:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202853, "uuid": "7985c59c-ca51-48a9-b823-2fe1fa658769", "value": 3518524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202853, "uuid": "abea69ac-348a-4d96-b38c-fdd4f9f1560f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c3c3fe-9bdd-11f1-8686-82aee05be84a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1787202854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "908e39ce-723a-4a5c-9ba4-306f0a1d4ee2", "comment": "Malware payload (RemcosRAT)", "value": "42a5b4406142d9f5833653f7b6e7a487", "object_relation": "md5", "Tag": [ { "name": "remcos", "colour": "#9984a9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "d174ff6f-6d80-425f-b660-2decf862c99e", "comment": "Malware payload (RemcosRAT)", "value": "adfefc2614695191b1a6e4050e53784a56204f03da3f1a6c55a90ae08ed16e72", "object_relation": "sha256", "Tag": [ { "name": "remcos", "colour": "#9984a9", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202854, "uuid": "f40c9f24-300d-40ac-bb87-c5e61175fa89", "value": "T1D606B66FE1BE9F2187412C5FD6E29CA11ADD1976E2C9C8E6D070DFC528A3D244BB1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202854, "uuid": "21bb5c40-d20f-4f81-abee-46c6836629ee", "value": "24576:DWDGnGwX3HBEtYA+EkCiRJIIBTSIesLHp7bAB9NfIypR25ujpQFzn+oOpdmDAmqa:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202854, "uuid": "ebe3ccf6-110d-446f-93ba-7ffb6871e9f8", "value": 3789820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202854, "uuid": "603ffb11-6ea1-435f-89ef-8dd42e80cb78", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6e6afe-9c55-11f1-8686-82aee05be84a", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1787202854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "be486097-9bc7-4788-9161-2090aaacc3f1", "comment": "Malware payload (PureLogsStealer)", "value": "19ae771572b0f04cc31deca91836ed97", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "5a78d1b0-0f9c-4ced-8e92-453dbe88f79d", "comment": "Malware payload (PureLogsStealer)", "value": "5963a9491c91eae44384e239284fdc74dc3db9ee1b13c24eccc516ece350df34", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202854, "uuid": "6f84fb02-44b8-4b3f-a838-92efe825e722", "value": "T1F1567D8E4155C9DD71EC9F19CC66F6D20B5E81270CA0BF133E2D655D9E48E0A332CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202854, "uuid": "35caee01-69e5-4cd1-b75e-08a975319e50", "value": "98304:ZAqv8h5g+Hj2xjMTadfxCCdlTrgYEXoh/hihzZqjRgyJJZ9HEXKZDsKsmTZ/raDF:ZZ7+CSTIpzdNr0z8RxTZ9dZI0Zqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202854, "uuid": "adb712a9-3fe4-48b8-b912-e167fc64e7ea", "value": 5976047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202854, "uuid": "8bd8c3a3-2da9-4506-8fc7-05c9cadcd113", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a41d5df-8a8a-11f1-9f62-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "5ee2bbc1-c4f1-416b-b8d0-54b38ce9cf43", "comment": "Malware payload", "value": "af48a0d4ac94a864fa6f481b4bc9d8d9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#bf35ee", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "341fb284-fd5b-4f92-9c97-cde1a1b7b6c1", "comment": "Malware payload", "value": "fa02ab08a5c04901998324f048d7c3d30db615e5f2435c13992b3221ff313598", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#bf35ee", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202854, "uuid": "819f62b8-f199-404d-bad1-164374834143", "value": "T16556F789229496763B20AFCC4B3AEE21875E420704C5CF91B19EE71E3B5DD1BA3097", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202854, "uuid": "3fe1a881-f50c-4819-8da2-f15f44860a32", "value": "98304:Pj0S8Czuy1foUpuguv3YN9M4rNG31avbDeW2hJQT6yo7eKzZ34I1H5T5ME0sjvH/:Pj0S8Cz/1foUpuguv3YN9/rNO1aveWsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202854, "uuid": "2d756903-7789-451d-9564-f229a2fd9564", "value": 5981511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202854, "uuid": "6b289222-9131-496c-a66f-b84a09482469", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97216977-98b0-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202910, "uuid": "cb3d57cc-33a2-428f-be73-b57d2966a9fa", "comment": "Malware payload", "value": "811e69d5075ffe5ab50de2ba02fde698", "object_relation": "md5", "Tag": [ { "name": "217-60-195-219", "colour": "#e8bfdf", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#607e08", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202910, "uuid": "d6750df2-2691-4951-a921-33e43007dcd9", "comment": "Malware payload", "value": "a367a461a57c1dd3f2ce3a975ea950d37023870cc9083a54d471ff3cc266b43b", "object_relation": "sha256", "Tag": [ { "name": "217-60-195-219", "colour": "#e8bfdf", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#607e08", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202910, "uuid": "dc6587b5-a815-4e78-9f18-0fb5bd21b163", "value": "T1E501D6D7001EE47FDF23CB25D70986C6F12BDA7088EE334A6272585B7801A0533D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202910, "uuid": "04a9cbd3-f83f-4fd4-ba0c-aa6a8e53f5cb", "value": "24:3LD8Y+M4dzxkj9mS1ATxTS1AhxlS1AlxmAS1AHxm1azAV8APAj8AJ:3LDXwEmSiSCS+SFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202910, "uuid": "2955b880-2b9b-45de-8702-e14d8d06d04d", "value": 798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202910, "uuid": "e1d0d7f0-e31b-4d73-aeea-24c76fdd215b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb68c5c-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202912, "uuid": "b902b3e8-13e7-4521-8e7e-5777c7b849ce", "comment": "Malware payload", "value": "4ee2edd53545f4b8d24d5e0db2ce9ad3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202912, "uuid": "154b58af-d239-44e9-bb71-80555fa94c00", "comment": "Malware payload", "value": "1bc067d7bc73a5205544164b122634bf25d98c2b6e81a3353b895aa9d0d3707c", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202912, "uuid": "859e7944-d80a-41b7-8443-abe588defc50", "value": "T19DC1525DF888267485F7962864E75305FDA7020F8128072079ED81E11FB275AE73DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202912, "uuid": "9b079c2d-87eb-41e0-bfeb-dfdec76352bc", "value": "96:1ZSeF8nWaoLJI3viVHEdsj/melJqpDi9kmCcLwFGBy2GJmCucmfmnlBmC2mVmomy:zRnMEHEdsrm+kmzL01Jm/cmfmnlBmjmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202912, "uuid": "42b4f53a-a19a-4253-a4c3-f7b75f5c92e0", "value": 6013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202912, "uuid": "cce24fcd-6d79-4851-b652-1eea8589b59a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee3f8f4-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202912, "uuid": "76ecbea1-2077-45d8-8e28-c39b8d64d712", "comment": "Malware payload", "value": "367b186e5576335a38aeba7b2e9c06d8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202912, "uuid": "07b85a41-911d-44b8-8422-f4d143b94c0b", "comment": "Malware payload", "value": "e61ada7705acfb837faa1fd96bc3f733ee174a3562e423ccd2707ddb15cccb8f", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202912, "uuid": "da4bcc27-e012-4f35-ab92-56c0fedb6592", "value": "T14481C8D7AC01C3B146B18A4A5A7AD00CEB88203759B17461BC8CCC874F3C37EE3940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202912, "uuid": "a0de89e8-5907-4312-918a-15c842349d4d", "value": "48:NgEAW4xH87DWDawjYgYfTdv/dGhJjCO667kR5/Wo+yhg/3:FAW+87DGaeYzBndyJvR7k5/JZhg/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202912, "uuid": "18af7882-9af2-4b1a-91de-95992eed0805", "value": 3829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202912, "uuid": "f98edf30-f013-4612-90ab-5343f9ba64ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2268f078-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1787202918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202918, "uuid": "34078d7b-cb4c-481d-b943-a4cb80880900", "comment": "Malware payload (AsyncRAT)", "value": "e74801a02e6ff13c0a94c5b274b78569", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202918, "uuid": "0dabfad4-8e17-4077-b9d4-415e2ed9c80c", "comment": "Malware payload (AsyncRAT)", "value": "60f3280493c50acf8ccc3b128177e714a7dd58dc5f89871ad6683ab1539b382c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202918, "uuid": "f28116d0-d62b-46c9-aad3-87960542045d", "value": "T18421E095A464507386ED0ED12E07AD24330F94F21E88D7CB7476497DA826A6AE2793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202918, "uuid": "b6da5c1c-106a-469a-883c-140136032589", "value": "24:AcuVrY1uNQ5iZpyZwMvXA051A4HVpG3BkCFuVM5GOD8A4no0k8vC7zPxjuD5lnA5:zuyaIssXlTH+kauXBvktzPKI00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202918, "uuid": "9357e700-a917-4ff8-a285-b4b40e6fbceb", "value": 1239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202918, "uuid": "5946acac-0504-4774-a0fe-62f35d4d0a0a", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22773178-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202918, "uuid": "fa6f1444-1356-45d2-a004-cce7fdcb7e2c", "comment": "Malware payload", "value": "0ae8142ae790ed498c04b85f489fde96", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202918, "uuid": "b07e8f56-b69e-4ff9-aecf-55de11266a2c", "comment": "Malware payload", "value": "802069736d28e5c16bce132a1cfe905f6f9c7ae44500cb32c3a34e93452400d6", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202918, "uuid": "795a0c54-83d1-45f6-8094-ffaf0e4dc9dc", "value": "T1C9258D33E213C866E9A764344C0B55B48830FF52A97AA97E3BE87D1CDF326D378251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202918, "uuid": "5738fc97-c970-45d5-a39a-5d22fc856100", "value": "3a2ffbe33592310cb39abe8a3f252614", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202918, "uuid": "c74267b6-ffc9-4844-afe0-69a60053baee", "value": "12288:w7Psf46qDSsacPAwEAcXGBng9hSQq5yqeUF0xp58jtsz6SMz:wDi468PPAg0Gm90bUUaF66VMz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202918, "uuid": "5c56e529-1477-4046-8b45-740087a9bb83", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202918, "uuid": "bee93baf-2721-4890-a05d-76ee890a8dc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23237bc2-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202919, "uuid": "cb04f225-876a-40b6-8e57-5e35c111ee98", "comment": "Malware payload", "value": "a60a2c8a9473d7b087e7e3e19044b7fd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202919, "uuid": "401aef95-9cad-41f8-9f8d-c4a0417908eb", "comment": "Malware payload", "value": "417f396852e6b1f4360ff1e4c16b85bd65ba46faa5c71fb97816b0a796d8055d", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202919, "uuid": "caf92fe3-42eb-461b-84b2-df01544b3368", "value": "T10EF502BD62503398D01E88385437FD55B1F6556E0EB986E976DBBAC03B7E810E702B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202919, "uuid": "71d056d4-a042-4d22-a049-8d48e8dd7bf3", "value": "4e47736629dc02327ea34cef775732eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202919, "uuid": "0b85d718-96f7-48b6-ba91-a182229bd9ff", "value": "49152:sP2SGzIaaxhu1ngj82MractKOGOU1gPQKu9uFgyrAqto3BNDU+bzhcEibAwy0ZBL:g0IhutgAraqNUiLu9uFHrA7NDJQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202919, "uuid": "352c25c0-589b-4d5c-aa7b-35ef82b79344", "value": 3560960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202919, "uuid": "9bc8f877-bc99-40b4-9f74-f6bb654bd5d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2748e6a2-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1787202926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202926, "uuid": "de33ab55-a416-4740-8455-dc2e3265cd1b", "comment": "Malware payload (ConnectWise)", "value": "0675f7ed8665b16d101ed18748c84206", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202926, "uuid": "8152f6cd-49cc-4cb9-93de-320c0be28db2", "comment": "Malware payload (ConnectWise)", "value": "98fd04031af897a657b71eebc1a3d6576f78d52a497c11868fbbce1dda893fbf", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202926, "uuid": "e1525092-d0e1-4fc7-ae66-deadb5825dcc", "value": "T156A6232063E58466F1B70A3EEE3586F4597A7E25DE12C08F63A4791C6D32E50CA723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202926, "uuid": "282a93c2-8bff-4f8d-be3c-d3527b4b1ad3", "value": "196608:AgHxiFSsYwwSA/OdB+i4xzeebgHxiFSsYwwSA/OdB+EgHxiFSsYwwSA/OdB+LgHJ:A2xiFxbwpacC22xiFxbwpaD2xiFxbwpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202926, "uuid": "9a437d6f-3620-4118-bfa9-2f496918a4f3", "value": 10227712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202926, "uuid": "373ee58d-d6f4-4e65-b657-6ef0d428e48d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "868296e4-8a59-11f1-9f62-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202934, "uuid": "486bd1ad-8d40-4a53-af0f-e30ecf5ac098", "comment": "Malware payload", "value": "ae2102521c9ee919a914bdcf93caa94a", "object_relation": "md5", "Tag": [ { "name": "94-26-90-90", "colour": "#32c193", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202934, "uuid": "1d553cdb-7f02-43a4-8108-798f9ffc97a2", "comment": "Malware payload", "value": "7e74a48ebaf713b7ecc828938a114bf32a9d3383aa51df88434b5a04a7f7915f", "object_relation": "sha256", "Tag": [ { "name": "94-26-90-90", "colour": "#32c193", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202934, "uuid": "b986f07f-0be8-461d-a2a1-eb82469d64f4", "value": "T15717BE45F2A252E8D667C074C166AA17FB7438BE03502AFB9AD099746F37BD06D3B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202934, "uuid": "95d32cfb-70a3-498f-93dc-fba55941bfe6", "value": "fc88bc9682352dfaf769becc8004ae0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202934, "uuid": "d1716d0d-f912-4606-b8b9-fe17dc2aaa57", "value": "196608:wrTP+eIOIvKRBVRB0EW8QkkplzPApX+1z/iMR052fM1fICRcyXo:qTP+eI1q1kfPAR+1z/hR052EJp74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202934, "uuid": "1eb26793-1b9f-45d5-800b-8792eaf166ab", "value": 18688512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202934, "uuid": "f4403126-44ab-4b6b-a7fb-404773578ff4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de8b678-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202937, "uuid": "b87f6cb0-9e75-4df3-abaf-17c771b82bb0", "comment": "Malware payload", "value": "6b6830a2ecc2e48c4d418573dbd69da0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202937, "uuid": "99bd515b-9eb9-4833-991f-00f2b1552a19", "comment": "Malware payload", "value": "b0206e3effd345734a191751fd7dcf412e1264e5a9671347540183dc37507b4c", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202937, "uuid": "7d618f7d-48fb-4083-b58c-0b0e76c5c52c", "value": "T1B97733F1B442896BA9C1DCA0E7C5C184E28641E5CE743D77E16A53F3C2E7AC794E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202937, "uuid": "4fc69047-642c-47ec-b10e-9ddfb8532dc4", "value": "786432:A87VCxbdhnfCJMGPk1Di4DNOCFzzt7P18AnX07UL3Ear:XQxbXnfCJMAYDi4D0C5Z9nT3Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202937, "uuid": "e7c2f581-40cc-4d76-b3cc-5bdccdda08a8", "value": 34593666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202937, "uuid": "0da8f3ec-8533-4bd6-afd5-ee4c2de5577b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b095c8-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202957, "uuid": "f62a11f4-c7ae-4ce9-a06f-ccc33a3c446e", "comment": "Malware payload", "value": "0efac239d6ff7e1067eae2027509dfe8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202957, "uuid": "b5143439-3ce0-4668-bfbe-953615e26328", "comment": "Malware payload", "value": "aaeae4c452096b11902e0077e6fab22aa3d1f50266edb2643e38278e0f5c6c0c", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202957, "uuid": "f3b5b057-ed4e-4e31-8f28-a759783e67fb", "value": "T1FCC633AAB75A08DCE84F233B98D289679BF178214BE482C757F85A040E635D4FF397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202957, "uuid": "17726533-7f3d-4dae-97cc-88b7b5fcdad6", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202957, "uuid": "e5ad7bef-0e9c-48cc-9a82-5f2d5e1dae33", "value": "196608:soV7MF00W8/LayNTwhL1FUV55AH8DWu0krdpWrGCO+tbEOQH2dOJ2/lVJIJ7Lk0G:spxW8yL1FUT5AHA5TWru+tbPQHdJ2/lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202957, "uuid": "049d5fd8-6abc-4db2-92f2-613458d50f80", "value": 12091500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202957, "uuid": "34e7edc3-cf9f-49fb-94a5-25d9921c0968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4792a246-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1787202980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202980, "uuid": "f71c6f09-a7b8-453a-b565-f8e93aa6115d", "comment": "Malware payload (ConnectWise)", "value": "bdc4cebe690b1862c3c6792e2b0103bb", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202980, "uuid": "97687a20-ca72-424a-ae52-092f2dbdc2df", "comment": "Malware payload (ConnectWise)", "value": "10de7dbb4b67064d3dde4e2290916ae4cd7bdddb4b32f264921482616e273f0f", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202980, "uuid": "7d31853e-0cdf-40af-83da-20773b0461f6", "value": "T124D61211B3D6A5B6D0BF0639D87982A55675BC058B62C6EF53D4B92C2D32BC08E323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202980, "uuid": "81063bb2-6aac-4ffb-8a80-6ac66848c3d1", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202980, "uuid": "aedb4004-9950-4263-956d-762b6113fb2b", "value": "393216:m2xiFxbwpazCg2xiFxbwpaD2xiFxbwpaY2xiFxbwpaJ:ZUFxMpKCDUFxMpxUFxMp+UFxMpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202980, "uuid": "20bdeca2-0c64-49c8-9926-b2ad9b6bf3e3", "value": 12809272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202980, "uuid": "3da588ac-a322-4038-9b84-df8995fa5882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9d468e-9a52-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202987, "uuid": "a5a0f80a-0f3c-4ea0-8036-4d14176fb525", "comment": "Malware payload", "value": "d0164ebf032ce6636e4ffd6dfda16cc7", "object_relation": "md5", "Tag": [ { "name": "94-154-43-74", "colour": "#d3f162", "exportable": true, "hide_tag": false }, { "name": "apk ", "colour": "#b41558", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202987, "uuid": "5e61e6a1-5f5b-4f0a-990f-43adfdc0b0d7", "comment": "Malware payload", "value": "1666d5be9d32b681fc10a2cd3e41eecb9d1ab913658248d560ca5bca6f2e036d", "object_relation": "sha256", "Tag": [ { "name": "94-154-43-74", "colour": "#d3f162", "exportable": true, "hide_tag": false }, { "name": "apk ", "colour": "#b41558", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202987, "uuid": "b229cbbe-d32d-4647-a758-c03f5a07ecd8", "value": "T195B29D33CF3A0136ED921B71DB7CE3B70E998B848A2ABF5456157D20BE572844644B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202987, "uuid": "b50d8df3-8b90-45aa-bd41-9b92916ea4ab", "value": "192:1wDr6dEBafgLGtwQ2Q0Dt0JuZAM5eNukRuhyDFNnH1oQPDK6TWt0sRmTvk:HUaIqmQ2z05JwkRuwDDWQPDK6TVsWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202987, "uuid": "51aed5f2-b310-4434-aeb3-dcad180710bf", "value": 24324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202987, "uuid": "833a9166-a3a0-47ba-8ed1-87f52259502b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ef0150-99c2-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787202990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202990, "uuid": "60939dc8-1c93-4726-b332-2bc36a4a81ca", "comment": "Malware payload", "value": "7066848c97e3505b260abeb65f5c0122", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#472c25", "exportable": true, "hide_tag": false }, { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202990, "uuid": "03123464-180e-473d-881a-459c0c16730c", "comment": "Malware payload", "value": "6b58d360729582335d241c0f35676459dd5634b85a7a4a8a634269bf2e37a7b6", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#472c25", "exportable": true, "hide_tag": false }, { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202990, "uuid": "3b8da563-f553-4e75-8914-563b77c510da", "value": "T17D072337F28AA53EE06E5A355AB3E21455376AA06D138D0AD6F4045CCF391603E3FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202990, "uuid": "ffd23a3a-90c5-43ca-a38f-1dbeb020f4fc", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202990, "uuid": "fabc5196-6f11-4a4b-a2cb-858d53345a67", "value": "196608:nq3IYDjEbP+HpPr7aEaIBDnqSpLiJMlLG+4ux4OkK:nq3Pc7+Hdp5WMLG+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787202990, "uuid": "64f54bbf-2511-4385-a5a0-36edea7b48b0", "value": 17493232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202990, "uuid": "30b4a48e-f485-43c3-b5d7-e854b55e427d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f3c94f-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787203026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203026, "uuid": "9333c244-105d-4985-9f2e-74e8ae4edeaa", "comment": "Malware payload", "value": "3d0a2d10055ac263a52148348c2f5a3c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203026, "uuid": "b221aedb-2d2c-4437-8428-a75acb7e0b8c", "comment": "Malware payload", "value": "541c69880907d311673ac16ae14e04b94ca140252db3c37d215f94dbcc1f5a9a", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203026, "uuid": "f1157635-04a6-4637-8453-dabcec822e92", "value": "T15E01BDA1A2213BF05F062FA1BF539504255B50470F44B0EA68E764DCE4BC70D77747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203026, "uuid": "2c23b009-5ef5-45ac-9038-72a96349953d", "value": "12:Uy1WCrfPY+UeEv9DhnL6dL62DA+aLPnR2rLHWrdJSg1/j1KKH3LRfR4EVFEv:USrH5UeM99nL6dL6PnZC2rff/R33Lb4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787203026, "uuid": "648ee73a-73b3-4e86-974a-9b62f039fc1a", "value": 762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203026, "uuid": "68eb8b36-45b7-47f2-9a0a-e1bf0e500cef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c121410-9c57-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787203390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203390, "uuid": "df46ba4e-a207-4193-b472-db75d6db560c", "comment": "Malware payload", "value": "73650b24e045a4636ffba752fdb5b743", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203390, "uuid": "16c8fdc1-319e-4f63-bb5c-611beab076f0", "comment": "Malware payload", "value": "7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203390, "uuid": "a8b8191a-f24d-4df2-b490-f1cc021a1616", "value": "T1AFD5239A66F34875E837C371CF83E0ACB06D77854A631E4F3ACE59608E926146D363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203390, "uuid": "9e547602-fbca-4ef1-9f3c-154c3f7365e6", "value": "b8048b8957358587b4fda264349e8f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203390, "uuid": "6013b908-687c-4058-b2dc-7ebcf872f6a5", "value": "49152:sqKwgHZ1sa/+f8qbbh/OCSAZrrbWFxtAFTsA/vG00e20SrHy7QOtMugQvgXcP:R21u8qp5Skrb+tAFd/u5pWtJVvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787203390, "uuid": "ad43b6ba-9d59-4f10-8c61-ad1bf8591b8b", "value": 2919936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203390, "uuid": "9397d826-be26-4d51-b75d-4f956d7b2ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cc81e2-9c57-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787203627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203627, "uuid": "810e3998-7809-499d-ae37-fe63838a3523", "comment": "Malware payload", "value": "360d8a6127788e0719bcfd3f78510840", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203627, "uuid": "14e56abe-a405-43a7-b3c0-badfa1303a9f", "comment": "Malware payload", "value": "7f47e1b053b724283eaf6fb27bb5a0598b669a56c2d4f5115f4de1d449447798", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203627, "uuid": "7f6c5c72-1c99-45aa-befd-c20918910dc8", "value": "T161A3013EDC6646B294AB68F723DC96FDC28066DB7224E4FC97B90258E00EDC185650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203627, "uuid": "a903bbaf-f8c0-4006-a668-6c2981abf30b", "value": "1536:4KATqiXTq2hz+hKBlhlAeTKOwnZqndUG7gMRVqmGlH8PZWNKgD09D3PFp9Khe:O2OzgKplz3neG0HmmH6WNKgDw7z9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787203627, "uuid": "58bb5fc5-b983-47b0-be06-7194b664f718", "value": 104722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203627, "uuid": "3d61d74b-02d9-492f-8fae-323dbf7b0be3", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e38029-9c57-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787203628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203628, "uuid": "ac6e17e3-b2ac-4ec2-9ab9-3ac7a197b963", "comment": "Malware payload", "value": "9944d3c0f5f625911bc445a5b0b4c2bc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203628, "uuid": "c841036a-634b-4e3a-b73b-be9e20647cc5", "comment": "Malware payload", "value": "35e37eca2a6905bac4d62a387d52a5b032fac52e28992ff29e1bfbf1e7d73c37", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203628, "uuid": "6431e4c2-9369-44ed-8da2-640ac35b4871", "value": "T1472122618C5094B3CAEE8ED37E52AD16330FD4F60E66C7C620254C6EE807C2BD26C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203628, "uuid": "9fb55ff3-4f21-4c1b-a53b-316f9e5dbd38", "value": "24:AWuVjLuVMoLGHxBlV3gLVF2k8vC7zPxjuD5lbjwgrmFuysDbNQ5iZpyZjoXJ13O:nuRudGHxbVO2ktzPKNZhIsbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787203628, "uuid": "7337c445-0a18-4761-ab48-788fc7863287", "value": 1373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203628, "uuid": "35700141-314b-4cb5-b0e4-9f3f808945c1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8c76d4-9c57-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787203692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203692, "uuid": "cfc745f9-8da1-48f1-aff2-6c0e55e870ac", "comment": "Malware payload", "value": "860178c62d6d7022eba5a4d557c5cd46", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203692, "uuid": "47889b1e-c89f-40ad-9afc-cf0c228b921c", "comment": "Malware payload", "value": "d2f6af703ff4f387ba765b8cc6c8bd88f494dd23ea55bae24b2bc0559d6cb502", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203692, "uuid": "42b3c264-028f-4e0c-a0c7-3c5cd47212e6", "value": "T122A4232E8A22963576BF30F356438D707F3CE45185D50B254A6B1FFA6EB10DE389C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203692, "uuid": "b125eecf-acb6-47d9-8b27-1d8740439587", "value": "12288:aD1AtEp8xIwVRqPkAOrZYDMAmDuJ2hcsSwIALkkC7:aUxIwVcMALg3SJecKIr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787203692, "uuid": "ccf53bfc-c9cf-4e4f-9119-6ecaf508c17a", "value": 457318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203692, "uuid": "88fb77a7-3b12-4dbb-a82a-b2171c63ee8e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0aa349-9c59-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787204278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787204278, "uuid": "f10c9bf1-23f0-424c-a26c-a2339044ae52", "comment": "Malware payload", "value": "0187bf1ef6341b0eb52e2dc0a1fef693", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787204278, "uuid": "c4ddbd15-f3e7-4ea9-b365-d5f3e934777b", "comment": "Malware payload", "value": "13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787204278, "uuid": "60a2e02f-6ac0-4348-8ae6-272c415f6529", "value": "T1D3D52399FCA628B0E437C3B74292707EF13E77514A784C1376C85B245E23A286CB76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787204278, "uuid": "20b50d07-b492-4c3e-9d86-226a4a21449e", "value": "24e8765fd838d429e6f908cdeb96c2d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787204278, "uuid": "b04f8fb7-ab95-4cad-9792-ea821970fe58", "value": "49152:5a/+MNJ/0KgIqLLnPSoAf8nU3GZX/Sf2M93635cJ3K0JEhn8wZVJAm+:w+MNJ/0KiaoAf8JXqekqpcFRJEhfzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787204278, "uuid": "894ef22c-da4f-4981-a0f7-96c974913340", "value": 3008512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787204278, "uuid": "30d88c54-a3ca-46ab-9ce8-f0f0ae4266dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200f42a0-9c5b-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787205061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205061, "uuid": "fe88a389-48f7-43b8-a21d-e70f1ea4106d", "comment": "Malware payload", "value": "289fec28b3fe35266be09a4f3ae14ff4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#bf35ee", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205061, "uuid": "ab02defe-9c8e-4eca-b7f8-afe846617056", "comment": "Malware payload", "value": "05bb646394be32f8b905262749ed243b9043d87d901984ab3f5cbe06974141bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#bf35ee", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787205061, "uuid": "9490fb1d-c418-4b8d-b91a-546d76c0db8e", "value": "T13C04EBA7330482BB6D76899FBF1988D952FDBF1103A070E2DE4A7C94D4A4B93C0E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787205061, "uuid": "243318f5-7e13-47dd-8cb7-406d500080ee", "value": "3072:aEAgvC/szP3YTmFr19axPAroEjmTPEPs4STW4tH+iAaqPe:VAMbYaHO4r2TPEf2wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787205061, "uuid": "6c17e2a5-b836-451c-b407-232ca070d5c9", "value": 