{ "Event": { "published": true, "date": "2026-05-10", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-10", "timestamp": 1778457782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "012d35a0-bc66-47b6-9258-0cd158dca4a7", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053709a3-4c9c-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778436841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436841, "uuid": "6271ee52-093d-4707-bd40-b32985cc1a5f", "comment": "Malware payload (QuasarRAT)", "value": "cbf264674171a3810c737e31e851abe0", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436841, "uuid": "a506cb63-ec61-4538-be14-7a0f594f3a59", "comment": "Malware payload (QuasarRAT)", "value": "00e6af4b4e3df4c09673e4492483f3cec7bb27b4565bdd112973fb4952ad897c", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436841, "uuid": "93501c87-beab-4c70-9710-c065e1f00d42", "comment": "Malware payload (QuasarRAT)", "value": "abfd48110be614dba6217c534f2babe1c74ce454", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436841, "uuid": "5d444b50-9f70-4401-8a9a-a7e862ba3c93", "comment": "Malware payload (QuasarRAT)", "value": "cf2222a452517d95c58986a01a2efa337e23554f2754260142e60faa2d9aa6f23ab2670d12f938c80e535abe9ed22c0f", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436841, "uuid": "40b33f84-4083-4946-8c0d-7d411adc8b23", "value": "T1F0E56C1C77F85F27D1AEE27296B1011267F0F82AF363E71B5194767B1C93B6088026A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436841, "uuid": "349bdf54-c195-40a2-b2d4-2dc13357cac3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436841, "uuid": "a30ecbed-ed9c-498d-9be1-c4672e4cb6b9", "value": "49152:Jf9iA+5hkIpjIdw0Squi411x92lsHetbxfCxCHHBX2ehJNTN:Jf9iA+jkIBsw0bui41j92ls+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436841, "uuid": "cdaa21fb-3c6d-4a27-873b-2056baa8304c", "value": 3241472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436841, "uuid": "99a49777-64b8-494f-aeb8-30e12bf94e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436841, "uuid": "7833b38e-9282-4c6d-98ab-6256226654f4", "value": "7z2600-x32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ba15ec-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389538, "uuid": "322856fe-257e-4b20-96f0-225b43455952", "comment": "Malware payload", "value": "5e9923674cffd5eb077f9272b365e968", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389538, "uuid": "ee6297ca-1b42-4d12-bf57-7c795020acbe", "comment": "Malware payload", "value": "032cfce8291796b8b28ace09c6812a18f4f54bd85241b353f03883392c0041ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389538, "uuid": "43684ebe-653c-4725-8906-38a370f8298e", "comment": "Malware payload", "value": "85b84aa844af155da545db9480bb830ab5e927e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389538, "uuid": "3302da04-ac36-46fe-98fd-71e2a166954e", "comment": "Malware payload", "value": "75e46c9ad4495b28c481e420a923d25ab9ac98c9e6247905381b921bb2497d448b865da9d15d19ec13aa1d0128e89aa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389538, "uuid": "3010c262-827e-4a66-b971-2f3bf0c4c577", "value": "T1FC065AA8BD2EA412EDDDBDB43F2502D47139FD889F41C32B6514BB9DA9F23548F21620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389538, "uuid": "39965efd-037c-4292-a786-8001b99fd506", "value": "49152:97necTL9QEGGb4vi5aUiVF5EaClfIc1sPz1:lecTL9QEoKEUilEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389538, "uuid": "e88cfea2-e873-4d9d-bb28-0dec3ecd5209", "value": 3932160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389538, "uuid": "7760d155-0cf8-49c1-bcd0-d48c53638b7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389538, "uuid": "1fc31f4c-2523-4a28-985b-5315d638aa97", "value": "linux_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b0d6c8-4c09-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778373979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778373979, "uuid": "437f930c-d986-4745-84be-a7b59e50414d", "comment": "Malware payload", "value": "17713898fc8ededd519e537308e66cc2", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778373979, "uuid": "a25dc0a7-1d33-4c1e-a98e-98fe0c2cb3a2", "comment": "Malware