179995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787205061, "uuid": "7192672e-6bbc-4cb9-b60c-1bf3f991f484", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e546eb-9c5d-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787206098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206098, "uuid": "f55647dd-408b-4820-8cd7-d8fa8726433c", "comment": "Malware payload (Mirai)", "value": "260833afb9a7478e5e1eef53e88b6854", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206098, "uuid": "820f46a1-612a-4316-9702-64f1a492e4c7", "comment": "Malware payload (Mirai)", "value": "42a6aa833f81b6e02e97d33613b95978d4dc5ec0d5229de820c6743ad4d72fa5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206098, "uuid": "e0e7bafb-7331-4213-9b02-923738fb0caa", "value": "T15B6339DAB402AE7CF99BEA7A44220B0DF420E35550931F27B76BFC936D721A5EC06C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206098, "uuid": "829fae2a-2072-4cc2-8b2a-c3d33f475aa0", "value": "1536:BbjtS19R8o4W7rF8BxeMXbvOYfDX4ps+XYjkFOlbC7E+4ypm2fl8npR:TlXTfkdYYFEmYEm223", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787206098, "uuid": "87e0a32b-f3be-4e53-9fbb-5fb4a5caf8ff", "value": 67176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206098, "uuid": "9263782c-aab3-4605-a382-75cc306667b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d709a953-9c5d-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787206227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206227, "uuid": "59a62b31-4dc1-42a3-9a9e-be9a211546d2", "comment": "Malware payload (Mirai)", "value": "58deaecabb919ef722e2d22dde97ca01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206227, "uuid": "b8234120-f448-4a93-ba22-86d23791b679", "comment": "Malware payload (Mirai)", "value": "c7cb01343d760f329205b7842a807ee8ac592f0493b6a22079491ecad35e04f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206227, "uuid": "0834c696-cbd8-47ba-86f1-3f9a4d3799ba", "value": "T1238363197E259F7DFBAC82388BB78F20934923D622A1D585D19CEE021E7034D741BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206227, "uuid": "dca50c17-7261-4b92-ab01-5fed3e85650b", "value": "1536:aEnCsJ39mU559v1OwekaJQLLZFRg8v3DrucGGUobCZU:ZCshoE1OwPu4ZFRg8v3DrucG5o+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787206227, "uuid": "9399c1e8-1d28-482f-8796-8a9c99b5d36b", "value": 88412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206227, "uuid": "8bdd2d8b-702f-49f1-8eee-50476bada94d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89c4822-9c5d-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787206284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206284, "uuid": "b217b44b-02ac-4bb8-b696-952b8ded3382", "comment": "Malware payload (Mirai)", "value": "6a11426cc7017ea1f239cb5380cd9dfd", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206284, "uuid": "0178f9a5-afab-4b54-b0dd-b881b4f6f2e1", "comment": "Malware payload (Mirai)", "value": "5977701072386f5b73c604446c54c0bd8f0ac9ad119baf9be0d49b439bea6523", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206284, "uuid": "ffba9094-b4d5-47c8-9fc5-9f1e45f08ae1", "value": "T1B9E32A46FA408B17C4C517B6FA9F42493322DB95E3E7330689185FF43F86A5E4E63A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206284, "uuid": "3f9b06e4-1bda-4dff-b55d-013c133db67c", "value": "3072:0nV/cy8QZKp80LAoqdUZkHT9UBfCyYmJlJiGwcfNipM/9tg1/Zl:45cy8Q4804Vz9UBfC3m7JccfNsM/9tgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787206284, "uuid": "314460b5-e349-4dd0-87c5-12b56f7bc6df", "value": 144486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206284, "uuid": "a130305f-7893-465e-a1af-9f259dcff20c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fca4950-9c5e-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787206403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206403, "uuid": "6ca5b5a5-f18a-45d2-ad8e-cf697d0c2b47", "comment": "Malware payload", "value": "017852e046310f3afdeb7a297437c134", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206403, "uuid": "6df710b2-d46c-4ffc-9614-805643d34b8e", "comment": "Malware payload", "value": "5761deb3f9eeaeada8c423c85fef9c832a38ad7d9f475a089b5e0df249802266", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206403, "uuid": "e84f5d5f-cdf3-452d-9eb6-61cb1a582912", "value": "T1F66633538E841648AE47F6F5784827ECBE4B9E5EB904404CB984F27C96C23BA7143B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206403, "uuid": "cd6f3508-e57b-49b9-9e06-2ac6ab3d89c1", "value": "196608:pgyuYPAzQF7euIwM/3o+grPcjHA+uzuff7Nu:pgpYdF8Po+gP6HA+uMNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787206403, "uuid": "d347ff5b-4b23-4ab2-a7ec-3ea0c54b1595", "value": 6922305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206403, "uuid": "574f15e0-6432-47e4-832d-a857f45a0d9d", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3427918-9c5e-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787206597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206597, "uuid": "09255a74-ef00-40c0-adba-f7d5504929e8", "comment": "Malware payload (Mirai)", "value": "e3d11a76814ef6335fde88362d4eae7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206597, "uuid": "667178ef-0e00-4388-8c12-807d0b035db5", "comment": "Malware payload (Mirai)", "value": "cb17af9bd8750abb7492620e48f44d45f89f0ca7e74556dcb3bf8cff2c4fd557", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206597, "uuid": "7b91b4aa-b009-4eaf-89b5-d278749966c9", "value": "T151633B03E98181FDC199E0B846BB7635C422F4BD123AB1977BC4FF1B2D59E601F1A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206597, "uuid": "b38519ed-b2ad-4ae4-bcf6-214cb25f4fb3", "value": "1536:yiH1yAqStWXhUxaiVjqlO9OlWOzz2kyhE0Q8sfhO0im:f4StWRSaiVenz2jE0QFhO0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787206597, "uuid": "cbb7d079-15d3-4ab5-9fd7-ee501696dc5c", "value": 68768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206597, "uuid": "91b48fd1-9b83-419c-8c0f-5963c6ceebf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f5a814-9c5e-11f1-8686-82aee05be84a", "comment": "Malware payload (CoinMiner)", "timestamp": 1787206675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206675, "uuid": "cc253572-d06e-4f64-b577-60282c88fcac", "comment": "Malware payload (CoinMiner)", "value": "5f8430227835881d5451bb0c083c2401", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206675, "uuid": "61aad445-78cb-4310-a6d9-cb448279114d", "comment": "Malware payload (CoinMiner)", "value": "c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206675, "uuid": "387915c2-3f73-43c1-a1c3-a3244afd0429", "value": "T16E3633A2ACC16170D053C3F54669207DFA79BF628A64BE17BBDC2D08CD8BA14593E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206675, "uuid": "2545a213-258f-4dce-8c7b-7c077d79fd66", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206675, "uuid": "88307a67-8f73-400c-8cc9-c4c37a3b534a", "value": "98304:8cMTdzQYSTc3SPrk6qRehso9cNr+R9hOscUF3xnxQF3jQ0snIYmORMwFFaXUF:8cMTd8Yx3CkdoWNr+zgQ9x03jQ0snxR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787206675, "uuid": "d62b2774-ec2a-4c17-b584-61741b46e35f", "value": 5220352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206675, "uuid": "8647e624-f242-4301-b7ca-67fdfe215513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cd0abb-9c5f-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787206823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206823, "uuid": "0ac35754-054b-42d5-9ee7-fc2d0c575771", "comment": "Malware payload (Mirai)", "value": "3cf8a4cc7a350fbab20f9aa699710274", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206823, "uuid": "0e14d7e9-dead-41dc-b482-fadc69c90947", "comment": "Malware payload (Mirai)", "value": "a49c0e59f6fabdceedeff38b5cb81de008594c6121be1f6316998d83ec48dd1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206823, "uuid": "54335dfd-8736-48a7-bef0-943b6881565e", "value": "T164733A15A93A2A17C0E4A53B11FB8225F2F6734E2570861E7C760F8EFF24B4469472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206823, "uuid": "2c39665e-f5e7-458e-b5ec-080df556dedb", "value": "1536:7PbGAZhxww0TiXwqFnN0NIOMmrBVbCzbEuS7eW:7PKAZ5FnCMmlVbCztS7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787206823, "uuid": "6b5a58a2-2bd8-4783-81e7-a52a6d599a52", "value": 74760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206823, "uuid": "79d02f1f-596f-4586-ab6f-4a6fdb9e1c01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15efe124-9c60-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787207192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787207192, "uuid": "cfd6d77f-bba7-4e7c-bd47-cc470490b22d", "comment": "Malware payload (Mirai)", "value": "737e5dfeaad2211b09b9837bed3572c5", "object_relation": "md5", "Tag": [ { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787207192, "uuid": "a9b981d5-0f61-4a94-b267-a594c38fdf18", "comment": "Malware payload (Mirai)", "value": "ab163943a962cb6bb8b55808a0d1d45863a36b65ebddf32b330b42600d8b77be", "object_relation": "sha256", "Tag": [ { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207192, "uuid": "8470b08e-3d35-463d-b925-ac8699334322", "value": "T186630882B881A626C7C51777FA2F018D3315A7D8E1DA33138D291FA077CA81F1D67B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207192, "uuid": "096b37c1-0d07-4343-8e90-c6c1551dedf6", "value": "1536:vNmpeqREkpmnCTmIJjxtrv8t46VOovF1Zd:vNXqRjjTT84mOGF1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787207192, "uuid": "5b82f9b9-7283-4cd0-9990-eda108374ecc", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207192, "uuid": "f04962da-154e-4700-9c2e-ce2eddd1bca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376abd77-9c60-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787207248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787207248, "uuid": "36f5f56e-93a9-4395-943e-aadc1f32546d", "comment": "Malware payload (Mirai)", "value": "ff91e340f4c6b365647a2c4700bb97ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787207248, "uuid": "40d5e249-dc25-45db-b3ed-b268c94c20e3", "comment": "Malware payload (Mirai)", "value": "f2357673ed912855faa538cb6f14d485c64e47800fc0748d07a9221e480432c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207248, "uuid": "0ad8649a-39c3-401e-8d2a-9a59cbf04409", "value": "T14193C51ABFA10FF7E89ADC3799A91B4624CD541B25997B35B930C418F64F64F08E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207248, "uuid": "12a78968-39a1-4f26-8b16-abf6506b0254", "value": "1536:Kpq2lAoAhHpfZOUjlJ/hth4O2PXAmiu9jDeM5ZO6fGjc:Wq2lAoAVpf0ULhtAvMM5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787207248, "uuid": "0cd17691-0fc5-4280-a838-1a3f49afea66", "value": 92300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207248, "uuid": "b5701937-4d42-42be-ab7b-a26ca17c0cc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33093c9c-9c61-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787207670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787207670, "uuid": "e5e1ffa0-bdd8-4e6f-9fac-810fc4e2bc66", "comment": "Malware payload (Mirai)", "value": "530fe3dfaa33273c6d165cb0c11dfb9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787207670, "uuid": "623a0435-0736-448f-bf1b-50d3b892de9f", "comment": "Malware payload (Mirai)", "value": "3db29da487bfe83452a4f875bddbd6a4f0a196a088d2247d2ba36e3f1d75b86b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207670, "uuid": "33a23904-4a02-4716-9bb9-19e91ef9df18", "value": "T1EA831A86F9419B25C6C507B7FA1F018D33165BA9E2EF7312CD141FA077CA81B0E27A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207670, "uuid": "7cd928d9-37dc-4d87-b1e4-45c5974227ed", "value": "1536:4NnBAHGsuhc46MhjbP1MZb972OWuCBr0qdd5erMY+BwzxIbir7Nyrw/wd:oAmsuJVjL1cZKcSoqd3ePVxyrw/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787207670, "uuid": "3cf55966-029a-47ef-ae68-587b96bfb698", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207670, "uuid": "5c4a5acb-a067-43a7-b7f5-69324eada3bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daf59c5-9c62-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787208225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208225, "uuid": "8e9785d4-03fc-4269-b325-d0a21f3bbeaa", "comment": "Malware payload (Mirai)", "value": "0cee0708f4aca45f2c94e12db4cfc490", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208225, "uuid": "9b51d3c8-64cc-49dd-a5ae-0131f02d89f9", "comment": "Malware payload (Mirai)", "value": "5335d11c6a44dfdbc0ba81db592494e545b6480ec475a2e05c1e096c7d0808d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208225, "uuid": "afde0f1e-ec55-4169-8932-cdcbdd3711a4", "value": "T1BE41F2195FD01F32DD66CC36464A2B512ACC842FA16B23966334DD60BD3E705E7D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208225, "uuid": "3af1a6e2-458d-4a53-ae90-fa9b34517467", "value": "24:WNBj3HsSimpHu7+ixZuDa9m6t5JJL4mmlZ9Wpe4g+/qc+UTK8WKUlu/eTlBwFLCz:UQ2YnuDu3J6df9H+SMTLWPkeTlSFCXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787208225, "uuid": "75e40f09-7277-4e41-add8-d2de64fbae83", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208225, "uuid": "6f243324-494a-4888-8e3e-e72797028a74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1557721f-9c63-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787208479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208479, "uuid": "05052a28-e935-4bb2-b2c7-a116548b9848", "comment": "Malware payload (Mirai)", "value": "581be42386caa503c3519eeff6d75aee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208479, "uuid": "b906c81c-e6fe-4fff-a3dd-4e2f90696693", "comment": "Malware payload (Mirai)", "value": "2814a54dc334931d644a3eb734ca590396ca8a868992f4f5eea4636624804e67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208479, "uuid": "1cf58c2a-d362-40de-9670-62e1768c4999", "value": "T18321F100F2191423E5D13EB473371F6157A98F032B2949089B9FE69DD9BDC305A8D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208479, "uuid": "02bfc91d-87da-4f6b-a0c4-8610517597b9", "value": "24:3WUpWS9nSWZ6S4/KSwISBd6oTKP5tAFlM8uqzktiKkvy5MaaTo0YGz1SV6JJ:GVgZVbXGAZLz2iKkvy5Mlr4VWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787208479, "uuid": "67634e54-0987-4e24-a0bd-44bc8ab2d51c", "value": 1412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208479, "uuid": "c0cd0765-18a8-43af-8863-1b6eba7d86d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f1b211-9c63-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787208744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208744, "uuid": "d6e73a88-b795-41aa-a7ea-4b09ba09f283", "comment": "Malware payload (Mirai)", "value": "057f7c7da2e23d0990cb18769c8c2ff6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208744, "uuid": "9febfdf7-1728-4338-b837-6de0076417a2", "comment": "Malware payload (Mirai)", "value": "ccda5659365408d4bf3b42071e7afde5ea28fb68c50f116926f8d6397c8689db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208744, "uuid": "6e7c5bc5-5a1f-4938-9b32-53711e7593ad", "value": "T1882112FAFBFB9B16C454907E0F6723203720DC5C0025D329BF216A1DAC526526F851", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208744, "uuid": "826ef30c-8c32-4ac1-a0d7-b4239cc7448f", "value": "24:3bNlDq3N0yTKs49knX8MAQmlhCDjSkvF6J9lkHVNTawqNs:XWVT8aX8MhvW9uHVNuns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787208744, "uuid": "98f65a15-5af4-4293-8e7a-9815a48fc5e2", "value": 1280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208744, "uuid": "1194e46f-c2fa-47b5-b724-dadcbbab9d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb72e1d9-9c63-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787208758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208758, "uuid": "8a85f211-c04c-4e62-95dc-bd978ef84780", "comment": "Malware payload (Mirai)", "value": "15040576bfb5a3306305171d8d231ba8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208758, "uuid": "54f113ca-23b4-4038-9740-fc4d2dae67c9", "comment": "Malware payload (Mirai)", "value": "994127370dd24d348d1570cf198fdace828a0a40af93d5b8b488eb1d99d8c6b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208758, "uuid": "9bc8c321-52d3-40d8-b89f-ca5fc8e043f1", "value": "T11231CD91B6D05DB8C8A451BEAE4B0311736A9F00E1CA7222C31CA328AD1EE7D6E264", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208758, "uuid": "44c16903-f391-4862-952f-6e7475aa4832", "value": "24:uTchKGpa7Urz/jlf/14dAXK1hH9Vev3gRGaJ9iRBBuLlZvD9gW29:ughKGpa7UrLZ4/I+JSBuTDJ29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787208758, "uuid": "885a6a18-c31d-4acc-8414-86543d6ccb2d", "value": 1504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208758, "uuid": "cd8c281a-01b0-4585-b6be-2e414db827ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6b09ec-9c64-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787208896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208896, "uuid": "9590a047-0c36-4d73-8e9d-5e57341f1fab", "comment": "Malware payload (Mirai)", "value": "00a3b679dd78eea67d6b5f65fd858205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208896, "uuid": "2d9c91fd-01c3-4e90-8468-f13df97aa7bd", "comment": "Malware payload (Mirai)", "value": "b0abdcf8f5a17770dc6f0198a7c551fa9181765af4cc03ead04220377623ef2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208896, "uuid": "c1fad340-da9a-4ec6-a7a1-7f032ef9ed5f", "value": "T10021EB62E1D9EC32DA2240FA5686AF9723958EA56817FF0BC9614802EC3E2C0C1332", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208896, "uuid": "1263ce8f-9061-41c2-8913-83fcdeeb4ee6", "value": "24:FlmbllMHCFHxgxEmceZGQleZ3eLiX6vixwyGues9OHruQOINfY:fmb/N+coGQlo3eLiX6aVqssLHVNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787208896, "uuid": "586ffdbc-08e2-4234-990b-b6d086c08ff0", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208896, "uuid": "787390b3-923b-4fa5-9e00-293259ce9cba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e54913-9c64-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787208928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208928, "uuid": "b0535f51-0059-4e69-a094-e53271e83d82", "comment": "Malware payload", "value": "f061fee6377f17ce0c3b1548e445932f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208928, "uuid": "9c7966c0-47c7-4ad3-aaab-55950e680237", "comment": "Malware payload", "value": "96af1d0c3ed78e44ac3f75665b7483e77ff451daa2ec01966299b0686bc3c49b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208928, "uuid": "731c3aed-1621-488e-9233-b07da0989e63", "value": "T17E21CE96A7E35D16CD840637DDAF5B20E322BF48C69EF503E31216251C3F31A1F211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208928, "uuid": "244caee3-5e11-406a-b7bc-20e34f991396", "value": "24:JKR4llMRgP9qD0at6EoDbGgKj9rUlFSy40VzLCkIddgvt+RGIUlZVNfW:JKqTFqDPtj5rkFSy4CzLZHIUlZVNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787208928, "uuid": "1adb6cc0-bf44-4489-9309-d16fd1329f3a", "value": 1168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208928, "uuid": "5b6c1c13-56f6-4483-aa72-ddb5d60f1b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e78d8af-9c64-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787208951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208951, "uuid": "c872caab-8179-4043-9371-c73f265944bc", "comment": "Malware payload", "value": "9b42816d0a8f4659e51514f275a7e50c", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208951, "uuid": "53f965f2-7b25-4cec-bb97-add0b05098b3", "comment": "Malware payload", "value": "14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208951, "uuid": "20b5344e-6f2a-40cf-a499-7c2d55976ad3", "value": "T109D5239569F928B1D467C7B74F47E8BEB1543BA08B748E43F6CC6A041E83604A83B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208951, "uuid": "abf4819d-4fe0-43dd-8f24-0cef2f9526ec", "value": "cc678ea372003a91fefb68ce6b422039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208951, "uuid": "70227119-98ea-4ec1-a52f-377a01ae3c05", "value": "49152:AmWmV3WJWemnOmDZgiKhTQlUVxlt3pOQ2Sj3pR7BnCVIk43hwK1hKQxXCow/mXkk:AmWmEJWemn/OhTmUT4ej3XEqkiiKM+Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787208951, "uuid": "ace966f9-529b-4a39-a7f4-953a16897e08", "value": 2903552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208951, "uuid": "529232a4-e6da-4887-8842-1b93e0916c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcc4100-9c64-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787208953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208953, "uuid": "4184d28a-ac23-48ee-b485-bdc92e9ae53a", "comment": "Malware payload (Mirai)", "value": "d7a569ad4b3c3a6c6c09ce9259eea6f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208953, "uuid": "e02200b8-f4dd-4c5b-a14f-651f203e70d2", "comment": "Malware payload (Mirai)", "value": "14b0aceb0f1af0ec5470986cb6832634ae83cf851d87c28f7d7ab4df710672e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208953, "uuid": "73ce9e86-339c-4fb3-a290-2c50fc0f4cb0", "value": "T163633B56D687F8F0CD8206B8105FEB79DA32A8322120DFBBEBD8F957DD6571260422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208953, "uuid": "043b7769-878b-4bed-941c-97d71773b989", "value": "1536:uBofxfvee2ahpN5cHK9dbeOErCdPDtaFIO:uBs1v7kr+dPCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787208953, "uuid": "11ef50a9-bb2b-4489-a738-6f57ced430d6", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208953, "uuid": "fe9d7961-6330-40dc-b198-0e01d367bb90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b08392-9c64-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787208970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208970, "uuid": "5ad81e54-e12d-4901-9d85-f4be938bb2bd", "comment": "Malware payload (Mirai)", "value": "4b4d0938b647836eabaf1d43a399c9e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208970, "uuid": "aed4aef8-2244-444f-95ac-7d34cbe461d6", "comment": "Malware payload (Mirai)", "value": "9e13f0b749693311817c7ea18b4f4cecadcdc64adb1bf124e68372f2ccd06f9a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208970, "uuid": "5c7ed864-f31e-4a2c-8920-095707ad9364", "value": "T17021FC0AF245285FE8AB517C142B062634307A4AE9138513F3268E3F7E7B1D4120A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208970, "uuid": "10d9cd0c-c197-4c48-877b-a9952ad9f812", "value": "24:3gAa8DzSWPpbP78Pwy74+CiFTHnhHHJ+D8ECAfGFioc1LqNT1G0:TpP3hb/mrTnhnJq8DAfRvqNhG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787208970, "uuid": "76b0f5f4-4931-426f-83aa-033a8ce17315", "value": 1256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208970, "uuid": "d6350789-e4ab-425f-8817-187ddc4d5bb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c61779-358d-11f1-bc00-82aee05be84a", "comment": "Malware payload", "timestamp": 1787210711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787210711, "uuid": "f59810b5-35cc-4c6b-bc7f-e55d9597bb56", "comment": "Malware payload", "value": "5294f25631d20b68ebf3a9acd4cc1f5d", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#15a23a", "exportable": true, "hide_tag": false }, { "name": "P2Pinfect", "colour": "#D18D7D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#e2e7c4", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787210711, "uuid": "e58f8dae-a7cd-4d8e-950c-5f976eeec172", "comment": "Malware payload", "value": "a505de0af54408dcde2f869608398a409908543a43fad15397a342b2200f8a52", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#15a23a", "exportable": true, "hide_tag": false }, { "name": "P2Pinfect", "colour": "#D18D7D", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#e2e7c4", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787210711, "uuid": "f83cb003-6bc5-424d-ac82-36dde0f42462", "value": "T19E06331581EA41EC80D88DFC9D152EF38F55EDF028FB0484A9F7E69208F79D297929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787210711, "uuid": "38b22c05-6f22-4f44-bb74-930e2cf0efc4", "value": "98304:zenAd0WS0Zelbevq7hwc8UthyhjeomOwsb3Pu:zenAd0W5ZwUJxhBwMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787210711, "uuid": "e126381b-11a4-45a3-9c49-927adde16eee", "value": 3716336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787210711, "uuid": "ae3dac7d-3360-46dc-925c-ad826c058eed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1633b234-9c6a-11f1-8686-82aee05be84a", "comment": "Malware payload (AsyncRAT)", "timestamp": 1787211487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787211487, "uuid": "ee6ff3d1-f4e3-4118-9d92-fee32999158e", "comment": "Malware payload (AsyncRAT)", "value": "8e202026cf4d6c587f3e8b909fd03097", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787211487, "uuid": "375d0678-bba4-42f3-850e-62b29085f152", "comment": "Malware payload (AsyncRAT)", "value": "6c03a02ccbf0d1b28709d7df24eecd14d64822851ad881531959b05ce56cc795", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787211487, "uuid": "528edec9-a51b-4258-8cf1-14b24179fade", "value": "T15103289E72D044FCE866C134D6F68332D972FCA819B4166E1B54DA3A2F70E705B793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787211487, "uuid": "0e3e24e5-2f86-41a7-a2c8-f37da2185f9e", "value": "54420143057cda58267e1f513b321387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787211487, "uuid": "f24f8d07-14a7-4a8d-81f3-f8bb9a2d562d", "value": "384:MDDLX7EXmoDf2MzY+t+MHewe8Fkrqq0uPw5JAQh5fRFk+98SWRLWxCW:Mz7smYu4Hp/eWq0OsiQhdR688VzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787211487, "uuid": "9a0673c8-9f20-4ee2-a868-0ec107737d27", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787211487, "uuid": "1e817366-e31c-4451-a7d1-0f4d4f63991e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec20b9b4-9c6a-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787211846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787211846, "uuid": "54b9c2fd-0c82-4374-b071-e28a18fe8ed4", "comment": "Malware payload", "value": "eab76d1806e4a74c8782f7fd4624aee0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787211846, "uuid": "ca421ebc-2d6f-4122-91be-e29cb8384bf8", "comment": "Malware payload", "value": "936340abed39f4b4043b3b695bbbbbc4036dbbfb137735db3ab886913c222d59", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787211846, "uuid": "3d0f64f0-9e9b-49e8-a0e1-04994be406a6", "value": "T18C8533AFB796D57A34372222CA049EF1AE3706084C9EBDDD31015F1930E79586B6EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787211846, "uuid": "a90055d8-aa96-4295-8b74-89867b987664", "value": "49152:6oYJbug1BDqSoHuV+cnYIjrdQskIHl/maIc/I:6/Jb5LDqb+LR/dQskK/mar/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787211846, "uuid": "26b86862-47b3-4be5-a4a0-90c93d06e6dd", "value": 1737232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787211846, "uuid": "9f5c004b-7652-492f-aae1-17096573d68b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b386b92-9c6b-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787212086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212086, "uuid": "6e3ebe0c-cdff-4b2e-8c97-a2b06386154d", "comment": "Malware payload", "value": "a914ae302bd6b97359d35ed09c185ed7", "object_relation": "md5", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212086, "uuid": "ec8fceac-e295-4af6-90aa-0d29f5647240", "comment": "Malware payload", "value": "37feee20468b8d078bd5a04b142da5114a17eea5f171aa29512a4a88e8ec0e76", "object_relation": "sha256", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212086, "uuid": "3f68fc22-acf7-4a0b-be98-a2b69d1b77d8", "value": "T111E56CA788B1EF13B7AA4E4827315E0D202067370FDF150FA4BED7C5B692AA5341F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212086, "uuid": "ae9f8771-02ed-418f-b897-d1d678423bbb", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFTz710kPrlKvEfDMi:m0eF4xaDjDONijDG8ZxFTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787212086, "uuid": "ec73324f-56a3-442d-a1d6-ea9efaf48e69", "value": 3242792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212086, "uuid": "74576712-6225-41f9-b12d-00cc5a76fc69", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e8ccf4-9c6c-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787212364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212364, "uuid": "8944fd88-0786-4520-8ca6-27356b1bb6a0", "comment": "Malware payload (Mirai)", "value": "b6f6b2b377da64aae3ae519e3263cb4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212364, "uuid": "33c0edb0-c8b8-4f2c-95ee-d4b97c91a183", "comment": "Malware payload (Mirai)", "value": "f2d7f891a8f0e91ee37e40b7e37e0d47971f8b4967625d0b4f727d67483927db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212364, "uuid": "d06eadd0-d066-4c0e-9c49-0c07c1bf62a0", "value": "T1BE41028A5F725EF5F05AD53C47370B3A37AA524847D18249E1ACD9006EC430D89DEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212364, "uuid": "758d7601-ec53-4f40-ac71-8a0226523394", "value": "24:3+mkMdb5jl8AmslI3t8AmypR/z2HcllPx1qtWB4u33MI8paLdz3N9l5zBkEp7i1q:Omr5E4GYg2H0j11/L/9LuEpMn3+yaBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787212364, "uuid": "20885847-fa69-4e9e-89b1-65393c74bd13", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212364, "uuid": "8e16546a-e734-4cf4-ad6c-a6096e0099e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4c41d5-9c6c-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787212489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212489, "uuid": "447c382f-8a25-4d6b-a7d1-5956e5483a04", "comment": "Malware payload (Mirai)", "value": "3e5d3158ed7593bdebba56ded3de2278", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212489, "uuid": "6d4f0528-5b10-4c3a-bdcd-1a92d60546f5", "comment": "Malware payload (Mirai)", "value": "bb5fdb88f5414e2d06de42145883d25fdbdbca4a1dce7482217c760345654e6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212489, "uuid": "dc4b4090-e507-4983-bd5a-ddd9b01bee9b", "value": "T13921328AF0C4AD64DF19DB3C4EB10A937B05D968C51FF3CE4E0A86B6591F2CC6A900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212489, "uuid": "4468039b-230c-4c6a-8955-3f751634cf4b", "value": "24:w5olnAwdGtSnUpzzbBWpzm1Ra5gDrmEWvNFGlikC7m17CMVNfi:w5olnPdxnUpzzbBWpzm1tDrmvvGli77N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787212489, "uuid": "8eb71e27-7247-48d8-a780-e7552423f3de", "value": 1204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212489, "uuid": "388b9c25-f09e-40d0-8d7e-4ca97d63d383", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da39d05e-9c6c-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787212675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212675, "uuid": "331429e7-caf0-4eda-9873-9e59d1cf1f85", "comment": "Malware payload (Mirai)", "value": "c978c9aaadcbbf42c7d5f8f4d90dec2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212675, "uuid": "6b553bcc-685d-4bbc-b486-c77d6a6b5faa", "comment": "Malware payload (Mirai)", "value": "6e55fc8ea2db42fdd70c8456394b9fd22875d361ff0f40fb6bb1e926e7b8182d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212675, "uuid": "77af119c-d986-44a9-a1bf-1439c7b7e4f1", "value": "T15A63F881F8CB45F1C50B493460EBF33FCA32D57A90715A6DEF99DE22DB6760291122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212675, "uuid": "2ba3993d-ab60-4340-b1f9-7ea5ef19a253", "value": "1536:jgWmXGAfgmpTsxmsDrmAOLWBaLOOd5eI7ka7sfF:jgDWAf5pTsosDrmAEPLOO29aof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787212675, "uuid": "b7697a05-2d12-4262-9380-85fe685053a0", "value": 71984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212675, "uuid": "282f7783-f26f-4bf2-832d-d905fc8d195d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04678bbe-9c6d-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787212746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212746, "uuid": "3a68dc75-af06-4c01-90f3-cca3b6717987", "comment": "Malware payload", "value": "fb6ee82a0a8243e54230fcc184dc4c9e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212746, "uuid": "6483dd50-5b5d-4449-bdaa-c5279822b7bb", "comment": "Malware payload", "value": "347a8e90b16b813e303ad95962b76ce524f5a0ce58a7e9f345e3b8b0b7e2cf77", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212746, "uuid": "f33de936-cec7-461c-a8ba-9041a8ba810c", "value": "T1FB95F1A3F1F25C87F9D88CB215A407E6AE18A3E254322B75251BF4053D1F97D8E98B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212746, "uuid": "421eb7cd-636b-44b1-bc0b-73f57ce6766a", "value": "24576:8+EhkjixLXR+bG/f29mFusqa+n0tkR5JoZh73VVPYDlJ0K3x0cGMkmpNdkyYh/x/:8UixbItdTrJoFVPMvXGMVdkvfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787212746, "uuid": "3295fb85-4f24-450e-8d8f-5eaca3204ebc", "value": 1885009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212746, "uuid": "98d7722d-7fdf-4136-b250-a72e51da71fb", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059daf2f-9c6d-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787212748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212748, "uuid": "ed6a1b47-e4ec-427b-b963-a57e51131cfd", "comment": "Malware payload", "value": "515eebcde3ddb499d547063728b403ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212748, "uuid": "e1680c6f-5440-4c92-b7a9-f8e56d4ab079", "comment": "Malware payload", "value": "5c8a8f414d6dc20687bee7e95526196cac01c1784f2ec9b61cb91304d265e4e2", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212748, "uuid": "08e1f410-2ab3-4606-be0a-ce20f61b4e2c", "value": "T14BA537E288B0FF17B7661D1873745E691018153B0FDB0209B8BEDBC67683DAA346F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212748, "uuid": "44e05a1d-643b-4f56-80a2-b34d2d317b21", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFTO:m0eF4xaDjDONijDG8ZxFTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787212748, "uuid": "7d9a8be9-4189-4b45-8ef0-bd9cfca19490", "value": 2152216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212748, "uuid": "05fc4ae0-2dee-4030-82bc-1ac8709aafc4", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0626faff-9c6d-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787212749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212749, "uuid": "5c134d54-4414-446b-a936-d9a1ed9d4f7d", "comment": "Malware payload", "value": "2a8280a0efe5588d6d602d77424454dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212749, "uuid": "9f6ad1e5-8e7e-4f19-8792-d2fc154a33da", "comment": "Malware payload", "value": "3a768c2048c9602d31553d84a09851519db8a74b447bdd5b29e557d0027b3377", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212749, "uuid": "da2e1216-787e-49e4-a934-54a244a261ff", "value": "T1FBB5AEA7F1638E85A918C4F14D5003E6BC145BCB896117387AEBFD087E9CCB98A64F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212749, "uuid": "219ad543-a54a-4000-99e3-e2ff76940734", "value": "49152:8UixbItdTrJoFVPMvXGu89U703X4DP980iF13VK:7iBI/JoFdMPGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787212749, "uuid": "ac8ef218-6c0a-47ac-8b41-f509d7553781", "value": 2483709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212749, "uuid": "47c2ae35-3c4d-4f20-9e4f-4809b65f79ec", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "073afda8-9c6e-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787213180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213180, "uuid": "4a1ae2e5-9573-488b-8798-cd1b32a993a9", "comment": "Malware payload (Mirai)", "value": "7376a5435c1993466d03669056df8e8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213180, "uuid": "2fe16c87-0b17-436b-90b1-e2537935f28c", "comment": "Malware payload (Mirai)", "value": "8e8cabc46f708a6415ec0d5cb8ace82d11470a557966135d8f1b903960dafc46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213180, "uuid": "b40afefd-837a-4055-98e7-b2e707a3c563", "value": "T109535B0173584E4BF9DA0EF0653F07E587AFEA4122E0F1C5690FEB4A8175E33558AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213180, "uuid": "2cff7941-74f3-4fd9-8151-e332458a0d3f", "value": "1536:H6oK+UxO2xTMndP3sxA9i2jAs/a5Zwt5u7n:H6om025MnWwRHa7wtAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787213180, "uuid": "db69bd81-f65b-49ae-b08d-0c848f41f999", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213180, "uuid": "2a9b76cc-ba6e-48cc-a68c-a3c1d3f124c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900fcbbf-919a-11f1-8d7b-82aee05be84a", "comment": "Malware payload", "timestamp": 1787213411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213411, "uuid": "ffc6726a-3206-45c5-b89e-dd15eb19fbdb", "comment": "Malware payload", "value": "0b6d6041356408cf664d7016d9583b37", "object_relation": "md5", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213411, "uuid": "3fdec086-8792-4f45-a51f-579f0bf758f0", "comment": "Malware payload", "value": "0f382de987737c3f6167d1b4596b9fcde2925c8098774b57fa78fa4e41d9905e", "object_relation": "sha256", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213411, "uuid": "a37071ab-8e3e-451c-b328-9c0295e4f783", "value": "T167E56CA788B1EF13B7AA4E4827315E0D202067370FDF150FA4BED7C5B692AA5341F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213411, "uuid": "fd350943-a885-4948-9158-f6f11bd7e897", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFTZ710kPrlKvEfDM2:m0eF4xaDjDONijDG8ZxFTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787213411, "uuid": "0886a2fb-432a-42f4-92cf-1f6392fa96a3", "value": 3242788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213411, "uuid": "6a42452c-03a0-48f1-b621-0d63386b00d6", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b827dc01-9c6e-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787213477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213477, "uuid": "02dea4f6-4c5b-4745-8473-78481178dac7", "comment": "Malware payload (Mirai)", "value": "ba68db3e2af26879201bd8605e2f50d0", "object_relation": "md5", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "x86-32", "colour": "#1e2185", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213477, "uuid": "45bd2ce1-7cd8-4bd0-8a9e-221662c2fdc6", "comment": "Malware payload (Mirai)", "value": "7bca37198acb59b4fe2183161f5b8ad833df7e60b738594583335da44d723b0d", "object_relation": "sha256", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "x86-32", "colour": "#1e2185", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213477, "uuid": "55d632f5-72e0-4d53-b161-8f10a6cc21ce", "value": "T137533AC4A583E5F6EC110938306B9FB59A77F53F6038EA9BDBD9A663DC01702D1122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213477, "uuid": "0fd0eae1-3f8d-43a3-a7e4-6fdd5cd839fc", "value": "1536:liCzqon1AtAkcdGFDIOLy0FCAmm18H98fWlKlbgs5XA:wzonYAVGFZm0syCH93aUcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787213477, "uuid": "81d0a401-5534-4aef-a290-1eff5ef20894", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213477, "uuid": "59758215-91a1-4ba0-828a-2d2e17dbeeea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6524f7ff-9c6f-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787213767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213767, "uuid": "5c28b8da-0f59-406d-bd55-2fcf56818000", "comment": "Malware payload", "value": "415a5884724c9a80a8aa2c69df84fe9e", "object_relation": "md5", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213767, "uuid": "f1a4cd77-c19d-416c-985f-39f800b68fa3", "comment": "Malware payload", "value": "db28b23c8598a338e341eed73341f6fdb4fb89622745aacf89ffc7d74ec15298", "object_relation": "sha256", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213767, "uuid": "1c94633c-9049-4ba5-b6f2-876c3c3907a4", "value": "T1D4D56BA688B1FF13B7AA4E5873341E5D1014263B0FCB110AB4BED7C67683A75346F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213767, "uuid": "e0e6b38e-4164-4fed-84b4-54b779520e0d", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFTSp0Lcmpw3xc:m0eF4xaDjDONijDG8ZxFTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787213767, "uuid": "10226ca5-a358-48d1-9bc5-0dbb6d137e04", "value": 2919966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213767, "uuid": "7dcb868d-be73-4b16-a5d4-fb02822441ed", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a598a970-9c6f-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787213875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213875, "uuid": "e3c0f4ae-769e-40cb-8ef9-8ba2e716db2d", "comment": "Malware payload (Mirai)", "value": "0d06934691c7b0fed35247a96f5fbbaa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213875, "uuid": "5d09b8ba-b557-4fb4-bdfb-18eda383f1f9", "comment": "Malware payload (Mirai)", "value": "f88d65205dbfa7cc6a2570d8dd717159c4c541ad5375d387a0536329f1f9a855", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213875, "uuid": "b725aacd-1086-4976-b510-34c80dbfd199", "value": "T130539F75C1647D98CA4506B0B92CCA748703E508B2632EF2DA9AC769940FEFCF509B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213875, "uuid": "cce3c263-ab54-458a-877c-d8ccb862893a", "value": "1536:H/8P0UdupdWTcyfixCAMES7De3U9T1LnTHCvvX:H0P5dupETc+ipSPy0RLnTHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787213875, "uuid": "856f161b-6b67-4e11-baff-8c080a61dcb9", "value": 64300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213875, "uuid": "8eb0773d-9893-4ef5-aff3-1862fac9a4d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae4251f5-9c6f-11f1-8686-82aee05be84a", "comment": "Malware payload (RemcosRAT)", "timestamp": 1787213890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213890, "uuid": "f818fbc0-91cc-498d-8a3a-424273796123", "comment": "Malware payload (RemcosRAT)", "value": "eb8a0620cb4087918fb7622b40438562", "object_relation": "md5", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213890, "uuid": "6c172240-212e-4938-98db-103dbaff5eb8", "comment": "Malware payload (RemcosRAT)", "value": "ae5f17cf80ec169d0d65dff3ab79c9080db0bcbb38d5a5a8b394e20672b19221", "object_relation": "sha256", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213890, "uuid": "6be62900-8b06-41c3-8acb-946d1096d0db", "value": "T1FBD47D49A39402F5D07BC135CA839537E6B2BC056670962F03D74E5B6F233A19F2EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213890, "uuid": "8dae2c02-8444-4ace-a36d-3ef009d7f0e0", "value": "3d20ba98fb1153d8e87b00324316b42b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213890, "uuid": "e2120e59-7f03-4f57-aa6a-9f6fba308144", "value": "12288:nKN72uXsciTv/0+EqjCpas1aUu9dzn76qoL/oF5iPOYlY:KN79XsciTv/0+EqGpas1xu9dzn+qoL/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787213890, "uuid": "5d131171-5299-472b-b1bc-84250cb1e96f", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213890, "uuid": "b9aee04c-aa3c-46bf-9690-fc6738408569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508af3c1-955f-11f1-b064-82aee05be84a", "comment": "Malware payload", "timestamp": 1787214071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214071, "uuid": "b0102907-16ed-49c1-bca3-aed487412a8a", "comment": "Malware payload", "value": "897df95f9a82cc8f34c9cd58bf015176", "object_relation": "md5", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214071, "uuid": "1f92f904-f964-45ec-a272-2332a8be01a0", "comment": "Malware payload", "value": "c4df942189818b56e0d03405e4e0d077c5caf6977b8273ea522d34b66891f9dd", "object_relation": "sha256", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214071, "uuid": "4212c029-2291-4943-a925-eac1192e41ce", "value": "T137E56CA788B1EF13B7AA4E4827315E0D202067370FDF150FA4BED7C5B692AA5341F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214071, "uuid": "f460c60c-56e6-4c4c-adce-cdbee1d4f290", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFTT710kPrlKvEfDMC:m0eF4xaDjDONijDG8ZxFTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787214071, "uuid": "e86f4939-1c10-4454-a57c-f86c587236fa", "value": 3242796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214071, "uuid": "35d267e0-00d4-46fd-8add-cec848553ea6", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4add06-9c70-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787214127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214127, "uuid": "a4474957-96f3-4e58-8df3-70a9acb8928e", "comment": "Malware payload", "value": "a9ab3be6b31f3e94e74a2d4784c24c87", "object_relation": "md5", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214127, "uuid": "b9425baa-3538-42d7-bbe3-2a4a72ec6547", "comment": "Malware payload", "value": "2ffe83bb6d49ca5493c89f1561791daa0a45a5fafb011eb4fe219d0f393fd5a9", "object_relation": "sha256", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214127, "uuid": "ab32901f-b63e-49c9-a4c7-54b859643e46", "value": "T193E56CA788B1EF13B7AA4E4827315E0D202067370FDF150FA4BED7C5B692AA5341F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214127, "uuid": "8199d2e8-47a9-45fb-9b5f-bdbc3909d898", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFTC710kPrlKvEfDMW:m0eF4xaDjDONijDG8ZxFTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787214127, "uuid": "e29e5e39-0f26-4c14-9b1d-3af0accbfd55", "value": 3242780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214127, "uuid": "a92fba17-43b1-4e7c-8fda-a00c1c6900d3", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dce7ca1-9c70-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787214238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214238, "uuid": "14c90717-83d4-465d-a6de-dacccd8c674d", "comment": "Malware payload (Mirai)", "value": "a9297a285a0da410e591e7e3989f4783", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214238, "uuid": "d602ac9f-4ada-484d-96b3-83c5509953e4", "comment": "Malware payload (Mirai)", "value": "bb0ef4d50edde0906f5fa696a3ba0b65be3ef43170ca8a2d587c5c47bb88ac46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214238, "uuid": "ec1dc316-f517-434a-b4ca-f69a13446239", "value": "T19A7307B93942F27CE9E55074F4032AE425220A083EDC95E369C3943AFF70B8C756DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214238, "uuid": "3b48ccc5-a857-4a76-abe6-46df455e3938", "value": "1536:aSw2+pThWbEyPx5VHET+mVBIVCCfy0K9ZHV:r+pThW4yJkT3uyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787214238, "uuid": "86388cd0-0572-4b7d-9456-3bbf795502b8", "value": 75144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214238, "uuid": "550e8520-a638-4deb-add0-5a5b3b221e29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8234ca71-9176-11f1-8d7b-82aee05be84a", "comment": "Malware payload", "timestamp": 1787214911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214911, "uuid": "457e4f58-35cf-4803-aaa5-ca2d165c4189", "comment": "Malware payload", "value": "f84d7444908c3c627449d91756ed21df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214911, "uuid": "8e38dfde-8b15-49a3-ac2d-b0c2a4aaff54", "comment": "Malware payload", "value": "0737010111c7cd22d706483e4783b688a173b2bf4826cb7a4da2ccf6bd30a537", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214911, "uuid": "851268a8-d7ad-4c7b-be80-caa6acde3b87", "value": "T113C529F698A5BF23B7B64E0863702F99501412370F8B015AB5FEC3C5E6939B9346F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214911, "uuid": "59e7d3b2-d3b1-4821-b1c1-966637b18b85", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFT2d5lJUb:m0eF4xaDjDONijDG8ZxFTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787214911, "uuid": "53932c3f-bf92-4873-8a75-08e7f7e003d0", "value": 2628570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214911, "uuid": "5c811060-ebc6-4de1-93df-20d683147a10", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b143bbf-9c75-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787216274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787216274, "uuid": "18d6ad87-4cd1-43cf-9663-49248a520c10", "comment": "Malware payload", "value": "d01b820e14c6212b1fb85e98bdeaa5bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787216274, "uuid": "c33d4dcf-e74c-46d4-8526-d81a2f5f62e3", "comment": "Malware payload", "value": "ee1a7be671f966af3641673af0f7a1dbcf7f6bff5310b99d0e63a62e07260f94", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787216274, "uuid": "01e7227e-b769-43d9-ba2f-08d507eb6709", "value": "T16A091243E96140B6C5AAD130C5669663BB727C494B2523DB2F60F7342F77BD0ABBA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787216274, "uuid": "9bccd382-9e2a-43c7-a6d6-5245b7379a32", "value": "6291456:5eOeKlLFYaYHt8cL4e6iivgnpTxAvC1cK8er0VKookW2f08VV:0OesLFI4N3vKQC1cXeCKMds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787216274, "uuid": "4b728021-b529-4f17-b5cb-86180d3e1f76", "value": 374669312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787216274, "uuid": "a93e1328-3cb0-4bba-8a22-5828f295f95e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fae0c1-9c77-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787217334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787217334, "uuid": "eded9a2f-86fa-44fc-8294-a4d2af328d14", "comment": "Malware payload", "value": "a12e96d6977611b6f6dc179ec41b5c1d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Phorpiex", "colour": "#5b88bc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787217334, "uuid": "9554c86d-5a99-40f5-b365-0aad3eff4923", "comment": "Malware payload", "value": "ce50b87723df613c938ca303303bff14865ff76ece1456ff3d8f122198436ee4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Phorpiex", "colour": "#5b88bc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787217334, "uuid": "780048e6-30bb-49e4-906c-62d47c07f42c", "value": "T14A32B0B78C7A41C43C8D059349F4D6FAAFFBC6A34835694454F812B9281D246BA623", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787217334, "uuid": "56c986c2-5f77-421c-b88f-1a17fd6b829f", "value": "192:C4liItjfo0oGxVxZmKrBlVCHcW/2CTrT2Zsx5uwKWi5YL8tDLyKwZ9XV4T:tBooAiBexZqZWKT+L8InFV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787217334, "uuid": "e211054f-e149-488f-a582-fa6265db0272", "value": 11008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787217334, "uuid": "dff0e9ae-de59-4e70-b605-b61a408cece0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87f9a7d-9c78-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787217799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787217799, "uuid": "282a88e6-e5b4-49b8-ba22-073ea66e7c47", "comment": "Malware payload (Mirai)", "value": "0e523fe08c4b7ee44f495884ae411cb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787217799, "uuid": "fc206157-e2aa-4652-b0cc-69700b2a66d7", "comment": "Malware payload (Mirai)", "value": "d40aa6c2a90d87a55a7c7f50383d27d205024a5e79a38bc000cdf0ddac8c94bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787217799, "uuid": "96e14ae4-3674-4959-8482-00f7b7527c7c", "value": "T173532B81F851A639C6C04777EA6F018D3324A7E9C1DA3717CD180BA4B7CA90F1D67B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787217799, "uuid": "0dffeb6f-de79-45f7-a209-715d855d4ad2", "value": "1536:axuCusfJIqLvz3bz9aBv8t461hndrUZdS:7afJHz8l84+xZUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787217799, "uuid": "9bf15aaf-b3e7-44c6-88e1-876846bf4f36", "value": 61224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787217799, "uuid": "e46da8c8-6b9f-4d30-a0e9-42fb57b134a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecbcce0-9c79-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787218320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787218320, "uuid": "a3296131-6d4d-45aa-8dc3-43761263ac22", "comment": "Malware payload", "value": "6f666a011115144b61a1cc1a179c513c", "object_relation": "md5", "Tag": [ { "name": "Adware.Downer", "colour": "#fe1fdf", "exportable": true, "hide_tag": false }, { "name": "emotet", "colour": "#23d4e5", "exportable": true, "hide_tag": false }, { "name": "heodo", "colour": "#75b3dc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787218320, "uuid": "c6153a25-6e5c-449f-93d5-fc1b37f36896", "comment": "Malware payload", "value": "64b88f19606129fb23cc91660e8e4b87f8e1bbb058f60f650ff552d5fb87cba0", "object_relation": "sha256", "Tag": [ { "name": "Adware.Downer", "colour": "#fe1fdf", "exportable": true, "hide_tag": false }, { "name": "emotet", "colour": "#23d4e5", "exportable": true, "hide_tag": false }, { "name": "heodo", "colour": "#75b3dc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787218320, "uuid": "fd4f689a-2fc1-46cc-9ea4-07094996b970", "value": "T161F2955ED277029D3407D4B53BA5678732E0222BD289E82CBFDDE5104F46EA986D2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787218320, "uuid": "37751d82-4397-4680-b91c-da41f3172711", "value": "768:44rFlFaOrFEFa81b2m2rxuNVFa+1MiDfOIa/t2:X3z2jl2m2tCXZaiyIa/t2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787218320, "uuid": "9ed906ad-4320-43ec-b2a4-1dcb067d728f", "value": 36367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787218320, "uuid": "d913d1a2-e832-475a-a034-d4628ba59c77", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7cd21b-9c7b-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787218991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787218991, "uuid": "f65e2b12-df7f-4a10-95f8-af0234e182e8", "comment": "Malware payload", "value": "3878923a2e0b1fdb16a307d4acb132c2", "object_relation": "md5", "Tag": [ { "name": "HypeAgent", "colour": "#DEFB3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787218991, "uuid": "632e2a52-0496-4085-ae05-1fa72a95d7ca", "comment": "Malware payload", "value": "3ef1d5cdf0f310e59736fa58cae69f0897e649e6d61ca21fc13217de77bcdd9e", "object_relation": "sha256", "Tag": [ { "name": "HypeAgent", "colour": "#DEFB3A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787218991, "uuid": "fac8265a-2d9f-4078-948c-ef2376144e8d", "value": "T1B5C533A146C37F9CB0BC0ED8ACD5F35344295A61EA34B3B16C94985FD695E3BE810B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787218991, "uuid": "53fec12b-c030-4f93-a384-a42b426e8b29", "value": "49152:LQ/acma3JpvczkO6hsTRTSxtTKKDSAZBdTtgz:LQNmypEQO6hA9SigPzd2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787218991, "uuid": "78c9e553-f148-4dcc-bf6c-2ca1291b2893", "value": 2704680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787218991, "uuid": "cb64ca2e-b6ba-4f00-b9f1-f2aac7b4543d", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64053e50-9c7c-11f1-8686-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1787219349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787219349, "uuid": "d58a3e3b-609f-4d25-991a-e87b53f2e848", "comment": "Malware payload (ConnectWise)", "value": "001130e083029d90783c95a5fc57688e", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787219349, "uuid": "9fc142e9-fe99-4464-aa84-c66cd66b957d", "comment": "Malware payload (ConnectWise)", "value": "f441d8c38bd0161b00a765fe08101e26928ca7fcb7547e16f6bdfddefb780770", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787219349, "uuid": "84d56eac-c473-4c6c-921e-fbef0b5e2253", "value": "T11336023FF28B653EE0295A3679B2A210943B7A6165134C1696FCF88CCF251B01D3E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787219349, "uuid": "0f472b69-d608-43b2-a038-30671e841210", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787219349, "uuid": "f6f72f35-6b00-4eb8-996b-c96941ac7040", "value": "98304:45ORXV8Vgbzfubw+OgO08+5lpOJ75z+ox3bX493Z8nJ:c2SabzfOwVgJlK7x+YIBSnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787219349, "uuid": "14ecd9ca-62cc-49df-8ae4-ffc96414ff8c", "value": 4889739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787219349, "uuid": "4b3b4ba3-7761-49da-b3c2-5c4a21e5b839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65335124-9c7c-11f1-8686-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1787219351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787219351, "uuid": "02989269-a91f-423f-9a25-472e833bd8d7", "comment": "Malware payload (ConnectWise)", "value": "7248f05ea71bc521cfbb9cfe853f2f6c", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787219351, "uuid": "5bb696e9-3549-489a-8400-f2dcd4ba528b", "comment": "Malware payload (ConnectWise)", "value": "4c1b2054ec54fc8433dbf0d085813760b321adcd21da212b7cd652ef4ecf4fbd", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787219351, "uuid": "b8f12aaa-3e0a-4981-a809-458cbba4ca3e", "value": "T1BB36023FF28B653EE069163A79B2A210943B7A6165134C1696ECF88CCF351B01D3E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787219351, "uuid": "3a4c8e90-f47b-41d7-bde8-1781ac3d540c", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787219351, "uuid": "79902329-f1c8-43bf-8649-0c06377d1488", "value": "98304:45OsV8VgbzfuwOSgDh+5lpOJ75zqngPaLh3bX493Z8nJ:c2abzfVOLDOlK7xqnQ4IBSnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787219351, "uuid": "5bb5459f-42a9-4021-ad4f-7bd08493e14d", "value": 4889833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787219351, "uuid": "eab8bc1a-0cab-4349-aded-1830ab191eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b24a4e7-97eb-11f1-8686-82aee05be84a", "comment": "Malware payload (Vidar)", "timestamp": 1787231767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231767, "uuid": "88daa311-69a7-4229-9279-278d93c49828", "comment": "Malware payload (Vidar)", "value": "041f5888750ae8f3f6ca0a8e8b9215b6", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#6ca1b9", "exportable": true, "hide_tag": false }, { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#ddd7e0", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231767, "uuid": "9729af07-c1f9-4c0a-af27-0f2e2b4bd79e", "comment": "Malware payload (Vidar)", "value": "b1ec921ab8b8c04be4f13b9ad814e8e3f2d6c046891c74211143330b5492dbd5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#6ca1b9", "exportable": true, "hide_tag": false }, { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "njRAT", "colour": "#62a25e", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#d8caed", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#ddd7e0", "exportable": true, "hide_tag": false }, { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231767, "uuid": "694a9751-5117-4a3f-9e9c-a242b4bc389a", "value": "T1BED40209B7E658ECE0F38834C9560961FBB33D254350AB7F1390C676AF129A1BD19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231767, "uuid": "192b071f-3bc6-4d1e-a7b4-8a3dc1c69cea", "value": "905d6e2fd95bb9d68bb959ec7e8cfb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231767, "uuid": "1d7e15ef-166c-4109-8086-ed08a94819bd", "value": "12288:IVrlMhKrylrlHW6j+R3MUqxAQcX15VLDq9YYDQasg5X4RCijO3gfitPepF:3hKelrvGDV35VqWkQasCX8CiS3RtPIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787231767, "uuid": "0906a195-e876-45c7-b8df-4fbc6b711f83", "value": 655952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231767, "uuid": "543b5d1d-a219-4dca-b501-8650039c1d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30686d6-9be1-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787231767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231767, "uuid": "12600164-4b37-499b-b86d-9f1e239b1801", "comment": "Malware payload", "value": "20b4b9ecb0747bc45fa45638fa586866", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#7632a5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231767, "uuid": "b764afb5-d9bf-4599-8663-60f5b2af0bee", "comment": "Malware payload", "value": "e00143f2a6531d26df3496408e351b2e291574dff352e013c19e98b7a1247160", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#7632a5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231767, "uuid": "2ab8c5d1-7445-4475-9d15-0bfd3f8ed93e", "value": "T167B5BFA7E1A38E86F948DCF2019443E5BC19124B86691728B55EBD1D3D5CCBDCE8CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231767, "uuid": "d9683693-9332-45b2-bebc-9396c444c720", "value": "24576:8+EhkjixLXR+bG/f29mFusqa+n0tkR5JoZh73VVPYDlJ0K3x0cGHy6dkg3D64Agq:8UixbItdTrJoFVPMvXGHbdk747pPeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787231767, "uuid": "e686783e-5e7d-453e-8acf-827ca41d4074", "value": 2494629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231767, "uuid": "906d50ff-9284-46e7-8567-7aad0ae11190", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3bcdd6-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787231768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231768, "uuid": "19b98899-acf6-4541-a19e-d1e1b4948738", "comment": "Malware payload", "value": "af491d3f781016a9946afd84880597a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231768, "uuid": "33b07c91-d5cf-46ca-a964-c4e10d46f87c", "comment": "Malware payload", "value": "95475e9c6ee155ac15f772179880ff247fa76255d70a164dc97d69d712ed5901", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "0e7f8353-a162-46ea-9270-c1a39c40ed7b", "value": "T165E21B08B75CC62ADAAF4F7E74A20A2103B1D7561513DBC61EC835FEEC973458621B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "76e18760-2ff9-4d65-8d04-fcef896c8032", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "fb53a121-ab81-4797-bf45-724d76fb486d", "value": "768:/mQZqx1lYcTYbFGLbiGxxHWagqXbYC1ZHB:/0lY85xx2gbDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787231768, "uuid": "6feaec2a-1251-4667-bbe8-7630d4bff665", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "2329fca7-192e-4bf1-aee9-bfeb63a6b642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5e1f18-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787231768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231768, "uuid": "bd0b56bb-c7da-431c-b7a9-f2d610b85228", "comment": "Malware payload", "value": "da3b10eae69c4c2980fc4234afa18c64", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231768, "uuid": "15ed6edc-216a-4f85-a0dd-1b6967d19232", "comment": "Malware payload", "value": "a0ae1d6adf7d46298c5b18e888accc4d9edbf31aa85b5a01330e2593aadab51f", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "c48ac287-922c-49da-90d7-a756ca4f2d3b", "value": "T1885533F914663894D7F86928DA77263DBDF15AF1786103662DECECCB0C81C2580AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "aadd84a4-2d67-422d-b3b2-6738690df724", "value": "24576:N5DGyinACPFht29HTkz9L5RAElFtiwzjtD8UjbooAFIi4RE3badqTQ3ftGoHaoRD:NoySDFf2dTkz9LrtQUjbvWIi4RoUqkvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787231768, "uuid": "cf8036eb-c795-460f-8782-ea7a44b86c0c", "value": 1385763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "b1ad8197-9ef9-412e-b6df-997d8e76ed9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7136c5-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787231768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231768, "uuid": "b75b3a52-e3bd-4e65-80ee-0941afe1c0ef", "comment": "Malware payload", "value": "e47748c361f6827bc6b8d8dc8efdb83b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231768, "uuid": "eda714e6-b1bd-431c-847b-36809462d108", "comment": "Malware payload", "value": "0794022a72a69256b2c93df157c77f0daff33bba46adf3e7b2c7d2e14ee4ef49", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "b576cdb5-e17d-4fe0-972d-4f1a11262012", "value": "T1253318186F48D22EC5BECE3DA8924542CA32122B2012DB453D8D51DDAFB7749C67DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "e08c4a66-3f9c-491e-9ba2-171baacd384e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "f6bf4c15-35cb-4c5f-8762-0454dbc01a6e", "value": "768:EmQZqx1lYcTYbFGLbiFIhWYJZJ4fof6qTkYeBwbeP+XbYC1261:E0lY8VhWqZJ4fof6qTkYEHybL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787231768, "uuid": "dea90d7b-4dd6-4de9-b161-0598437d51f8", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231768, "uuid": "2716eda8-60b8-4c2a-8204-e67ade27ceb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ede5b27-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787231769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231769, "uuid": "e7dbdfe5-e895-429c-a9e1-2880ba8dbd84", "comment": "Malware payload", "value": "4c5bf910afd87fbd38b7b653925c12e2", "object_relation": "md5", "Tag": [ { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231769, "uuid": "4021e83f-1006-4aaa-834b-bae340278b95", "comment": "Malware payload", "value": "5ea524a6e999cc2794cd9662f0e008b22ec0596c54e6c9bad2ef71036e1a8356", "object_relation": "sha256", "Tag": [ { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231769, "uuid": "26ab1b8a-6cdf-43de-9001-26dbd684219a", "value": "T1E54633D56D261151CFA8C9B4F180199BFD83E35E1880533962CBBD2797A8A0F37E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231769, "uuid": "b32d0b58-930b-4b86-b9e7-badb13f15214", "value": "5f800b572e9989276193558ad276d956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231769, "uuid": "76f9f090-2bcd-4731-b5aa-6b6ed15047a7", "value": "98304:6z2dat6Yqww7jqcmI+YAwsF3wSYsNltcWE2GQGu5mG91c8MgC:FVw0v6b3B2N2GQGu5s83C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787231769, "uuid": "cdd39574-181f-419f-8e77-88541f0a3c14", "value": 5505824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231769, "uuid": "b3f41c9f-23da-4a0d-8dbe-31fc8182cc81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8bb63f-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787231770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231770, "uuid": "91099d82-d381-4382-95e5-b1d7f965c9f8", "comment": "Malware payload", "value": "8174966ffe5631fca12b972c961effd0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231770, "uuid": "b1ca750b-6efd-4e53-bdde-c8dacf291832", "comment": "Malware payload", "value": "ed6e8b04d02cb18fad664fc9003fe1d5cca8731ebdbbf3a07bb44c1df4b2e4e8", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231770, "uuid": "47aeb852-914e-45d1-a376-fc14c4637928", "value": "T1CEB533B0640B7D9A3D7B68C8E4612124FC15AD9B91EA1439FD8BB6F858C9439DE7C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231770, "uuid": "b98ef50c-0ae9-4889-a320-2aacf79c04d3", "value": "49152:8A3C2JyJiuj0gtd7D5188bLtUqh9Scxrk2:8QFcXj0gP7l1FircxrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787231770, "uuid": "e43fbc09-67f2-4050-baa8-d63d765a690c", "value": 2362769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231770, "uuid": "edd530a1-f23e-4f5e-a1fc-c1c5b5788110", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7208433f-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787231828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231828, "uuid": "ed4fc8bc-e6af-4ff6-b267-c7e61b6f56ef", "comment": "Malware payload", "value": "9b574be12ddebdc76a01f57b26041106", "object_relation": "md5", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231828, "uuid": "f640d546-2df7-49a2-bd04-3af9ad5f2682", "comment": "Malware payload", "value": "2a97c244bd952d59b218f549cc201014c01115877db8dddf0ee253e90319e1d8", "object_relation": "sha256", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231828, "uuid": "17272dda-9aa8-414a-9494-c5fe77f358cf", "value": "T1081523F5C1BB2B02ECFDCEE80AA215A591D2F96B4461B5ECDCC559C63B3AE93057C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231828, "uuid": "e8c7ac3b-ec07-4c3a-aae0-74a3f3d83d96", "value": "24576:Pk8EIpn8FDKk1enNeCXB9CzsUw8va6Bt0O0T4wqIO8xeB:Pl4DjuesMoKa6gJvQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787231828, "uuid": "9dcf2e77-75b8-464f-b8f1-1a18f9329925", "value": 941617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231828, "uuid": "8e9618b7-cf90-49fb-b673-0d3e16ad486d", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14414b4f-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload (ConnectWise)", "timestamp": 1787233818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787233818, "uuid": "583fb318-9be9-4671-ad65-bde6fd2b6d39", "comment": "Malware payload (ConnectWise)", "value": "ce9a2a40724894c9694398674725f982", "object_relation": "md5", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#db9821", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787233818, "uuid": "ea8f560f-caa2-46af-873c-08874afff8b5", "comment": "Malware payload (ConnectWise)", "value": "9a6a2a3a88cde3da3256143d6094219a252adae010ad19886119a4fd82a663bc", "object_relation": "sha256", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#db9821", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787233818, "uuid": "fe5535f7-4e1d-440d-a1b0-5b301a152672", "value": "T1E9E6232267E8D425F1B64B36EC3A86B16B39BC00DF15C40F2764785D6972D81C2A37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787233818, "uuid": "88bda9b2-c6a1-4e27-80e9-e545aea44f63", "value": "393216:sq5VDBCDxjQEbq5VDBCDxgq5VDBCDxTq5VDBCDxNq5VDBCDxGq5VDBCDxp:spCEbpup9p3pwpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787233818, "uuid": "d715ff1a-56e9-4474-a9e2-a7555593327d", "value": 14577664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787233818, "uuid": "5d2763fa-f646-4f9d-9d28-736aa69791f0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46b562c-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787234060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234060, "uuid": "2c946a66-4631-4333-862f-d8b593524400", "comment": "Malware payload", "value": "e13fcf68f0af558907867a70f873ffc7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#866f51", "exportable": true, "hide_tag": false }, { "name": "hancitor", "colour": "#b5c6fc", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234060, "uuid": "efcbaa07-b6c0-432e-a024-a03c1214c0d4", "comment": "Malware payload", "value": "3790531859ba87b43e626ecd2f452a52a58f3527a67b8147e4dd786e557d0f7c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#866f51", "exportable": true, "hide_tag": false }, { "name": "hancitor", "colour": "#b5c6fc", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234060, "uuid": "d286bc96-5bef-4261-820d-8517449d0de5", "value": "T1BE11E1A609454C05233443993892F10D8843D14F0B8C6D9074AA907F15E67C2C6F7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234060, "uuid": "7053f2e9-556b-4675-ac1a-90915f928ff7", "value": "24:0WT6StHRFBN/WN/7NoflzRfl6bqIOOPWOVgDM:0WnBNuNQJNKOOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787234060, "uuid": "7f54a945-07bc-4efa-9828-26cc718d635a", "value": 958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234060, "uuid": "8f90b6b4-38ff-4ddc-9d27-84ee95220616", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417afe3f-9ca0-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787234753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234753, "uuid": "7c70777c-37ff-48bc-926e-59b20392f7c3", "comment": "Malware payload", "value": "1f97ae28b06a79cf125ef2946b88981b", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234753, "uuid": "482c7199-6027-4478-a928-9399b19a1dc2", "comment": "Malware payload", "value": "9f0ba38b7e5b93833623c9f90d10ed33f37d168bfca00f652483953eb8503d6e", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234753, "uuid": "b8214985-26df-465f-9551-d68093474bb2", "value": "T182C18376A804CD4BEC61BE5A007EBE3A54CD893B47A4CD7CAADCCE1506025BA6F91D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234753, "uuid": "3e6ea59a-3667-4e8c-b348-78ce98d01a34", "value": "96:ERy+MPOynYosLvnK0ggMcD59tcn2qBu7cg1xqzcfxmbcfEWtacTKEoouW:b+UObomnPm2MgnqzcJmQXmoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787234753, "uuid": "f8ea5b51-5af7-454f-81ff-76a83ea6c8d4", "value": 5898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234753, "uuid": "c3435ae4-285e-4b82-b5ac-784484df5c8a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4cc66b-9ca0-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787235044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787235044, "uuid": "0aeda8be-1dea-4ee3-ad86-baaecdea660f", "comment": "Malware payload", "value": "205a1b7d3a555369db5fbfea8237706a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787235044, "uuid": "daa4c366-7a39-4b73-a6b0-3627f485cc5b", "comment": "Malware payload", "value": "e81416a48afd066b86656da22375814e3a21cff14ac128718e9c03bc9f3b8ec1", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787235044, "uuid": "31c33e6b-dea7-4c49-b8cb-5d243c5f6541", "value": "T13493E871348DA839224F818FC253370C70DEDED5E212A5E5F2FA5238A5F9D903AB36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787235044, "uuid": "49405456-650c-4f6e-9744-df402546baa0", "value": "1536:dap9kuEEwH8kw0PMqpYJKNoE+pTYeGf8BqLv3Tli0oRGpNuqYPPX6IH8LutVWw:MIuEEwH890j+pHBqv3Tli0oRGpNuqYPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787235044, "uuid": "7af3238c-62ce-4fd3-a231-9f8139a41627", "value": 89613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787235044, "uuid": "114382e6-6e1a-4693-b6a7-5bcc1a8e3cfb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c19e9f-9ca3-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787236000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787236000, "uuid": "f223b1ee-6c54-4551-bc8a-27fc33551de1", "comment": "Malware payload", "value": "d675b40c3982f559118d3883fc0e6e0b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787236000, "uuid": "bfe33643-d03e-4ab6-9c91-7079e8b6d2d6", "comment": "Malware payload", "value": "59812582b6e6cc798d96f8aa311d14f51ade280db96792ac49af81483695ffdf", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787236000, "uuid": "782f7fc4-f1f6-480f-8c0f-2fed18c2ea9d", "value": "T1B52302B5DC0C70067D2DB0D5B3F821A2C22449A9DB2A9E36049ECC827637B0D2DC93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787236000, "uuid": "b8aa139a-45e3-4598-9725-3481c6b2bbce", "value": "768:BPkLW48WG4gvSUjZcrGDoewM4IP8f4f4emaamPtUwJowhs1LBEyKTsSIkSF2kyH6:BcLW4AouFwK4Nm7RyVcTIkUsdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787236000, "uuid": "ac571044-aa0c-4792-a90d-8c37ee4446c2", "value": 46841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787236000, "uuid": "242cb0dc-321c-4826-841f-73d93aa25761", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133b9c78-909f-11f1-8d7b-82aee05be84a", "comment": "Malware payload (Formbook)", "timestamp": 1787236926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787236926, "uuid": "e8051ad6-7551-4c56-ab3d-ba4ff7723a6b", "comment": "Malware payload (Formbook)", "value": "f01afca27ee2c5d8779eed816bf8c91d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787236926, "uuid": "1acc9faa-7066-4904-b786-a4dd30ba19e8", "comment": "Malware payload (Formbook)", "value": "3ddce244c308f1ce27307b16467f29bd7f3e2333c535cb4a0c5d93a0b7296230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787236926, "uuid": "5e70c2a0-b90c-4d5d-9b53-6ebddf4ab5cc", "value": "T1AD54230235DBF9A7EE95C8F3CE1BC08F553595380B8FF90A72568CDA06104F56EA89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787236926, "uuid": "016fd264-2cb6-4684-b941-925b735836f1", "value": "6144:MYd77T/BjuU/aTca6vBOCi2udXrdw7vdZury71AebVUDX:577TNZ/tBOr2ErdwZ57yebV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787236926, "uuid": "6f24bedc-7f30-45cb-9ff4-831766812631", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787236926, "uuid": "d36fa996-ac14-4efa-8f56-22acb229e9e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "998f4489-9ca5-11f1-8686-82aee05be84a", "comment": "Malware payload (Formbook)", "timestamp": 1787237048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237048, "uuid": "f9952e7f-4398-4afb-9dff-41ab71b1c353", "comment": "Malware payload (Formbook)", "value": "8f42c066a13d5e5d023c96607d310414", "object_relation": "md5", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237048, "uuid": "3a43de69-d568-4c38-806d-ca5d19ef5621", "comment": "Malware payload (Formbook)", "value": "4b0d8aaa3f52f48c5c59d368bf925b4456f39162b16dba03dc328678c6208a7b", "object_relation": "sha256", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237048, "uuid": "5a2da113-475a-4652-9f2a-6a91d8b17d1a", "value": "T18754236EC58EA42FCB849471D471C2F34A707AFAD084B807B145DEDBCEE27B49052A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237048, "uuid": "af1d710c-f90e-471f-93e4-45c5fd912fe5", "value": "6144:B6HfdXA2HFgyUtCFqFwdrCeOf7nrAgtkbsUNl9+HGFoEy6th7p:oXh/UtvwZCe6rMbTzZv3t/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787237048, "uuid": "8461f11f-bcb9-4380-8581-ad22432d54dd", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237048, "uuid": "351400ad-a2da-4fae-97bd-bdeff50a2ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acfb333-9ca5-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787237050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237050, "uuid": "5e769d79-2311-4c7d-a3ee-c85836a3cf99", "comment": "Malware payload", "value": "38fca63fa1c96f1c6ff45378996cc16a", "object_relation": "md5", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237050, "uuid": "552f88dc-fe4c-4da7-b213-58eb5357fea9", "comment": "Malware payload", "value": "d4014b2f24d7ddbd798162fbc94fc812ed0ad035f999f9205c6d2775a8fe526c", "object_relation": "sha256", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237050, "uuid": "08312440-8dc9-4fd2-9f68-31290bdc34cd", "value": "T1DC1533762C9398755CEB30AD9E3029928FFD37C008DFB8C28012DA8558D967A5CD5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237050, "uuid": "3c99eb66-249b-4766-ba82-34fa34e64fa0", "value": "24576:Je22YgNFDGUcXEgbjooiJlXYwhxJaqXB9Ubvmt9u52HK7P:JeJYUFD7gbjooiXXTxJCmt+eK7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787237050, "uuid": "1e6c2648-01a5-4dfd-a7fa-26acc4be2f0e", "value": 956940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237050, "uuid": "ab57b053-ee00-4eff-b7ee-15bd597284f5", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be277051-9ca5-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787237109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237109, "uuid": "ff1306cb-899e-4aea-b40b-fb9235d77a75", "comment": "Malware payload", "value": "0836b7c1966d2dbe1b8932fc8ad1785d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237109, "uuid": "399b395e-2880-4137-a12c-527470d7f348", "comment": "Malware payload", "value": "fa15616fc950c7c88d2f52f7054d4d1c696a60517dc519b987164dcc6d3776ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237109, "uuid": "871b1415-4189-4b8a-9f9a-7aa1a2021fed", "value": "T133C529F698A5BF23B7B64E0863702F99501412370F8B015AB5FEC3C5E6939B9346F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237109, "uuid": "a903d6bb-7f21-46e9-8acf-0ec63e5c0577", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFT2d5YJUA:m0eF4xaDjDONijDG8ZxFTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787237109, "uuid": "8f99047f-d68c-47d7-bfb9-2b694d01db59", "value": 2628594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237109, "uuid": "1ea4b3cc-b8bc-43e6-b866-0c96466f3833", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f40a4a2-9ca6-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787237272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237272, "uuid": "5155bb60-db8a-4566-a56b-c72323e7d340", "comment": "Malware payload", "value": "0a33bd9b46a16919ff0794bcb42cd313", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237272, "uuid": "4b25fd68-5ee7-4854-93e8-d275f531662a", "comment": "Malware payload", "value": "c9ccbff7906990f07308503d3a5f77540ea3713e9624527eab62c61d94e97572", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237272, "uuid": "49836d23-8d40-4a49-bc2c-c1ae99cbfc8c", "value": "T1E3E0F100D8A08D14423002002DC1F9095D8AE78787859E0822EB507C0FC5782CDDF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237272, "uuid": "24915c71-3aa2-4870-8df8-0099723cdd61", "value": "6:qTIuJzhqIwGiY63fAbplilAl+u+AqIbR2AWHwlJV4LKTjawl8IjqwF0NAEdpQCbJ:qTp0JYyg9/qsPWaV1jqwqAEd2QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787237272, "uuid": "67f8b3ad-b193-4d5e-9c4d-3c29e747ea3d", "value": 392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237272, "uuid": "a34598d6-5b6b-46c2-baac-86b381658fbd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a81ec28-9ca6-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787237345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237345, "uuid": "2afa4385-a39f-4a47-aed2-e7987cbbc29a", "comment": "Malware payload", "value": "d80fab87627e323334931060fd60a9f2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#bf35ee", "exportable": true, "hide_tag": false }, { "name": "kadam", "colour": "#ad3004", "exportable": true, "hide_tag": false }, { "name": "Malvertising", "colour": "#096d84", "exportable": true, "hide_tag": false }, { "name": "redirector", "colour": "#b57ea7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237345, "uuid": "eea89497-92fa-422b-8e24-f7a5e0dad875", "comment": "Malware payload", "value": "934acc5837e855d0f34dd635b6a85626e01ab7ad91a06f1777477bcbd3bea6d9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#bf35ee", "exportable": true, "hide_tag": false }, { "name": "kadam", "colour": "#ad3004", "exportable": true, "hide_tag": false }, { "name": "Malvertising", "colour": "#096d84", "exportable": true, "hide_tag": false }, { "name": "redirector", "colour": "#b57ea7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237345, "uuid": "45539f5e-7ffd-4df9-9c19-c26e3efd9f62", "value": "T1A0F2D8D87296B07112B77176A13FA20AB33B69896C0E8050D12798D17C7DE8FD227F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237345, "uuid": "d9a0927e-37d4-4ae2-ba63-ad3bb6f647bb", "value": "768:0csMI3obj//N1RhODXTWL3taf11gRkDJ8wE7LtqENEPuElFk0+E7lk:x1RhODyA1EYJ27b2PxlFk0h7lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787237345, "uuid": "2346c782-cd21-4d60-bc8a-fd51acb835e1", "value": 37613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237345, "uuid": "324f6fe4-e147-4ac3-a26c-b24982d992fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3a88dd-9ca6-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787237376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237376, "uuid": "e95f5bfd-658d-4f7a-84dc-fd78af0504ea", "comment": "Malware payload", "value": "8d3f36a18ab393fec51409a494f9319f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#d08580", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237376, "uuid": "a388259c-e211-42a7-916a-e602562fbad0", "comment": "Malware payload", "value": "3c9652edc983c5b7267f545cc5d0a0293b04edaa50fa9bd0d93399642fd34b3c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#d08580", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237376, "uuid": "58fff84f-5bb2-409d-bc3f-07620d550a8f", "value": "T15185226167B45DB5293E43B7AE062B0CA713C916C34EB2F0E4E7D29452CDF615BA2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237376, "uuid": "f95d7859-c198-4796-aebe-3f4cd3994346", "value": "24576:XucZPkfb6R39Ekz+lLfBKe+UyHGIPPSuL3TFgzJD33ea/3+j+Tdh60PkKvfTK2zM:TNAEHXxk9fqSdHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787237376, "uuid": "1f16ec0f-330b-4e73-9801-8641257dc0c7", "value": 1721535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237376, "uuid": "9770995e-5876-417c-866b-9c90665bad57", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9407076-9ca7-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787237987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237987, "uuid": "de746147-153d-405a-a7ed-81b3cfea446e", "comment": "Malware payload", "value": "71f646bf121286543779bcf957e501ad", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237987, "uuid": "74559fb2-027a-42ce-84d5-f64eb9eb89ea", "comment": "Malware payload", "value": "4497ba13cd9eb5f7c0a0b7272769234d3443ddc073d8fb3a194de37ad8e12ad5", "object_relation": "sha256", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237987, "uuid": "86f82469-4d69-4043-b2db-e65fe39b5209", "value": "T1236633FA69C3891BD993FEC9783014A654C250F9D0E1070E07A996BFE49D84078E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237987, "uuid": "63f0c448-1bf5-40ea-9bee-a0e3aa92d3ae", "value": "98304:S4EDeS+q9flwiuM6FBy2NEIDa2dvWH7QT/so6vdUWe9JwrreF6DJ9NvFc0UTQ9:bS+qjwZFY2NE2dObQT/9eqfJgy+9Pik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787237987, "uuid": "c4746f71-827c-49e1-8ec9-e846ac21522b", "value": 6923981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237987, "uuid": "236fe592-9602-4816-a1db-0c126e9d4980", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845033c0-9ca8-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787238301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238301, "uuid": "24085b1f-f0c6-4380-96fc-f72eff0b80e0", "comment": "Malware payload", "value": "036b50c64cd856d4b04dc3b7964770bf", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238301, "uuid": "912af0c1-247a-4aa4-a0b5-8c7b7fe78a8d", "comment": "Malware payload", "value": "0ada2d2ba1d1f54194e8071359691c491613c3e6f3d79d8199ef67ba87d9dd28", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238301, "uuid": "9b721b8c-5366-4cd3-8da7-b2492011baac", "value": "T1FBF3E85EBBB23276721B8309FAC1B768916DC153EA011EE7BDB5F118CBC229201736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238301, "uuid": "02d66cc2-f739-4851-981a-a43751295373", "value": "1536:japAr5lURr4kjofmmkWl0Fr/vqLBavZWkOA4Y4hJgTnUX0vZI:Gd4kyA4vJgTtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787238301, "uuid": "19aaefed-b1f3-458e-be11-0a8090801c39", "value": 157652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238301, "uuid": "56e39440-56fd-478e-8a12-50dd8579ee16", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898880d7-9ca8-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787238310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238310, "uuid": "e5a9944e-e828-4986-be3d-3dedf424dcea", "comment": "Malware payload", "value": "75d1e8bf88188b0321453e0e5820a353", "object_relation": "md5", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238310, "uuid": "7c8438fd-0be1-47b2-960e-81a6a8ac24f1", "comment": "Malware payload", "value": "1a2205faeac30ebb4eb26c9c8672d9c41d62cb0f08cd52bef560b7e6b02665c7", "object_relation": "sha256", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238310, "uuid": "c000dcc4-4404-473e-890b-59fdf55f922f", "value": "T1C9A527E288B0FF17B7661D1873745E691018153B0FDB0209B8BEDBC67683DAA346F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238310, "uuid": "9787c04c-ee6a-4923-8ad8-ec86774c01fb", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFTR:m0eF4xaDjDONijDG8ZxFTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787238310, "uuid": "c0bcb6c0-035e-4586-9edf-a4b6dffda21c", "value": 