payload", "value": "034f998ce9e33b821409be34a74889d0e30e18bbcd44886fd44bfc7d550e7d9f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778373979, "uuid": "1e5715fc-2c3e-40bb-aae4-25bb290ed6d6", "comment": "Malware payload", "value": "5cb093d9640d3bd8224f24a7ce897a1e43751c24", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778373979, "uuid": "635bd33f-ae69-46d2-a585-1881bf21ae1c", "comment": "Malware payload", "value": "878bf31613fb0561ca719fa4291be45bafa55c66e160a5140c13da9a17ef11d8e518390e4c4f6d870ea3545af32261c7", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778373979, "uuid": "dfa79313-f2ca-4586-81f0-23d2b9808d57", "value": "T14DF533F7AE28A8BBC9C01979631166214256F7F848A4436792369C7F3FD7621743823F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778373979, "uuid": "9dd8753c-d2d3-4ba5-a7a9-eaf2b4b17861", "value": "776836f2bf0711c81269fea849a9e0a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778373979, "uuid": "64a87765-b254-456f-b89c-7a12d4e43c15", "value": "98304:5cUs9YFS8ACakAX06El0+NLA1RXzbD61r2POr:WUs9WPokAXglrLA3mr2mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778373979, "uuid": "62bdaaf9-1b3d-4cc4-b46f-40e1e611b850", "value": 3470640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778373979, "uuid": "e1bfddaf-84ec-4ef8-a5db-e5e90e9a6f14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778373979, "uuid": "1c4761bd-6fe5-4edf-85b4-8d7855463a29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dcfea0-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413914, "uuid": "c6ad25fc-4a4f-453c-9db7-330cc71e3b26", "comment": "Malware payload", "value": "0e0f54de739017387380e51d6a31b870", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413914, "uuid": "6377c62c-e89e-48c3-98eb-f4e4ba1a3166", "comment": "Malware payload", "value": "04321f43acfe829ea2cd7e3e5ddb9643cf9355fb1d3c4300c3e145b8ade149e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413914, "uuid": "99c2eb73-7417-45db-856d-5a1c97b8e527", "comment": "Malware payload", "value": "d2264eaa229c295bd161eb4100ccf9a92b849924", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413914, "uuid": "170f72a9-91fe-4079-8ed7-39db3448b2bf", "comment": "Malware payload", "value": "06f4c8b0d98fbac41d8ecfa56c78ec168c107a5e9bc9107e3476a1e485eb5474668aa481cb578dca5ca80808f8aae6bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413914, "uuid": "23d9550a-2b9a-47e0-a9b5-83d52965703f", "value": "T1DB567B55BC1D7462DAC976752F7652843239BC484F82C7232A18BB7CAAF235CCF63261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413914, "uuid": "e40ce74b-d93c-46a9-8678-8a72d40554fd", "value": "49152:bWb8A+2yKR27k60qe77eiQLztKF1IbejWPcMj35EE:bO8A+2lcn0qO7eiOztWX3MNEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413914, "uuid": "572e9686-9401-4e4f-827a-0f9479700144", "value": 5898388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413914, "uuid": "641b06a8-70d2-4291-8ad0-7a7d3690061d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413914, "uuid": "08ea32c1-47b7-4798-8149-82aabef60182", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a829ab-4c8c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778430231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430231, "uuid": "aea83432-d5a6-4602-82b7-9bc0c24a9ceb", "comment": "Malware payload (Mirai)", "value": "f51805c65ba2974edea2584ef1ea062f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430231, "uuid": "982d2391-fc4a-4251-8028-13aeac31c015", "comment": "Malware payload (Mirai)", "value": "05376681181f11433cb64b2e6257b44c87e3c7fdf608bfb746484d011e4f60b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430231, "uuid": "af481297-2828-4858-aaa1-997138381057", "comment": "Malware payload (Mirai)", "value": "4d12faa860f1eefa46b6ca8b8202375fc05355bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430231, "uuid": "1e4daf79-8237-400a-90b7-f6cf17c5efd0", "comment": "Malware payload (Mirai)", "value": "9a23e55b6bf01630b96a96e8137f1df467aa6e1db74766f6cd13804304d1cb80f6fbb00915890a9a15d7c23cdcc2e499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430231, "uuid": "cdda7960-c5d1-4015-a420-b26527f914d7", "value": "T140660A09AD842BE6C86D4F3444EECA9512B45D144AF24A3616B4FFADBC772387F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430231, "uuid": "8cf329d2-5bdf-48f0-98d0-4f147b80ecb7", "value": "49152:CnC+rBZkUsZRSFq903OVzgXq8Jz0JvC5EO:+saAOu4EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778430231, "uuid": "330659c7-3cfa-43b4-8f3d-3c942e10c5e7", "value": 