2152390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238310, "uuid": "e35a6187-190b-491c-8937-20d8e32c36f3", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0beb76-9ca9-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787238668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238668, "uuid": "4afcc735-a6e9-463f-bf13-4dd6ee076e33", "comment": "Malware payload", "value": "9049302a255867dfdd42b4df04678c43", "object_relation": "md5", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238668, "uuid": "164ef60f-e1c4-4a0e-b58e-8088da9c99cf", "comment": "Malware payload", "value": "b4d53a191080d86792633e3e9e631b95b21b1b0799931dc82384ff26fffd3794", "object_relation": "sha256", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238668, "uuid": "ae83d2b0-d3ee-4e7e-90e8-7014b6f6de69", "value": "T18CD56BA688B1FF13B7BA8E4873341E5D101426370FCB150AB4BED7C67683A65346F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238668, "uuid": "fcd581b7-3bf1-4dd8-a412-c46897aebd5e", "value": "49152:TK0rN4F4Cd6Jag2j0riZgNudjDG8ZX8LSJFTC3VHaO+8:m0eF4xaDjDONijDG8ZxFTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787238668, "uuid": "3bdaadc0-a953-44e1-886b-89cff4f81ade", "value": 2989466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238668, "uuid": "0400980d-6715-401c-8614-99254cff8bbd", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664b6a64-9ca9-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787238680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238680, "uuid": "9a2159d4-491c-41d4-a8c8-5b19165920fe", "comment": "Malware payload", "value": "b5d927c3d11673673c10eb77492ee6db", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238680, "uuid": "7fed3bf5-1b77-41af-bc67-babc4c73c5be", "comment": "Malware payload", "value": "d8da6de51db4ba85186300ebdb7d6d3c1249c7716fd1b4f62a4f167ccedabfc7", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238680, "uuid": "43fca017-abd8-47e5-a24b-62d910c677ae", "value": "T12FF3E85EBBB23276721B8309FAC1B768916DC153EA011EE7BDB5F118CBC229201736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238680, "uuid": "a82c64bb-f4f9-4798-b035-2befebb846f1", "value": "1536:5apArYlURr4k3bpnIPMAyCJ/Wg+jrF0o1iF4B1hYTynUX0vZI:Ym4k4F4dYTytW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787238680, "uuid": "ab70b11e-1ed4-4743-b8b6-121ca5815582", "value": 157603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238680, "uuid": "e81a139d-f0ca-4c0c-9a21-2688731f95ce", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0673493-9ca9-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787238912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238912, "uuid": "d2a2c355-bae4-44a5-8640-ef8947dfdd59", "comment": "Malware payload", "value": "b3d005ec741f392b2f72b02e89aa3551", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238912, "uuid": "181b81d6-8f54-4c37-9aba-576759dc1a07", "comment": "Malware payload", "value": "585b29c25859a57233790ab591bbcd09fbc7d620d13a3a66abdfaf48984b7ae7", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238912, "uuid": "79365888-5487-4fbd-a5e3-224b6805d31c", "value": "T10663F97378C6142A311F028F6107732CB5BA99D6DA01D9F1F6F661285BB4FA136F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238912, "uuid": "2f3e1478-acb8-4ea9-880d-a1b9d05434c4", "value": "768:uNZdypGVU1pupU0nMF/FbD3tKAD27p+EeLSJb9ee7xlqafPWuo0sCy:uFyp4UKMpxD3tKAD2VDeLSJbnlqafPW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787238912, "uuid": "8b23634a-cec5-41d0-8f91-7dd8543cea88", "value": 70350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238912, "uuid": "85fd0e1b-9825-4a98-8de4-3df60f775186", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b9ad66-9cab-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787239538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787239538, "uuid": "aaa634bd-debe-4f21-8917-0028006eed93", "comment": "Malware payload", "value": "20cee0600e8a88955d3c03e784152cfe", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787239538, "uuid": "52c18a1b-ed21-43c6-88b5-ea78376bfbab", "comment": "Malware payload", "value": "c30b44854e443bed32d07968e0639dae36729d77263c9f38d59147aee0422469", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239538, "uuid": "d0e00dc0-ee45-455c-a8a8-99e33933c5cd", "value": "T1C1D52395BDF61874D833C77B6DA3E06EB12977914B316C873AC8AA008D135885C3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239538, "uuid": "e7cd7869-f43a-45a3-b2e4-f7e3f4543032", "value": "cc678ea372003a91fefb68ce6b422039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239538, "uuid": "8ba83d77-3a73-4d7a-958b-5e4ba31bd1b7", "value": "49152:fabsdfaUrrrG/u7eY5quURqDVEnMiMgT340Lvyc32B3yyqoinmTkFV+L:faMao/7F6Rq5SM6T5vg1zqLm7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787239538, "uuid": "045551ca-300d-4430-9922-37e14ec506e8", "value": 3010560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239538, "uuid": "091ce0b9-5fbd-484c-963f-c0ccd9db97cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc5bb5f-9cab-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787239689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787239689, "uuid": "434bb838-c8f9-4079-a7e3-35905c0ccd1c", "comment": "Malware payload", "value": "d1696c52ec29719de70dcec43269372a", "object_relation": "md5", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787239689, "uuid": "ece39066-104a-43d7-ba5d-3dda4c21f536", "comment": "Malware payload", "value": "2f085c531338b95b02c2a957d87af64596ae4a358831ec4490d7ea9333dacd78", "object_relation": "sha256", "Tag": [ { "name": "censys", "colour": "#97DA5B", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false }, { "name": "ClickFix-cc", "colour": "#F076C8", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#0153b0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239689, "uuid": "a90d1f1e-619d-4f89-b8b7-389fd0078045", "value": "T18EB186234829AC721157CAA4B146762DC0EA8277F342C65A72FD815C9FD3DC381E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239689, "uuid": "937cacff-99bb-4d33-9c00-702a3a4e5142", "value": "96:MJlH7n472wO36VvLb9NE0kNUmgHwrSUx9PGgq/GNt7sGGExml51pOT1pV8Q3O3NZ:MvH7n472wa6VvLb79GUm3H9PWGNt7sx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787239689, "uuid": "32fafff3-7efa-4ecd-9e90-ae0cf642a2a8", "value": 5413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239689, "uuid": "4fb1357d-bb88-4d67-92ce-8da38a339b54", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de755dd4-9cab-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787239741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787239741, "uuid": "d2334923-3601-4fd5-9752-66fd4fbc1b5a", "comment": "Malware payload (Mirai)", "value": "5dca36afb0133f137302bcca63c82e02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787239741, "uuid": "af1afb09-ba5c-405f-bd2c-713ad9211129", "comment": "Malware payload (Mirai)", "value": "1fe5cb991fc57e2439d2691ed2ac57d4992da555a55c968e4b35be014529823f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239741, "uuid": "2fda9800-5f3b-4d48-8e3d-4809773d5c51", "value": "T1AC74F80A6F550EBBD86BDD3706FA0B1234CCB84725993B367078ED14B94A54B4AE3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239741, "uuid": "72f37a4b-3222-4445-8049-78380036a607", "value": "6144:HHyUmsvN64q8nOYUhvP418LScdB3gxsDDatk:nygvsSivw17g3rDDatk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787239741, "uuid": "b7ab6ca7-c57a-4b5a-b950-991ec3bd3fad", "value": 347476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239741, "uuid": "9799eba7-39b7-4fd7-97e8-fe48ba5fac2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c68f9fa-9cac-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787240006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787240006, "uuid": "b1c03c52-16a5-46de-a587-7065651b5620", "comment": "Malware payload", "value": "7f6a2b47c50789bb2a7641db5f56e800", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787240006, "uuid": "163d3ccd-692c-4c98-a8fe-2b245b2a7023", "comment": "Malware payload", "value": "ac296fc3febc8741e059c09ae9ad90b2fb55cb68c6ceb64c9e7df07e90876183", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787240006, "uuid": "7aaac451-7a82-4f15-b3b5-4fa3329a6216", "value": "T19FD5238AFEBA40B9F873C3B35A83307CB169778447749D4A36CCD7504E12568AC3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787240006, "uuid": "3835d1a7-9da3-46c5-93c1-5b931ebb3962", "value": "24e8765fd838d429e6f908cdeb96c2d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787240006, "uuid": "a120b8b3-b7bf-425c-bcec-b9d1796ea120", "value": "49152:ZX6GMdKhCSB3p3HcZrgBnHJlpzkDfiy6AtbmyCG/ZiIakgdOo+lsrf97HrNt:ZPMQh1p38OBHXi96AlLtwlkgdnewFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787240006, "uuid": "1a1f7b22-8ba6-4c55-8e6b-dfc2f3d18355", "value": 2990080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787240006, "uuid": "5eb7a072-98fe-45f7-b460-fc1407c9d995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31939e79-9cb1-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787242028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242028, "uuid": "de81ee0e-9127-4d35-9c26-8d93d7dcf1c7", "comment": "Malware payload", "value": "a54ef04e995ac48fbe1ed797230ebb38", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242028, "uuid": "8386b487-00be-4b10-9fc9-bf243186c81b", "comment": "Malware payload", "value": "bffb8462002de9dc414ba9a4f74f803d99a336c7afeec3c9c05a0c89c014f407", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242028, "uuid": "bde67ad5-00ea-48d6-be47-cd1b603feb90", "value": "T1F68563B23D450CF2666EF9E649667CFFB41B7A6578EF92E3B40A0F5111827ACD6100", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242028, "uuid": "909c2801-a136-40bd-b45d-82011e3774dc", "value": "24576:CM/gY2B3DzIT5fsQTMNYZnaHn7l3nPHa1UdwsZNFI+iE8Qc6FTDtNhDtNezQF7L9:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787242028, "uuid": "d3cc13e0-f924-49fe-bbbe-39191950c93e", "value": 1819946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242028, "uuid": "a75e35f1-eda6-4101-931b-560af243f593", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "319bf99a-9cb1-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787242028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242028, "uuid": "9581120b-fac5-45c5-9b69-d0f2aa4b8a3e", "comment": "Malware payload", "value": "6cb34f46fd4e727de1e9f24fe4926fa8", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242028, "uuid": "163fb6e0-92cf-40c8-89a4-fb54315e1af7", "comment": "Malware payload", "value": "f5be102bc9678342db793cc56a34593a83d1f4a0f1a91e9870ffa8bc7be95881", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242028, "uuid": "cc144120-7c59-47dd-911c-342c21b7aa17", "value": "T1EF8533EC69B8E53E57ADCB5F86457A902D0864F637F147CE722C54CA0A9A478BF0CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242028, "uuid": "fc9f030d-7dbd-4d77-8af2-46713686c4e2", "value": "24576:v64SyK8sxB/7jpXHea6knUzW9EKeXE2eyjhdkMqsUrPVb1deCUWX7GSpLIKsaLkX:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787242028, "uuid": "fd78eb13-19c8-49c0-b5e8-32cbed67e1ec", "value": 1820695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242028, "uuid": "04465dd0-c183-4760-baeb-f2cd521b1a9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340b8683-9cb1-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787242032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242032, "uuid": "47e25044-1b64-446b-b184-f142ff1e7619", "comment": "Malware payload", "value": "2028b560f347823542042979e4e82b11", "object_relation": "md5", "Tag": [ { "name": "HypeAgent", "colour": "#DEFB3A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242032, "uuid": "114b4665-9551-4259-8150-d173fd52f0fe", "comment": "Malware payload", "value": "d8df49c39fc031f2f460f2bd632c43ac8c8f2aa27ca319ecd9ff259e2eca3768", "object_relation": "sha256", "Tag": [ { "name": "HypeAgent", "colour": "#DEFB3A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242032, "uuid": "282420ef-13be-483c-bf97-e0e5247d406f", "value": "T16DD5337B4070031C1AFCEC22B74DA78A9437D4CDFE768151E1864E5EF9890B4CA93D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242032, "uuid": "2cd3ece8-8aa3-48ac-80c0-aa036b83a2b8", "value": "49152:GZErsOUQTjpQlsn8oJgBVDr6IQr5yqP7Og/475emKtq32gcwaWq5cWQxXTpzAua7:fx5pQllHg1Pnu5MtqhcwanOfTtTlaq1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787242032, "uuid": "b8befe0b-9b47-4018-b0b5-dd0b124f1a0c", "value": 3015659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242032, "uuid": "2efd368f-acd0-408a-9b7f-3a7088eff4e9", "value": "image/png", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731dfb18-9cb2-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787242567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242567, "uuid": "c0a36726-fbbf-4e0f-8984-4a35de4f07e2", "comment": "Malware payload", "value": "ab78adb2180ff24502a091a61c7fff97", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242567, "uuid": "4fcc4b55-ad83-4f1c-99ab-b5383f46e07a", "comment": "Malware payload", "value": "f90cac678c07a3f06e7e9d39aa2cee6638f65bf04b95ee24f4994b1c9b96b8b1", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242567, "uuid": "8455d520-a302-4c30-92ed-d35bb92a2872", "value": "T1074533503F06E954B9B5A17BE923C9160B9216FD5F6D2D031FE8BC985C0E0A4A4F0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242567, "uuid": "d27a983e-b636-4c22-bc9f-c07b0e21c6f7", "value": "24576:dJhT4GQMoROnt1U2Fu1KY8ZV3D1F2NV1bk0G6pXd5YmFWKQYkbLogqTQ3ftGoHaU:pUHCnFuoY8Z9Db2N/bodNlAgqkvtZ5kW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787242567, "uuid": "f94a18b1-1f75-44be-946c-ffbfbf863629", "value": 1206082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787242567, "uuid": "401e9197-babe-4311-ade8-3e28eda525c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bb6bb6-9cb9-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787245440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787245440, "uuid": "d75070d2-4f45-4086-9942-a3aac8dfbad3", "comment": "Malware payload", "value": "b0d4adc46acdb9f35339362ba749eee0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#615a56", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787245440, "uuid": "7d5c595d-45aa-44f9-8ebe-cf09026057a2", "comment": "Malware payload", "value": "71f6c687db361d63fa3f3322be0c3b6a07bf95f376b81aaea940a099921877cd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#615a56", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787245440, "uuid": "201edee8-e096-403b-b5d9-fe12f3b6d7b8", "value": "T180179E7AF1B800A4D4BAD0BCC657A617FBB17855433467CF16909AB61F23BE09A7E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787245440, "uuid": "690405e5-bebb-4209-ba74-3f45b28474ad", "value": "1e2b04f1e38431713df8dd13231829a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787245440, "uuid": "46eb18db-6db1-4e19-ad42-64a47793c205", "value": "393216:rWNSXJ4vHiQYy+1ssrlZ4N1xhHnqQJutCfBo:SNS54SOO7tCfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787245440, "uuid": "782130fa-2f27-494a-a871-f80ff681a910", "value": 19422208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787245440, "uuid": "975b30e0-84ec-435a-8d75-9072d561df6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d82bf0-9cbc-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787246952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787246952, "uuid": "8d93fd47-82aa-41a6-ac0a-0f5988314c47", "comment": "Malware payload", "value": "01e37c14622ac5990b5e12a8a1124a9f", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787246952, "uuid": "c743ae09-58cc-43b2-a226-4aae792d647d", "comment": "Malware payload", "value": "9ba593c8258860d4ed0ce2235e9f3d205b71567121f427641deff72af4a221a7", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787246952, "uuid": "f463a7a4-ea2d-463c-add4-67182deba6ba", "value": "T16FD523E7A9F20870C876CBB3AF82E47EB0997B4157A18D5BFADC79008C524585C3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787246952, "uuid": "ce64f9f0-3c0f-4fef-9b0c-dba399ef33ca", "value": "b8048b8957358587b4fda264349e8f60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787246952, "uuid": "5fc9c59f-9424-4394-82ca-e1e5c952cd1e", "value": "49152:E/eCYTiokvsuE6UGh+zez9R47EbRXzSYW3Rf5Ohm7L+Qn0kmsM2Bg3mSdI9/0:EI2vI6/hVzUo1W7BhOhmmQ0F2BgWSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787246952, "uuid": "c1217f41-4979-459e-b15e-a2a23997ee69", "value": 2922496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787246952, "uuid": "d0a82735-c320-47f6-bb24-9d9075c4012b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae6078b-9cbc-11f1-8686-82aee05be84a", "comment": "Malware payload (CoinMiner)", "timestamp": 1787247090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787247090, "uuid": "65418fcf-7eb7-4049-a3ea-c051501e77e4", "comment": "Malware payload (CoinMiner)", "value": "7f47881dc207b40b3a3a2725b7d074b2", "object_relation": "md5", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787247090, "uuid": "72885591-50a4-4110-bcd0-f1088d12fc30", "comment": "Malware payload (CoinMiner)", "value": "fe90b0f1eb82ff6918fa8bfdf9b3b9b6150ca27fe910f8899241d07a2e57a309", "object_relation": "sha256", "Tag": [ { "name": "42d208560b5e968930dcedab3c2bf57b", "colour": "#7d1dd8", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false }, { "name": "dropped-by-remus", "colour": "#7e486b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247090, "uuid": "c40b536e-197a-406b-96df-46b01ff10e79", "value": "T1893633A6AD8B80B0D147C7F5916374ACB33F7B990964BD1A76CC29884E96F00A53F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247090, "uuid": "d32c1843-9ac8-4cbb-98da-74a358da44fc", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247090, "uuid": "e1f41c20-c29d-4577-af46-d507fe7227af", "value": "98304:2XZ5+7x3RYl7xoasvoy3uqYu/t7jTVn9hEMMADozcIVqPK/kGGPzBqqq/x:2rax3uLstuqFLV9hRbrIVqy/vGrcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787247090, "uuid": "e205986c-99ad-4712-842b-2bccd9098979", "value": 5272576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247090, "uuid": "9b32b3ed-9cc0-4dde-ac4a-cb6b2610045d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a77bbb4-9cbd-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787247170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787247170, "uuid": "67970f99-fcec-4e6b-8fc1-d25616fbb910", "comment": "Malware payload", "value": "8bf7e57fa4c94364b23509816e191c9f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787247170, "uuid": "0b7dd72a-69af-4a3a-971f-d6c3aa5a454b", "comment": "Malware payload", "value": "ef934adf694468560d1c78ec13639dbe21bc5cb93cefee0d1949043479dff61a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247170, "uuid": "37e30587-caf1-4f59-ab3f-d0013a31d53e", "value": "T16803279E729044FCD866C135D6F78337DA72FCA81974166E1B64CA362F30AB05B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247170, "uuid": "63851635-e837-4041-9c07-e47039c10dbc", "value": "54420143057cda58267e1f513b321387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247170, "uuid": "1b309cad-a741-4746-a416-38bae9083bcb", "value": "384:3DDLX7EXmoDf2MxnzXoHdXd4kySJzKAQh5fRFk+98SWRLWxCW:3z7smYjoHdthySJzDQhdR688VzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787247170, "uuid": "49fe4bee-2eae-44e1-a0c0-3de529ae8167", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247170, "uuid": "6ae60fa0-5104-4bd1-8771-b1d9e1aeff16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed442732-9cc0-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787248785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787248785, "uuid": "4e50ee76-2427-4282-891f-b4ad112fd521", "comment": "Malware payload", "value": "909ad94411ac7d5c8f0646a32a3a0c49", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#866f51", "exportable": true, "hide_tag": false }, { "name": "emotet", "colour": "#23d4e5", "exportable": true, "hide_tag": false }, { "name": "epoch2", "colour": "#FF6699", "exportable": true, "hide_tag": false }, { "name": "heodo", "colour": "#75b3dc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787248785, "uuid": "c2131638-f5aa-4690-bf93-fc2745c89e8b", "comment": "Malware payload", "value": "1ef80cbc4e47a032d84f9c96017949c2aa16c4d689964fcde69577eb5119640a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#866f51", "exportable": true, "hide_tag": false }, { "name": "emotet", "colour": "#23d4e5", "exportable": true, "hide_tag": false }, { "name": "epoch2", "colour": "#FF6699", "exportable": true, "hide_tag": false }, { "name": "heodo", "colour": "#75b3dc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787248785, "uuid": "c35347e1-58d2-4eb7-a71f-f68eb698f942", "value": "T19B837F1A997E107B2797E5D07BD96B9B31C2301FF3659C193EFCA2A00F19C7D8984A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787248785, "uuid": "a5e491a6-f1b3-46a9-8a08-938b0af07abe", "value": "1536:F213x2KCKWHbsFOUTEI+c5Xdrj0wo4VhIZxqiBeaw:q3x2S/Z+c5NrXorZxqAeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787248785, "uuid": "57b80e53-a198-4367-a069-d0b51df9f2f9", "value": 87352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787248785, "uuid": "1bc89412-d1ca-44fd-83f0-a70000ee5036", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb1c0f8-9cc9-11f1-8686-82aee05be84a", "comment": "Malware payload (Mirai)", "timestamp": 1787252433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787252433, "uuid": "630a762f-c306-465b-855b-9766866c25f0", "comment": "Malware payload (Mirai)", "value": "0a40cb59fd08a11970a875d3bdc90446", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787252433, "uuid": "a22ad6a6-e67b-4c3e-aada-7b0bb13f8742", "comment": "Malware payload (Mirai)", "value": "b6f9b9ece65c6e3c15fe362a7e01539058433d3f8d9f6ad78791dc2bf9e6ddfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787252433, "uuid": "0283609b-01a7-4061-a22a-3728e978b50c", "value": "T1CF047CC16DA3E0F1D5534A76526F9B158A36D833022ED611FB6E19387F02620E7AB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787252433, "uuid": "dbaf1426-cb35-4124-8d6e-245180c3ff57", "value": "3072:l1sn16sJMprzJy6Oc1t63wshEskDAfcseLanu1EssMZc/T03ImIys61X1h5ob8:bS6sJ83JfhXDs7eLaEEssMOgh5oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787252433, "uuid": "98c70e26-6c60-4a02-89d9-388031bbc0b5", "value": 179852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787252433, "uuid": "5d2fe19c-8547-47f3-976d-5ab7df20c6b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee720f6-7fdd-11eb-99ee-ac162dbe2a66", "comment": "Malware payload", "timestamp": 1787257926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787257926, "uuid": "a3e94df1-754a-44c5-afc1-58599473f5a3", "comment": "Malware payload", "value": "a73ddd6ec22462db955439f665cad4e6", "object_relation": "md5", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arc", "colour": "#0d6598", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#8b9939", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "Mozi.a", "colour": "#ab09a0", "exportable": true, "hide_tag": false }, { "name": "PowerPC", "colour": "#ff7a12", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#36e61e", "exportable": true, "hide_tag": false }, { "name": "SuperH", "colour": "#25a3d8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#0fa3df", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787257926, "uuid": "40062951-eb5f-4b2b-b740-e90310e904fb", "comment": "Malware payload", "value": "b5cf68c7cb5bb2d21d60bf6654926f61566d95bfd7c9f9e182d032f1da5b4605", "object_relation": "sha256", "Tag": [ { "name": "", "colour": "#242a7c", "exportable": true, "hide_tag": false }, { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arc", "colour": "#0d6598", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "hajime", "colour": "#9ffdd8", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#8b9939", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false }, { "name": "Mozi.a", "colour": "#ab09a0", "exportable": true, "hide_tag": false }, { "name": "PowerPC", "colour": "#ff7a12", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#36e61e", "exportable": true, "hide_tag": false }, { "name": "SuperH", "colour": "#25a3d8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#0fa3df", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787257926, "uuid": "4096eb55-2ca8-4ea7-9b25-a934304c1798", "value": "79D312B3C639E3EAF471E4B0B66C23CC101462D9C958BAA0774C54661B5439B1B6F3DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787257926, "uuid": "0b8515ff-0c89-498f-9736-c0e70cdde746", "value": "3072:2glZ3FtCKXhkmHtZ9TEKzjfj/WMngyIfsJ0F7xPtoM:2IIKXhZtL7jOTyIG87Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787257926, "uuid": "eb80b9a5-c36c-40a6-ad6b-3915f3ed27c1", "value": 135472, "object_relation": "size-in-bytes", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a84bed-9cda-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787259880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259880, "uuid": "144f86a9-adeb-43cf-b4c1-fb1da5afc863", "comment": "Malware payload", "value": "c68363f6779ff19773c7ad0825a996fc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#866f51", "exportable": true, "hide_tag": false }, { "name": "emotet", "colour": "#23d4e5", "exportable": true, "hide_tag": false }, { "name": "epoch3", "colour": "#009966", "exportable": true, "hide_tag": false }, { "name": "heodo", "colour": "#75b3dc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259880, "uuid": "aa1234d2-684c-4897-8f4f-b92a473d1522", "comment": "Malware payload", "value": "73d333f013699ab53c558aa860f61d30bb2f6a06c52f046eef7b1a044f40d1b6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#866f51", "exportable": true, "hide_tag": false }, { "name": "emotet", "colour": "#23d4e5", "exportable": true, "hide_tag": false }, { "name": "epoch3", "colour": "#009966", "exportable": true, "hide_tag": false }, { "name": "heodo", "colour": "#75b3dc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787259880, "uuid": "c3abae0e-5dd3-4ca5-9ab1-a9792b6cc5f3", "value": "T13023B319917F12BF3507D4E13BD42B8732D1212FE74AE8187FFCA2504F46DA99A91B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787259880, "uuid": "718c108d-a890-4840-ae5b-3554f927871f", "value": "768:e7oRFlFvFEFEBlmy0xkIII5sF6sk+MD5B:pR3x2KBgRuIII5sgsTMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787259880, "uuid": "efd223d7-467a-4c61-a239-99760ddcc3f2", "value": 48117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787259880, "uuid": "72918573-7811-4948-b937-f9d16a6b3590", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a0f556-9cda-11f1-8686-82aee05be84a", "comment": "Malware payload", "timestamp": 1787259931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259931, "uuid": "83b4be97-d090-42ea-b63d-2289cec6b393", "comment": "Malware payload", "value": "31994ed2f501d3b57f89dd61c6c779e9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#866f51", "exportable": true, "hide_tag": false }, { "name": "emotet", "colour": "#23d4e5", "exportable": true, "hide_tag": false }, { "name": "epoch3", "colour": "#009966", "exportable": true, "hide_tag": false }, { "name": "heodo", "colour": "#75b3dc", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259931, "uuid": "1774ad28-de2e-4575-97cb-a274345de959", "comment": "Malware payload", "value": "0d50ee109a96154d477360f917d5282036c61c11df5ecee10ca7fa97769a9ef1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#866f51", "exportable": true, "hide_tag": false }, { "name": "emotet", "colour": "#23d4e5", "exportable": true, "hide_tag": false }, { "name": "epoch3", "colour": "#009966", "exportable": true, "hide_tag": false }, { "name": "heodo", "colour": "#75b3dc", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1787259931, "uuid": "cf1c335d-797f-48a8-9aad-4ec158668828", "value": "T1AE53D619A17F217F3917D8E17BE16B8231C2312FD75AE8183FFCA2504F1AD699681B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1787259931, "uuid": "49272313-dc9f-4a6e-9d3b-60823024e00e", "value": "768:e7oBFlFvFEFEkQN5gs0kSjoQLVwP9U7qRdwG/oxd664l48XIJRWIigxp:pB3x2KHssPSj52wGsuDXIJzigj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1787259931, "uuid": "e5db36d9-9c4e-40de-871e-ef4065b15779", "value": 61127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Payload delivery", "to_ids": false, "timestamp": 1787259931, "uuid": "cd26de99-5788-40f1-90f8-e843e4987305", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ], "Attribute": [ { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787184381, "uuid": "f995b209-9c2a-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.12.46.19:42170/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787184426, "uuid": "14b07273-9c2b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.230.45.47:55198/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787184735, "uuid": "ccd68044-9c2b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://101.108.7.49:39084/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787185090, "uuid": "a0784950-9c2c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://121.233.205.151:33594/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787185926, "uuid": "92323ec3-9c2e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.230.45.47:55198/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787186539, "uuid": "0020a142-9c30-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.48.163.35:38931/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787186834, "uuid": "af71932a-9c30-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://121.233.205.151:33594/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187128, "uuid": "5ef381a0-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.171.194/data_arm5", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187130, "uuid": "6014fee4-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.171.194/data_x86", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187130, "uuid": "602af553-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.171.194/data_x86_64", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187133, "uuid": "61e9322e-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.171.194/bbc", "Tag": [ { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187139, "uuid": "658702ff-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.171.194/data_arm7", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187153, "uuid": "6d88422f-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.171.194/data_arm4", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187156, "uuid": "6fd1dea3-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.171.194/data_arm6", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187163, "uuid": "73d0ec0c-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.171.194/data_powerpc", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187187, "uuid": "81ca9a8f-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.58.171.194/data_aarch64", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "geofenced", "colour": "#1f0be2", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "USA", "colour": "#c4b637", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187193, "uuid": "85dca2bb-9c31-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.172.77.129:45661/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787187975, "uuid": "57ca7cdc-9c33-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.48.163.35:38931/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787188095, "uuid": "9f7c3881-9c33-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.157.249.227:40515/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787189535, "uuid": "f9d4f1a7-9c36-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.31.103.204:55940/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787190082, "uuid": "3f6058e1-9c38-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.224.151.118:35018/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787190740, "uuid": "c81ce528-9c39-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.57.121.48:46211/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787190802, "uuid": "ecf36e8d-9c39-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.249.199.3:45299/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787190979, "uuid": "56393138-9c3a-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://103.31.103.204:55940/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787191868, "uuid": "687539a7-9c3c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.224.151.118:35018/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192549, "uuid": "fe23af02-9c3d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.57.121.48:46211/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787192766, "uuid": "7f773628-9c3e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://83.219.1.198:33484/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787193328, "uuid": "ce727240-9c3f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.116.11.55:53485/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787193443, "uuid": "12ca85ec-9c40-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.186.126.198:55528/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194697, "uuid": "fe1b2b4b-9c42-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://191.44.114.243:889/gg11", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787194698, "uuid": "feeb9291-9c42-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.141.132.237:60298/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787195127, "uuid": "fe9be858-9c43-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.116.11.55:53485/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787195828, "uuid": "a0458f5d-9c45-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.44.145.210:44835/i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787197327, "uuid": "1e3ebc79-9c49-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.48.10.6:39981/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787200647, "uuid": "d8a855c4-9c50-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://191.44.114.243:889/.bash_history", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202082, "uuid": "3057dd7a-9c54-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.121.250.165:60904/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202198, "uuid": "7592a58c-9c54-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.190.189.204:53404/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202847, "uuid": "f8129cd5-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://57.129.23.24/sike/crypted.ps1", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202847, "uuid": "f812a32c-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://57.129.23.24/8089/crypted.ps1", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202847, "uuid": "f81b0198-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://217.154.188.255/36/ecc/iwantsomethingbetterformegetbackgoodthings.vbe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202847, "uuid": "f84814a8-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://connectmagazineads.com/CarbonCopyCloner7.dmg", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202848, "uuid": "f8f2de82-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://217.154.188.255/60/goodthingsarebestformehappeninggood.vbe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202848, "uuid": "f8f2e6d1-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://217.154.188.255/35/eas/niceworking.vbe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202849, "uuid": "f91cfb30-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://217.60.195.219/ty/p/cgnty_carrier.ahk", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202849, "uuid": "f9a4ead1-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://217.154.188.255/35/goodthingsarecomingfromthebestplacescomingforme.hta", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "f9ba7491-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://azq0yqtjd.s3.ap-southeast-1.amazonaws.com/DeCeRKDepesL.apk", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "f9c3384d-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://217.154.188.255/60/document_picture_0994950005995.jpg/verygoodthingsarecomingentiretimeforbest.hta", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "f9f85778-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://62.60.226.185/kaze.exe", "Tag": [ { "name": "CoinMiner", "colour": "#b47064", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "fa32a0b1-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://204.44.69.216/93/ecce/givenmethebestthignswithbetterplacescomingfromthebest.hta", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "fa397d17-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://62.60.226.185/r843.exe", "Tag": [ { "name": "RemusStealer", "colour": "#ddd7e0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202850, "uuid": "fa3b2401-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://116.2.53.55:45559/bin.sh", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202851, "uuid": "fa476b86-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://107.175.88.87/22/goodpersonforbestthingsfor.hta", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202852, "uuid": "fb521720-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://172.245.95.62/ph/velogs.exe", "Tag": [ { "name": "PhantomStealer", "colour": "#aaa46a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202853, "uuid": "fb8e0513-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://198.23.144.125/wed/crypted.ps1", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "fc19f114-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://57.129.23.24/09890/crypted.ps1", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "fc19f7a9-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://57.129.23.24/29039/crypted.ps1", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "fc65ed18-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://57.129.23.24/63748/crypted.ps1", "Tag": [ { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202854, "uuid": "fc7ab6e1-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://204.44.69.216/93/goodthingswithbestnetworkingskillcomingfromtheheartforme.js", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202855, "uuid": "fcb4641e-9c55-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://172.245.209.194/44/goodcommuncaitionskilldevleipedfromthegood.js", "Tag": [ { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202861, "uuid": "00ca58ab-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.198.239.2:34176/bin.sh", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202909, "uuid": "1d2c4bfb-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://217.60.195.219/ty/v/client_carrier.ahk", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202910, "uuid": "1d7de871-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://217.60.195.219/ty/load.bat", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202913, "uuid": "1fcb19c3-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://217.60.195.219/ty/s.bat", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202914, "uuid": "1fde6958-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://baoxissde.one/S/spxploy.vbs", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202918, "uuid": "22be68ec-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://meeting.supply-reflection.shop/Bin/ScreenConnect.ClientSetup.exe", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202919, "uuid": "22d8167a-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://dl.myresult.co.za:8071/10y8r8/go_b3.bat", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202919, "uuid": "231e6fa1-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://tantralegacy.com/Client/battlebot.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202920, "uuid": "23abaae4-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://itsmystik.com/dl/deadlock/Loader.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202928, "uuid": "28884f7d-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://importantdocumentscopys.s3.us-east-2.amazonaws.com/ScreenConnect.ClientSetup.msi", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202934, "uuid": "2bbfd097-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://pub-1f5a501a59d74a6a97e77126cf1fc526.r2.dev/ohijfalqvzldlhaqw.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202934, "uuid": "2c3b2bcb-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://94.26.90.90/client.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202935, "uuid": "2c93f474-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://pub-a6ae2d4aa393400aa29f7b02ac7ab213.r2.dev/OCUDLOMO.msi", "Tag": [ { "name": "PureRAT", "colour": "#cc0ccc", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202937, "uuid": "2df6959d-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://baoxissde.one/S/sp.zip", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202957, "uuid": "39ec8314-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://xxpro.dev/BAC_PC%E5%A3%B3.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202958, "uuid": "3a5ea6e3-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://pub-f225fc4c925f4cad963c543c3378b1ae.r2.dev/Bembemi.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202981, "uuid": "47ffa741-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://bm2contabilidade.com.br/Nxtlvllnk/ScreenConnect.ClientSetup.exe", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202986, "uuid": "4acced9c-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://91.92.242.236/files-129312398/files/file_fedb1cae70e15500.exe", "Tag": [ { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202986, "uuid": "4ace55ba-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://91.92.242.236/files-129312398/files/file_5531355e31758cd9.exe", "Tag": [ { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202987, "uuid": "4b818a88-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://37.221.93.40/Servicer.apk", "Tag": [ { "name": "apk ", "colour": "#b41558", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202987, "uuid": "4b8c07df-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://91.92.242.236/files-129312398/files/file_4799cc1c552dbe75.exe", "Tag": [ { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202987, "uuid": "4bc7fbb6-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://176.65.139.139/Services.apk", "Tag": [ { "name": "apk ", "colour": "#b41558", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202987, "uuid": "4bdd844f-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://38.97.56.196/Services.apk", "Tag": [ { "name": "apk ", "colour": "#b41558", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787202990, "uuid": "4dabff26-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://91.92.242.236/files-129312398/files/file_0d90bf33aa3e6c18.exe", "Tag": [ { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203027, "uuid": "632d2637-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://94.154.43.196:8080/api/v1/install", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203039, "uuid": "6abe7ad5-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.dbg", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#0fa3df", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203039, "uuid": "6ac48675-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.x86", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#0fa3df", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203039, "uuid": "6ac48778-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.arm5", "Tag": [ { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203039, "uuid": "6adf2a6a-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.x86_64", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#0fa3df", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203039, "uuid": "6ae18c2e-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.mips", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203039, "uuid": "6ae82114-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.arm4", "Tag": [ { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203040, "uuid": "6aeaa56a-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.arm7", "Tag": [ { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203050, "uuid": "7174800b-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://ip-69-33-213-199.dfw.megapath.net/nerv.mips", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203104, "uuid": "917f52ea-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.arm6", "Tag": [ { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203104, "uuid": "917f58c3-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.x86_32", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#0fa3df", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203104, "uuid": "917f92ab-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.mpsl", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203104, "uuid": "91800a68-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.sh4", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "SuperH", "colour": "#25a3d8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203106, "uuid": "92863dbb-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.sparc", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#36e61e", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203106, "uuid": "929b3b02-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.ppc", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "PowerPC", "colour": "#ff7a12", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203161, "uuid": "b3993632-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://69.33.213.199/nerv.m68k", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#8b9939", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203162, "uuid": "b3dad67d-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.156.98.218:49065/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203272, "uuid": "f5749c33-9c56-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.126.90.106:37277/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203625, "uuid": "c7e7a771-9c57-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://dl.myresult.co.za:8071/10y8r8/launch.vbs", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203627, "uuid": "c8df2c5e-9c57-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://dl.myresult.co.za:8071/10y8r8/as.xor", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203627, "uuid": "c94d937d-9c57-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://dl.myresult.co.za:8071/10y8r8/inject.ps1", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203628, "uuid": "c9ec214d-9c57-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://dl.myresult.co.za:8071/10y8r8/wupd.bat", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203692, "uuid": "efb7f772-9c57-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://dl.myresult.co.za:8071/10y8r8/ac.xor", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "ua-curl", "colour": "#4761B1", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203706, "uuid": "f810d9fb-9c57-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.156.98.218:49065/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203754, "uuid": "14d45f25-9c58-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.121.250.165:60904/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787203870, "uuid": "59f1c889-9c58-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.48.12.174:50575/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787204245, "uuid": "3983949a-9c59-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://180.190.189.204:53404/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205081, "uuid": "2bf0d0c6-9c5b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.52.217:41359/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205367, "uuid": "d677f746-9c5b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.48.12.174:50575/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205736, "uuid": "b2092911-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://94.154.43.210/daredevil.mips", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205744, "uuid": "b729d8a3-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://94.154.43.210/daredevil.armv4l", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205744, "uuid": "b729d9a2-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://94.154.43.210/daredevil.x86_64", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205744, "uuid": "b729dd9b-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://94.154.43.210/daredevil.armv7l", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205744, "uuid": "b729de40-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://94.154.43.210/daredevil.armv5l", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205744, "uuid": "b7334711-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://94.154.43.210/daredevil.armv6l", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "cfd45ec6-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/676064", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "cfda9aca-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/c72382", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "cfdee400-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/0b1663", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "cfe9d6f3-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/515c80", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "cff1915d-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/8ac363", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "cff23ee3-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/db7a9c", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "cff2addd-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/0db2ec", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "cffe9452-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/2b08fb", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d0093b0f-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/456417", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d00b55eb-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/279fe0", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d00c5883-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/69d5f2", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d00c6921-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/acb326", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d00c70f1-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/473c1a", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d00c911b-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/065109", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d00ca550-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/49fa35", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d0271069-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/9dfbc4", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d0273808-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/b3679a", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d027533a-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/094392", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d0275676-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/c4844d", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d0283ff6-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/573976", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d02bea53-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/c515ee", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205786, "uuid": "d036cde6-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/344f7e", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205787, "uuid": "d04880b5-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/faedd6", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205787, "uuid": "d048845d-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/78f157", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787205800, "uuid": "d82eb5f7-9c5c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://94.154.43.210/daredevil.mipsel", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cab7529c-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/76e6f5", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cac3076a-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/85692b", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cac571e0-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/b39f8f", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cac57735-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/e00ee7", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cad37a4b-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/6a20da", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "caff2e81-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/de19ef", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cb001005-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/b74d4d", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cb00c99d-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/589a29", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cb00cc8a-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/4d493d", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cb00cd64-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/1498b2", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cb216166-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/804c43", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206207, "uuid": "cb2444b7-9c5d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/55bd33", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206471, "uuid": "681487d0-9c5e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.215.52.217:41359/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206879, "uuid": "5ba7615b-9c5f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://183.63.8.194:46154/Mozi.m", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206879, "uuid": "5bb287fa-9c5f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.57.182.131:41041/Mozi.m", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206880, "uuid": "5c102360-9c5f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://110.186.229.108:47843/Mozi.m", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787206891, "uuid": "62497312-9c5f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://77.239.124.108/atomic/atomic.sh", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787207237, "uuid": "311d6551-9c60-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://183.23.132.41:35951/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208271, "uuid": "9913b5fe-9c62-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.220.201:34645/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208309, "uuid": "af91ea38-9c62-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://python3.en-us--balancing.co/jquery.min.js", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208484, "uuid": "18247bf2-9c63-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://multisavcx.xyz/ncx", "Tag": [ { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208665, "uuid": "840c98c6-9c63-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://elxxvvx.xyz/i", "Tag": [ { "name": "ClickFix", "colour": "#1e5b64", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208727, "uuid": "a9060756-9c63-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://pub-a06eb79f0ebe4a6999bcc71a2227d8e3.r2.dev/apiti.png", "Tag": [ { "name": "VIPKeylogger", "colour": "#7632a5", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208729, "uuid": "aa04e9ec-9c63-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://long-wildflower-b4f5.gustavosoftware.workers.dev/", "Tag": [ { "name": "VIPKeylogger", "colour": "#7632a5", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208854, "uuid": "f46b8084-9c63-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://119.117.76.11:59095/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787208923, "uuid": "1d7ce311-9c64-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://183.23.132.41:35951/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787209026, "uuid": "5b63c423-9c64-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.229.190.135:33907/i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787210467, "uuid": "b62f9ae1-9c67-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://120.84.212.210:44835/i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787210485, "uuid": "c0d67b76-9c67-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://119.117.76.11:59095/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787210711, "uuid": "477c2cfe-9c68-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://120.77.1.20:6021/linux", "Tag": [ { "name": "honeypot", "colour": "#15a23a", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#e2e7c4", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787211488, "uuid": "169bd58a-9c6a-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://85.203.4.64/client.exe", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787211847, "uuid": "ec59eb77-9c6a-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://23.94.145.229/api/v1/ps1/bf57fba60c91af3c5b2a12a00824e554/payload?gk=8548a53bccb76780011e980c89530d41dc9762640a4cc2664b532a045e8dee8b", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212026, "uuid": "574ebd44-9c6b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.55.236.213:53264/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212037, "uuid": "5dea0916-9c6b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.95.17:59123/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212041, "uuid": "60374aed-9c6b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.184.140.145:34890/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212042, "uuid": "60ea2f81-9c6b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.97.253.208:46690/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212086, "uuid": "7b457444-9c6b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://res.cloudinary.com/shsw2tu4/image/upload/v1787199350/img_001530.jpg", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212326, "uuid": "0a5940fb-9c6c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.232.226.68:57370/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212745, "uuid": "0392854d-9c6d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://193.104.58.65/RUMPYU14TH.png", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212746, "uuid": "046e632a-9c6d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://193.104.58.65/rumpyu13th.png", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212748, "uuid": "05a390bc-9c6d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://193.104.58.65/img_gas.png", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787212749, "uuid": "063193d1-9c6d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://193.104.58.65/rumpyu18.png", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213001, "uuid": "9c22e946-9c6d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://23.95.103.215/crypt/crypted.ps1", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213412, "uuid": "9147624f-9c6e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://res.cloudinary.com/shsw2tu4/image/upload/v1787096999/img_194944.jpg", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213767, "uuid": "653728c0-9c6f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://res.cloudinary.com/c8tdweya/image/upload/v1787186570/img_204142.jpg", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213768, "uuid": "6584b683-9c6f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://219.155.61.0:41221/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213768, "uuid": "65a700f1-9c6f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://58.47.104.43:52617/bin.sh", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787213890, "uuid": "ae4c4b76-9c6f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://sivrex.click/obi/Obi-64Bit-remcos_a.bin", "Tag": [ { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214071, "uuid": "1a3bdd3e-9c70-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://res.cloudinary.com/shsw2tu4/image/upload/v1787185571/img_202554.jpg", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214127, "uuid": "3b62802b-9c70-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://res.cloudinary.com/shsw2tu4/image/upload/v1787199607/img_001951.jpg", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214188, "uuid": "5fb6608f-9c70-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://pub-378362a70f714a30b26c109732cabca4.r2.dev/img_171507.png", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214729, "uuid": "a2aff6a6-9c71-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://sixmexicos.com/20/stego_cm94aawwlf.png", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214848, "uuid": "e91ed82c-9c71-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://nieuw.technoberg.nl//wp-content/bin44.exe", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787214911, "uuid": "0ea934ad-9c72-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://sunix-technology.com/images/niceorgimg_082205.png", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787215404, "uuid": "34afae10-9c73-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.9.240.151:46316/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787215627, "uuid": "b984226e-9c73-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://58.47.104.43:52617/i", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787216111, "uuid": "da558179-9c74-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://paularavanelli.com.br/7rfuc/f98f/Finanzam-agreement.html", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787216274, "uuid": "3b36c175-9c75-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://bucketforada.s3.ap-south-1.amazonaws.com/e3d7348c34787506/AdobeAcrobat.iso", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787217203, "uuid": "650df90b-9c77-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.121.153.246:33661/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787217381, "uuid": "cf5f6fd3-9c77-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.9.240.151:46316/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787218027, "uuid": "506d5758-9c79-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.119.6.45:53526/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787218927, "uuid": "68b5b7bb-9c7b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.228.233.155:37974/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787218928, "uuid": "68ea78c7-9c7b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.228.233.155:37974/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787218991, "uuid": "8e83077d-9c7b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://files.catbox.moe/knujwn.png", "Tag": [ { "name": "HypeAgent", "colour": "#DEFB3A", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787219227, "uuid": "1b727f7d-9c7c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.52.159.178:51500/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787219349, "uuid": "640e0fb2-9c7c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://github.com/dustinsergio/MyProgramAmbitious/releases/download/v1.0.0/ScreenConnectSetup.exe", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787219351, "uuid": "653cb9ed-9c7c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://github.com/dustinsergio/connect2/releases/download/v2.0.0/ScreenConnectSetup.exe", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787219482, "uuid": "b32504f3-9c7c-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://79.106.231.174:57989/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787219895, "uuid": "a96aff46-9c7d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.119.6.45:53526/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787220066, "uuid": "0f4bb23d-9c7e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://85.137.246.220:9705/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787220066, "uuid": "0f5415c3-9c7e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://120.84.215.27:44835/bin.sh", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787220069, "uuid": "110993c3-9c7e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://121.40.213.105:9384/linux", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787220136, "uuid": "390396f8-9c7e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://119.117.108.130:33716/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787220385, "uuid": "cd6052b0-9c7e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://211.229.127.206:53013/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787220667, "uuid": "75814a1d-9c7f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.52.159.178:51500/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787221762, "uuid": "02414bbd-9c82-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://36.5.87.54:4370/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787223126, "uuid": "2f7b3c06-9c85-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.138.103.241:51367/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787223727, "uuid": "95bb6f51-9c86-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.117.51.201:37109/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787224927, "uuid": "60bede87-9c89-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.114.49.31:47819/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787225003, "uuid": "8e639d6e-9c89-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.121.247.247:43842/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787225167, "uuid": "eff85d17-9c89-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.117.51.201:37109/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787225543, "uuid": "cff7f8ac-9c8a-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.178.23.194:35659/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787226800, "uuid": "bd2626d0-9c8d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.137.206.166:45619/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787227035, "uuid": "495fc1e5-9c8e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.178.23.194:35659/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787227248, "uuid": "c890102f-9c8e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://60.217.123.198:46902/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787228062, "uuid": "adb5a744-9c90-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://85.108.86.149:50272/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787229083, "uuid": "0e1662c8-9c93-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.14.178.128:40955/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787229443, "uuid": "e4ad8800-9c93-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.14.178.128:40955/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787230266, "uuid": "cefd90a7-9c95-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.84.173:60970/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231243, "uuid": "159da979-9c98-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://125.43.41.147:38217/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231429, "uuid": "8496be45-9c98-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://163.142.93.0:38525/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231526, "uuid": "be69b974-9c98-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.84.173:60970/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231766, "uuid": "4d5dc625-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://178.132.198.200/payload_v10.sh", "Tag": [ { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231767, "uuid": "4d8e1828-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://23.94.148.3/70/weareinthebestplaceforbetterfuturecomingforme.hta", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231767, "uuid": "4dc80256-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://fdrv.beeyuskincare.co.nz/download.php/Complete_Package_Inspection_And_Damage_Verification_Mp4?f=66898a522ebd09a431f48ede0d3df5e8", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231767, "uuid": "4dcd38da-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://62.60.226.185/tu3929.exe", "Tag": [ { "name": "Vidar", "colour": "#77efaa", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231767, "uuid": "4e0d96aa-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://www.2goelectricity.cloud/MSI_PRO.png", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231768, "uuid": "4e511abb-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://raw.githubusercontent.com/fdcsdwrqass/microsoft/main/microsoft.exe", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231768, "uuid": "4e6ccf2d-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://gaiadeqi.com/vlc1.zip", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231769, "uuid": "4ed74baf-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://profitable-pink-0y9btnew-dpk6vqe6eheo.edgeone.dev/", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231769, "uuid": "4ee9e7ed-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://balanced-red-emhnkdfj-dp7g2kvqxx8n.edgeone.dev/", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231769, "uuid": "4eeda9a4-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://91.92.242.236/files-129312398/files/file_e646a62aa048cacd.exe", "Tag": [ { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231770, "uuid": "4fa2deeb-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://art-jewels.de/wp-includes/Text/jzoctxl/u1jifzw/jnmpdkg/UG1crypted.ps1", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231770, "uuid": "4fb1528e-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://vibecoders.vip/softwaretech", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231770, "uuid": "4fc54a75-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://107.174.251.112/img/3.jpg", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787231828, "uuid": "72568501-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://somostask.co/stego_2pu3tp48pp.png", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787232022, "uuid": "e6053c34-9c99-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.220.201:34645/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787232561, "uuid": "271a5e70-9c9b-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://119.183.51.162:34711/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787233459, "uuid": "3e1cd5a2-9c9d-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.220.84.239:55052/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787233819, "uuid": "14d5c1f8-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://paretandassociates.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&c=Eye%20Clinic&c=&c=Surgery&c=Personal&c=&c=&c=&c=", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#db9821", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787233927, "uuid": "55155ee1-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.5.10.102:53641/bin.sh", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234045, "uuid": "9b5c499d-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://swanrecovery.com", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234045, "uuid": "9ba36f88-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://robinhoodwallet.dervano.vu/windows/", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234045, "uuid": "9bb0c9bb-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://docuslutmentadoonline.top/reference/", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234045, "uuid": "9bc2b418-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://shortsouth.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234045, "uuid": "9bdeccad-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://www.zenledgerpolicy.com", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234046, "uuid": "9bf082ad-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://helnivo.vu/FinalCD", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234048, "uuid": "9d22673e-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://docuuumennnntonline.top/reference/", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234049, "uuid": "9e48d457-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://azlvaka.vu/access", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234093, "uuid": "b87ef7e1-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://multiculturalbridge.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest", "Tag": [ { "name": "connectwise", "colour": "#4e114e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234168, "uuid": "e4ce5795-9c9e-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.220.84.239:55052/i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2ac18cbb-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/f287aa", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2ad0d9e2-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/939936", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2ad3e6c1-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/026141", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2ad6d42d-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/b3eb09", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2ade4e9b-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/6a40ae", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2ade66d7-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/9c9685", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2adf7c9e-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/fc2db6", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2ae294eb-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/3eafe3", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2aeb7875-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/c4a84f", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234285, "uuid": "2aebd73f-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/ad61ec", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234286, "uuid": "2b168afa-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/9a3160", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234286, "uuid": "2b1b217d-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/b97872", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234466, "uuid": "969baac1-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://github.com/atilabyte/golang/raw/refs/heads/master/scripts/install.sh", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234468, "uuid": "97ae05cc-9c9f-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.126.248.10:58244/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787234814, "uuid": "6646c7c8-9ca0-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://85.108.86.149:50272/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787235067, "uuid": "fd0d9358-9ca0-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://91.92.242.236/files-129312398/files/file_46acc204d4e52963.exe", "Tag": [ { "name": "c2-monitor-auto", "colour": "#46920d", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787235080, "uuid": "0472b7da-9ca1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://31.77.227.121/bins/parm64", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787235368, "uuid": "b01ee769-9ca1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.5.10.102:53641/i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787235507, "uuid": "02dd36b4-9ca2-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://46.236.65.141:33052/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787235668, "uuid": "62ca8a14-9ca2-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.126.248.10:58244/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787235668, "uuid": "633a0e61-9ca2-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.113.44.60:34879/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787235917, "uuid": "f7703ffa-9ca2-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.56.147.247:47891/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787236400, "uuid": "179c17c8-9ca4-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://45.150.195.235/newpath.sh", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787236767, "uuid": "f21bc0bb-9ca4-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.168.114.203:46828/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787236885, "uuid": "38aacba8-9ca5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.168.114.203:46828/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787236926, "uuid": "50f6ba68-9ca5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://flooriscoveringworld.com/bin.exe", "Tag": [ { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787236945, "uuid": "5c684d39-9ca5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.62.135.216:60668/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237048, "uuid": "99c68f77-9ca5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://wylkpznq.xyz/hukl/cp/bin.exe", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237050, "uuid": "9ae32f48-9ca5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://somostask.co/Candy.png", "Tag": [ { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237109, "uuid": "be354592-9ca5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://pub-153d2a9e026942c4aff3b3aca8f80952.r2.dev/vceolaqcvj.png", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237110, "uuid": "be3811d1-9ca5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://pub-8f07b712b50246eca5982f64bd695eea.r2.dev/bxaigui.png", "Tag": [ { "name": "AgentTesla", "colour": "#71a933", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26c593e3-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/a9eeb4", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26d13d43-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/63d2dd", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26d89fdc-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/1e596c", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26e230ff-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/59e4b9", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26e94e2f-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/229db9", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26e9afbc-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/6711b4", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26f25cb7-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/f61d73", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26f2989d-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/833d99", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26f386c4-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/908e60", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "26ffaa06-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/e6a806", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "270ff441-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/e27047", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787237285, "uuid": "271187ab-9ca6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://5.182.210.174/646d52", "Tag": [ { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238205, "uuid": "4b26492a-9ca8-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.58.177.63:33235/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238247, "uuid": "6410d020-9ca8-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://pub-a06eb79f0ebe4a6999bcc71a2227d8e3.r2.dev/app330.png", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238310, "uuid": "8998dc40-9ca8-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://pub-45a83f302a1943ed8d62418c2af947ef.r2.dev/bin001.png", "Tag": [ { "name": "xworm", "colour": "#3b494e", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238366, "uuid": "ab0016bf-9ca8-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://178.16.53.176/PW/EZcrypted.ps1", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#7632a5", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238426, "uuid": "cebdec33-9ca8-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://178.16.53.176/PW/pr2crypted.ps1", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#7632a5", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238608, "uuid": "3b1d73b2-9ca9-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://178.16.53.176/PW/prcrypted.ps1", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "Formbook", "colour": "#7893ac", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787238668, "uuid": "5f254305-9ca9-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://www.2goelectricity.cloud/img_122332.png", "Tag": [ { "name": "rat", "colour": "#0c02ad", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#779e3a", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787239328, "uuid": "e8ad9037-9caa-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.112.89.53:48165/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787241384, "uuid": "b234da25-9caf-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.130.209.58:35031/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787241919, "uuid": "f0ddf482-9cb0-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.137.105.216:51325/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242027, "uuid": "31527296-9cb1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.112.89.53:48165/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242028, "uuid": "319a1c56-9cb1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://178.16.53.176/DVB/eecrypted.ps1", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242028, "uuid": "31a03c37-9cb1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://178.16.53.176/DVB/ugcrypted.ps1", "Tag": [ { "name": "ascii", "colour": "#88b2db", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#36750f", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#7b6e87", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242032, "uuid": "3410691c-9cb1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://kits.frog.tw/Images/stego_jxdqj7fw9j.png", "Tag": [ { "name": "HypeAgent", "colour": "#DEFB3A", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787242567, "uuid": "7322abb3-9cb2-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "https://gaiadeqi.com/clc.zip", "Tag": [ { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787243482, "uuid": "94bccc39-9cb4-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://222.137.105.216:51325/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787244698, "uuid": "6921bf26-9cb7-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://116.2.50.30:54263/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787245525, "uuid": "565ebb3d-9cb9-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.50.254.53:38226/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787246062, "uuid": "96071013-9cba-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.225.241.153:52809/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787246428, "uuid": "708d42b5-9cbb-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://116.2.50.30:54263/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787247142, "uuid": "1a2f09c3-9cbd-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.50.254.53:38226/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787247325, "uuid": "87381474-9cbd-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.7.217.91:35797/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787247328, "uuid": "88fc5571-9cbd-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://162.255.251.91:57427/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787247672, "uuid": "55fbc437-9cbe-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.62.135.216:60668/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787247979, "uuid": "0ce7e502-9cbf-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://163.142.93.81:51284/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787248286, "uuid": "c3ff1480-9cbf-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://14.107.121.45:50511/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787248466, "uuid": "2ef9b804-9cc0-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.225.241.153:52809/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787249129, "uuid": "ba6e0352-9cc1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://162.255.251.91:57427/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787249963, "uuid": "ab3e2d5b-9cc3-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://14.107.121.45:50511/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787250087, "uuid": "f59bf960-9cc3-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://113.236.118.216:50033/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787251762, "uuid": "dbd6d7a1-9cc7-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.56.136.70:46446/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787252827, "uuid": "56baa85a-9cca-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.51.4.93:56227/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787252828, "uuid": "5771b875-9cca-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://41.201.226.25:57585/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787252829, "uuid": "57b23686-9cca-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://27.207.216.59:45025/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787253366, "uuid": "97f1a0dd-9ccb-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://59.96.139.113:60057/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787253402, "uuid": "ad594e57-9ccb-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.248.174.58:54368/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787253981, "uuid": "0695c6cd-9ccd-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.230.209.22:37617/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787255229, "uuid": "ee801b92-9ccf-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.230.209.22:37617/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787255467, "uuid": "7c335947-9cd0-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.57.212.220:54561/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787255611, "uuid": "d2195019-9cd0-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://140.237.7.157:41787/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787257628, "uuid": "83fbca3b-9cd5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.57.212.220:54561/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787257927, "uuid": "36959417-9cd6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.120.13.196:55125/bin.sh", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787258852, "uuid": "5de74aa1-9cd8-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://46.236.65.235:41753/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259067, "uuid": "dda09af7-9cd8-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.9.195.116:34313/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259251, "uuid": "4bd60ec7-9cd9-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://91.92.242.236/files-129312398/files/file_ea0fdcdde83b1f61.exe", "Tag": [ { "name": "54e64e", "colour": "#eb829a", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#1ac4f9", "exportable": true, "hide_tag": false }, { "name": "rustystealer", "colour": "#1A044D", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259440, "uuid": "bc6d726f-9cd9-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.54.253.22:60163/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259631, "uuid": "2e37e234-9cda-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.121.43.33:42422/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259728, "uuid": "67fa46ed-9cda-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.12.177.12:56227/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787259984, "uuid": "00804acc-9cdb-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.190.17.0:42140/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787260344, "uuid": "d74b544b-9cdb-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.9.195.116:34313/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787260884, "uuid": "18d4868c-9cdd-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.121.43.33:42422/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787261006, "uuid": "615721a8-9cdd-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.54.253.22:60163/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787262257, "uuid": "4b2a9ea4-9ce0-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.123.162.14:46510/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787262800, "uuid": "8eaa59c6-9ce1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.55.52.24:36106/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787262800, "uuid": "8ebdcba9-9ce1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.61.118.232:57819/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787263100, "uuid": "41b0a822-9ce2-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.9.223.160:52129/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787263516, "uuid": "39bacd62-9ce3-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://182.123.162.14:46510/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787263927, "uuid": "2ea5fb11-9ce4-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.120.157:38424/bin.sh", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787264483, "uuid": "7a5deb62-9ce5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://115.55.52.24:36106/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787264591, "uuid": "babf0130-9ce5-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://119.114.63.205:38557/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787264733, "uuid": "0f61c192-9ce6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://223.151.74.149:48587/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787264766, "uuid": "22ec2588-9ce6-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.231.203.243:47565/bin.sh", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787265727, "uuid": "5f770e47-9ce8-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://61.53.120.157:38424/i", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787266111, "uuid": "446c0625-9ce9-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://112.248.174.58:54368/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787266162, "uuid": "62ec056e-9ce9-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://123.9.223.160:52129/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787266224, "uuid": "879761ba-9ce9-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://119.114.63.205:38557/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787266326, "uuid": "c4b24443-9ce9-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.231.203.243:47565/i", "Tag": [] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787267956, "uuid": "901b4327-9ced-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://125.46.213.70:33401/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787268454, "uuid": "b907a66a-9cee-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.174.102.151:51009/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787268862, "uuid": "ac15320a-9cef-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://175.165.197.57:46174/i", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "url", "category": "Payload delivery", "to_ids": true, "timestamp": 1787269824, "uuid": "e99bf9f4-9cf1-11f1-8686-82aee05be84a", "comment": "Malware distribution site", "value": "http://42.224.103.64:50547/bin.sh", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231764, "uuid": "4c5361a9-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "107.174.251.112", "Tag": [] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206866, "uuid": "53a71b36-9c5f-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "110.186.229.108", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787253364, "uuid": "96bbf9bf-9ccb-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "112.248.174.58", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787209024, "uuid": "5a26ae99-9c64-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "113.229.190.135", "Tag": [] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787197325, "uuid": "1cceaa01-9c49-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "115.48.10.6", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203865, "uuid": "56c7ed8a-9c58-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "115.48.12.174", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787245506, "uuid": "4ada05e6-9cb9-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "115.50.254.53", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787252825, "uuid": "55390308-9cca-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "115.51.4.93", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787190725, "uuid": "beaf496c-9c39-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "115.57.121.48", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787206866, "uuid": "53a6f08e-9c5f-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "115.57.182.131", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "iot", "colour": "#a93a04", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787238185, "uuid": "3f002674-9ca8-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "115.58.177.63", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787236924, "uuid": "4fa30735-9ca5-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "115.62.135.216", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787244665, "uuid": "55ee7e52-9cb7-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "116.2.50.30", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787264585, "uuid": "b6b6f937-9ce5-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "119.114.63.205", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787220125, "uuid": "32f5bc6e-9c7e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "119.117.108.130", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208845, "uuid": "ef11e066-9c63-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "119.117.76.11", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787210707, "uuid": "45104229-9c68-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "120.77.1.20", "Tag": [ { "name": "honeypot", "colour": "#15a23a", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#e2e7c4", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787210465, "uuid": "b49d497d-9c67-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "120.84.212.210", "Tag": [] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787185084, "uuid": "9ccba408-9c2c-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "121.233.205.151", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787220065, "uuid": "0efa3be0-9c7e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "121.40.213.105", "Tag": [] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787259725, "uuid": "662b6846-9cda-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "123.12.177.12", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787229065, "uuid": "037b71c6-9c93-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "123.14.178.128", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787259064, "uuid": "dc4feeb3-9cd8-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "123.9.195.116", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231225, "uuid": "0abbdbcd-9c98-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "125.43.41.147", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787248267, "uuid": "b85b875a-9cbf-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "14.107.121.45", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787255585, "uuid": "c275a8cb-9cd0-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "140.237.7.157", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231405, "uuid": "75f0560e-9c98-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "163.142.93.0", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247965, "uuid": "04de2905-9cbf-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "163.142.93.81", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202846, "uuid": "f772bd47-9c55-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "172.245.209.194", "Tag": [ { "name": "PureLogsStealer", "colour": "#110c7f", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787268845, "uuid": "a1ef8c89-9cef-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "175.165.197.57", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787236744, "uuid": "e4a1bc16-9ca4-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "175.168.114.203", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787268424, "uuid": "a7538685-9cee-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "175.174.102.151", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202985, "uuid": "4a747f2d-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "176.65.139.139", "Tag": [ { "name": "apk ", "colour": "#b41558", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231764, "uuid": "4c547ae5-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "178.132.198.200", "Tag": [ { "name": "botnet", "colour": "#0f456a", "exportable": true, "hide_tag": false }, { "name": "download", "colour": "#e2dcd3", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#3a22f0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787239325, "uuid": "e6ad962a-9caa-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.112.89.53", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787235666, "uuid": "61c0be06-9ca2-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.113.44.60", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787224924, "uuid": "5f1fbd70-9c89-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.114.49.31", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193307, "uuid": "c1c2ce03-9c3f-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.116.11.55", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787223725, "uuid": "94411f9c-9c86-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.117.51.201", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787257925, "uuid": "350cd100-9cd6-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.120.13.196", "Tag": [] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787217184, "uuid": "59c9f15a-9c77-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.121.153.246", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787224987, "uuid": "84916417-9c89-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.121.247.247", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202064, "uuid": "2587a771-9c54-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.121.250.165", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787262246, "uuid": "44890af8-9ce0-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.123.162.14", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234465, "uuid": "95cec0bf-9c9f-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.126.248.10", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787241365, "uuid": "a6d3cde9-9caf-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "182.130.209.58", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787207225, "uuid": "29ae60ec-9c60-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "183.23.132.41", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787194685, "uuid": "f71da7f4-9c42-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "191.44.114.243", "Tag": [ { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#fcf208", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213765, "uuid": "63e71265-9c6f-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "219.155.61.0", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203146, "uuid": "aa48f34d-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "219.156.98.218", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787241906, "uuid": "e8f50ff0-9cb0-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "222.137.105.216", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787211844, "uuid": "eaa5c7c9-9c6a-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "23.94.145.229", "Tag": [] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787252825, "uuid": "553907ec-9cca-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "27.207.216.59", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787205065, "uuid": "22516e8c-9c5b-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "27.215.52.217", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787233445, "uuid": "35be2f3c-9c9d-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "27.220.84.239", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787221746, "uuid": "f8a026ba-9c81-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "36.5.87.54", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202985, "uuid": "4a73c58b-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "37.221.93.40", "Tag": [ { "name": "apk ", "colour": "#b41558", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202985, "uuid": "4a74b609-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "38.97.56.196", "Tag": [ { "name": "apk ", "colour": "#b41558", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787225525, "uuid": "c522b7ac-9c8a-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "42.178.23.194", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787269806, "uuid": "de97ec07-9cf1-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "42.224.103.64", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787246044, "uuid": "8bbf4736-9cba-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "42.225.241.153", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787218925, "uuid": "671f8fea-9c7b-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "42.228.233.155", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787253964, "uuid": "fc8f09f0-9ccc-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "42.230.209.22", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787184424, "uuid": "1339c330-9c2b-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "42.230.45.47", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787264764, "uuid": "21b01184-9ce6-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "42.231.203.243", "Tag": [] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787251744, "uuid": "d11fd233-9cc7-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "42.56.136.70", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787247305, "uuid": "7b7db4e8-9cbd-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "42.7.217.91", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213765, "uuid": "63e71bc9-9c6f-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "58.47.104.43", "Tag": [ { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212024, "uuid": "56593dd9-9c6b-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "59.97.253.208", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212024, "uuid": "56594497-9c6b-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "60.184.140.145", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787193425, "uuid": "0816f85a-9c40-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "60.186.126.198", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787226784, "uuid": "b4054465-9c8d-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "61.137.206.166", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787219225, "uuid": "19f9c408-9c7c-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "61.52.159.178", "Tag": [ { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787212024, "uuid": "565918f8-9c6b-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "61.53.95.17", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787259424, "uuid": "b2edacdd-9cd9-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "61.54.253.22", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203025, "uuid": "62235716-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "69.33.213.199", "Tag": [ { "name": "arm", "colour": "#cbbf5a", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#6015f8", "exportable": true, "hide_tag": false }, { "name": "m68k", "colour": "#8b9939", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#cc650d", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#311efc", "exportable": true, "hide_tag": false }, { "name": "PowerPC", "colour": "#ff7a12", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#36e61e", "exportable": true, "hide_tag": false }, { "name": "SuperH", "colour": "#25a3d8", "exportable": true, "hide_tag": false }, { "name": "ua-wget", "colour": "#20da6a", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#0fa3df", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787228045, "uuid": "a331ac59-9c90-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "85.108.86.149", "Tag": [ { "name": "32-bit", "colour": "#ea1acb", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#0b6b80", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#251061", "exportable": true, "hide_tag": false }, { "name": "Mozi", "colour": "#dabae0", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787220065, "uuid": "0efa3f6a-9c7e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "85.137.246.220", "Tag": [] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787211486, "uuid": "153da345-9c6a-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "85.203.4.64", "Tag": [ { "name": "AsyncRAT", "colour": "#6a2351", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#ccae1b", "exportable": true, "hide_tag": false } ] }, { "type": "ip-dst", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202985, "uuid": "4a7394a3-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "94.154.43.196", "Tag": [] }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231765, "uuid": "4c6d27a8-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "art-jewels.de" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234044, "uuid": "9b4d60df-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "azlvaka.vu" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202846, "uuid": "f78b10cd-9c55-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "azq0yqtjd.s3.ap-southeast-1.amazonaws.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231765, "uuid": "4ccd06a3-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "balanced-red-emhnkdfj-dp7g2kvqxx8n.edgeone.dev" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202907, "uuid": "1c2e7efe-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "baoxissde.one" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202908, "uuid": "1ca4326f-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "bm2contabilidade.com.br" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787216105, "uuid": "d6c7858f-9c74-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "bucketforada.s3.ap-south-1.amazonaws.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202846, "uuid": "f77f91ce-9c55-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "connectmagazineads.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202911, "uuid": "1e74ce50-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "dl.myresult.co.za" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234045, "uuid": "9b5a9a03-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "docuslutmentadoonline.top" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234045, "uuid": "9b59ddc8-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "docuuumennnntonline.top" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208665, "uuid": "83f9f4ba-9c63-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "elxxvvx.xyz" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231765, "uuid": "4ca1a80f-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "fdrv.beeyuskincare.co.nz" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234044, "uuid": "9b4b2eee-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "helnivo.vu" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202908, "uuid": "1c4ddcfc-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "importantdocumentscopys.s3.us-east-2.amazonaws.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787203025, "uuid": "62860bef-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "ip-69-33-213-199.dfw.megapath.net" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202910, "uuid": "1d914896-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "itsmystik.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202907, "uuid": "1c3430fa-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "meeting.supply-reflection.shop" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234045, "uuid": "9b64361e-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "multiculturalbridge.screenconnect.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208484, "uuid": "1812af67-9c63-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "multisavcx.xyz" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214845, "uuid": "e7d25cc1-9c71-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "nieuw.technoberg.nl" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787233806, "uuid": "0d76500b-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "paretandassociates.screenconnect.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787216109, "uuid": "d8bbdb4a-9c74-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "paularavanelli.com.br" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231765, "uuid": "4cc6f147-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "profitable-pink-0y9btnew-dpk6vqe6eheo.edgeone.dev" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237107, "uuid": "bc7872ce-9ca5-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "pub-153d2a9e026942c4aff3b3aca8f80952.r2.dev" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202910, "uuid": "1d759828-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "pub-1f5a501a59d74a6a97e77126cf1fc526.r2.dev" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787214185, "uuid": "5e134c13-9c70-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "pub-378362a70f714a30b26c109732cabca4.r2.dev" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237107, "uuid": "bc708af9-9ca5-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "pub-8f07b712b50246eca5982f64bd695eea.r2.dev" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202910, "uuid": "1d7f20cc-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "pub-a6ae2d4aa393400aa29f7b02ac7ab213.r2.dev" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202908, "uuid": "1c3e7b4a-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "pub-f225fc4c925f4cad963c543c3378b1ae.r2.dev" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787208245, "uuid": "89dd0c33-9c62-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "python3.en-us--balancing.co" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234044, "uuid": "9b4dc58b-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "robinhoodwallet.dervano.vu" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234044, "uuid": "9b4e7412-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "shortsouth.screenconnect.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787213886, "uuid": "ac116cfe-9c6f-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "sivrex.click" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231825, "uuid": "7025bf71-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "somostask.co" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234044, "uuid": "9b4153ba-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "swanrecovery.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202908, "uuid": "1c505d41-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "tantralegacy.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231765, "uuid": "4c6d03c3-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "vibecoders.vip" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787231765, "uuid": "4c7f02e7-9c99-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "www.2goelectricity.cloud" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787234044, "uuid": "9b5019ca-9c9e-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "www.zenledgerpolicy.com" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787237046, "uuid": "98451d1a-9ca5-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "wylkpznq.xyz" }, { "type": "domain", "category": "Payload delivery", "to_ids": false, "timestamp": 1787202910, "uuid": "1d86676e-9c56-11f1-8686-82aee05be84a", "comment": "Malware payload delivery host", "value": "xxpro.dev" } ] } }