6684865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778430231, "uuid": "41577fbc-f71c-4b53-9ec0-3122213460bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430231, "uuid": "d9235dcb-e19c-4b94-ac02-3d7ec019cf64", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77076065-4c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778438320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438320, "uuid": "39f3a483-f71b-43cd-bd45-3ce0012c79aa", "comment": "Malware payload (RemusStealer)", "value": "f0930a66f80572caa6be13e9776f4181", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438320, "uuid": "ad4d92a5-702e-46d2-9027-4e2d546664ba", "comment": "Malware payload (RemusStealer)", "value": "05c605c364c2465d765d7e4bd0d80459b2d230491399ffbb2a9085891531498f", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438320, "uuid": "98d16f80-f8b2-4e4e-a62b-3417103da49a", "comment": "Malware payload (RemusStealer)", "value": "654eb7714db211cbad8a5b9af0a8f8a57ef1b8a1", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438320, "uuid": "b83a0195-a059-4de5-a6b1-74ca417c56a5", "comment": "Malware payload (RemusStealer)", "value": "cf7af2d7a5f32a9a3c7311bb1d727e4883fa69ce86c40ab0deddbec9967307d01bfd472ae8962e0fd3cb45c42f62e723", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438320, "uuid": "d051c6c0-cce7-4afd-a25c-21209b7ffb24", "value": "T19E764C1378A54469D4A8E331C467A6A3AA69BC45E33877D72FD1AEF02F313C01A39717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438320, "uuid": "2809d75d-23a2-4b53-832a-e9942bf2edf1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438320, "uuid": "37c4bcaf-dda1-413b-8148-2893438dbfe9", "value": "49152:CqUNQlGl1xtDtCnZPI7rSn5mYZHai7vjG4+ASeZnEaTPd9XoYsfMQiishdE4xq1e:CLZH+FDJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438320, "uuid": "28c180ca-e509-4594-9aa0-c05503032e7c", "value": 7672320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438320, "uuid": "17ea643c-064a-433b-985f-7c62885cf84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438320, "uuid": "cbce697e-3f01-48c8-838f-0174a2486fca", "value": "file_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88033042-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371347, "uuid": "48d143a7-884f-4550-b92a-cb1fde3fe0e9", "comment": "Malware payload", "value": "18c565dd69cb1057159403f13beb75f0", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371347, "uuid": "d29a532b-519b-4bcc-bd28-18085972e44d", "comment": "Malware payload", "value": "05c835a5c6e59b26228180ffe8424e21538125a9b4bc734052334906ede9cb63", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371347, "uuid": "af178065-f63f-450a-9265-8b054fbef137", "comment": "Malware payload", "value": "ab66f28925a01148e29db858c4bd6fd58276e08e", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371347, "uuid": "8097726c-97bc-4e57-839a-81617aa77e71", "comment": "Malware payload", "value": "e57258fa69bb93d9dec5c0ae18224c890f877f4063230d31bc39075a1aeaa9325427b6237bacfd11f5d1770ced63b2b3", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371347, "uuid": "13bb3fcc-c182-4f97-9b6d-a0c3400ea121", "value": "T14505492473FAA60FE1BF4775E5B24C6A23B260936651C30B4D46715E1F63781EE02BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371347, "uuid": "3d163cc8-3c4b-49fd-af43-dea603c8df08", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371347, "uuid": "8aa94105-e33b-45b6-b4e3-332294c3441b", "value": "12288:MRdjDfTFqiL0OSfsUVC2H/ESCZaFqiL0LCh:2XYWD9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371347, "uuid": "894c0b49-45e4-42bd-b2c7-7c72ef5ea024", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371347, "uuid": "75f601e3-7617-4a63-b623-91d7ce333b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371347, "uuid": "7a36703c-f1ea-4441-8e5d-4aacea97913b", "value": "05c835a5c6e59b26228180ffe8424e21538125a9b4bc734052334906ede9cb63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb0922c-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778414331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414331, "uuid": "6c9ceb42-32c7-4486-a194-8aac5345ed74", "comment": "Malware payload (Mirai)", "value": "8bb470898b417238e31e6252e5294171", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414331, "uuid": "fdeaf751-fe9c-4df7-9f1f-980123724f15", "comment": "Malware payload (Mirai)", "value": "05d46d7dd103a8d116adf6e303ee7605cab01a8e644b8b99dd44c799b135f20e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414331, "uuid": "fba38254-21ce-49db-a53d-6c25a97d84dc", "comment": "Malware payload (Mirai)", "value": "3ee4aceff7a2a622d5cb89b7b32124763901aa41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414331, "uuid": "ee83a724-4c53-45b2-b04e-3b2db3ac58aa", "comment": "Malware payload (Mirai)", "value": "35e40d666e63010e5feae07d291c9387773bacbe9f02fad3648f948cf5040c674dc74321a8812f48cdf99b79db1485b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414331, "uuid": "35c314c1-72be-4369-8d68-bab4039a2d64", "value": "T177F3ADEFBA8B1590C00701F00B8F9BAEAB972124CEAFD1E36D5DB63B55295D7D025390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414331, "uuid": "8c7e4843-bde1-441e-8c0c-34649c8e929a", "value": "3072:ZlQl49NKy6cSwM9CUtHVfGAAy8rnj2LbmHWhhttgJwq:bQl49NKy6cSHPk22aD4wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414331, "uuid": "6c1dca87-d320-4f64-a986-b6f27425764d", "value": 157560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414331, "uuid": "cb953662-b7b9-46dd-b3bf-6d287981171f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414331, "uuid": "5f64e1a1-7d55-4c47-8b93-2ac81623c0ea", "value": "titanjr.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4bb94f-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413685, "uuid": "4a07b385-2f2b-4fa3-a43d-d7636c1d7e43", "comment": "Malware payload", "value": "b6917465b0b52e2df55ea1f2456cad37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413685, "uuid": "3e153dc0-3fb5-4ac9-8896-8319124ce464", "comment": "Malware payload", "value": "06498721817df77eaa9e6dcbf70c85e1df297a467c3962791402aed3ed3399df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413685, "uuid": "7eb581f2-2199-4d94-acff-2b83fbaa7bd2", "comment": "Malware payload", "value": "a5e291d08e161d558be052379572a59f46b6ea42", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413685, "uuid": "0967867f-65e3-4803-b022-aed7c7c57d43", "comment": "Malware payload", "value": "881c71aa8b0cee4817240689967b4aa3b01335ce3550cb75dd9c82b827cceaae449f26319a0af39952bbe342eb954a28", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413685, "uuid": "0780a5c0-1086-4cb1-920c-aa650354c540", "value": "T1F031B8D71A121D4206008A4F3BA09088E94EC5CD54EBEB6CFCA69C7F4D9963D71E9F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413685, "uuid": "5709829d-0d88-48e0-9feb-2805c5237894", "value": "24:9yiRKk9iRCUq7aI1jhRfU2VmMgQJFMp3dSnoB3/O:MiRKk9ieRW2MpnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413685, "uuid": "5016719d-8ba1-4eeb-9ca1-f9235f8a948e", "value": 1529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413685, "uuid": "c15e3b99-77d3-4637-b0f9-66d696034d19", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413685, "uuid": "d6d9b309-46c8-443f-8ce5-e1278ff3b2e2", "value": "Vision.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ad3ebb-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436123, "uuid": "b4a907da-4ce3-42b2-9280-9341d2b1fc67", "comment": "Malware payload (Mirai)", "value": "6edd19358a719b467b180f228f949f7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436123, "uuid": "0359acc7-19a5-4155-99af-8f4500899aef", "comment": "Malware payload (Mirai)", "value": "06fe5669b2c720e8ca3b52e74020c93e023ff5a64c744f463c91e6703d3e973c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436123, "uuid": "8e3aae01-a88c-448a-aa80-e5910fe942da", "comment": "Malware payload (Mirai)", "value": "71cb6fda0f1abffffea4cdab395a2ff419d55009", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436123, "uuid": "1111e295-0653-43ac-a010-a3ead19dbe1b", "comment": "Malware payload (Mirai)", "value": "8b781376c8e549c56fef78762359b7e538576cced0dfd88b9f60a0df2919c51480101f93d27c4384e9bb99c915b732e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436123, "uuid": "6fbdc578-4f66-43bd-adc0-18b43e2c6619", "value": "T18013F1CD524004E5CE6F5A3DA8BE1F65394071C432EE0F5A92698D61BEFAAC7B4CD0D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436123, "uuid": "f5ce0932-278c-49fd-bf0d-87f537c95430", "value": "768:3jdBuP37LSHyomZgvE5FRahT2GYADAf+wV88rxZeOa0WHt:3jdBo2y/Zhy6GYADAf+wmmxZUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436123, "uuid": "16d1ba1a-8287-46e8-bb1a-e2018b4a63ea", "value": 44524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436123, "uuid": "0836ee8d-59a8-4550-a459-144d77b581a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436123, "uuid": "c2cb2196-0d79-42aa-94f9-781ad0f7ae3f", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2dcb815-4c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778376224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778376224, "uuid": "d1a7d6aa-5ef6-4505-9939-31d00bc4c2cc", "comment": "Malware payload (Mirai)", "value": "b83b88f0de91d876d319dd9160405542", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778376224, "uuid": "0dc77af2-00bb-4b72-8d0a-6f06729fa00d", "comment": "Malware payload (Mirai)", "value": "07207f62578f69a793e5f1560c923f24b3512e97b6f9034f5df797f7eb253d74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778376224, "uuid": "d806abf1-7a2c-434d-92c8-cbe761bf1a4c", "comment": "Malware payload (Mirai)", "value": "30890a9c824d05b4449212f7bdbffe690a5b6ae4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778376224, "uuid": "745ff9bd-73b7-4fcb-9831-c6dea2ec8515", "comment": "Malware payload (Mirai)", "value": "e3a4e16e33295b2194fbdfa217cec860f81260f3d81122bbc2377edda38bdb5349b74fdce2c6139afd5e2431f82b52c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778376224, "uuid": "373048d2-e426-4de8-9a06-210533154cf8", "value": "T12273026E551EA16FE091A073EBF217E41B8A03D02D349F6EA7E501B3DCE493E7846C91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778376224, "uuid": "83801ae1-822a-42c7-9bf9-36a70822f1cf", "value": "1536:boGenTBAB7BHoxYCWlIV6i00WxhimF7PdBHmksU1Xi9DhAbVN/tlOmVEW4:kRnmBJoeLIgiyhTBHmIXdNWmVEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778376224, "uuid": "e4e06d41-fe68-4b99-904b-91723adb3a0d", "value": 75780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778376224, "uuid": "11e75813-2f31-467c-9c33-0c8ac5f7877d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778376224, "uuid": "afd53171-6606-47f3-a6a9-d8a71eea1e41", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bebc818-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436154, "uuid": "d23955f2-5075-4a9b-bd73-0bab7e47b67c", "comment": "Malware payload (Mirai)", "value": "b91795f6145b28604f063193885e23a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436154, "uuid": "6774c3b1-4aa6-4760-9501-17d5544a17a7", "comment": "Malware payload (Mirai)", "value": "0865971736c56f592c1f337e8d1131bef829debb78cb12922adacf70a4baed56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436154, "uuid": "00be4942-5410-4d7e-96f0-ba5d28c58570", "comment": "Malware payload (Mirai)", "value": "ce73526f69e05d68c4898d778867906cf52e5076", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436154, "uuid": "5c7b6fc8-b008-4dc3-8f86-c7402b2f7a4c", "comment": "Malware payload (Mirai)", "value": "54d06547b4f22a9c28978f981a91c7e887c7c083c281caa974bb95d2c8d6f117e5e7539c89eecc1076f6eb08e02afbbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436154, "uuid": "da547e6e-32ea-49cb-83c0-d81fde48da7c", "value": "T1BE933A45FD819612C6D1137BFB2E328E332663A4E2DE3203DE256F22338659B0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436154, "uuid": "3264ffdf-6de5-4dc6-980e-400a19a9f5b8", "value": "1536:OLta87G2FrspVaO3wyb8pPRLQ0YeKXffd6bqmv19:Opa87F4bPipPVQ0+Pk19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436154, "uuid": "b684116a-0f5b-4e72-895a-84baf21970bd", "value": 92248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436154, "uuid": "134b84e0-ee3c-4a02-92d3-4d7020a197a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436154, "uuid": "12139706-4f54-4696-abaf-db127b9691b3", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7043ecdd-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371307, "uuid": "4276cfe5-c1a9-4b70-a68c-e8955d9793b5", "comment": "Malware payload", "value": "ad6ccf408c0eda72995826836b1fd360", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371307, "uuid": "a9ab9512-230d-4720-aa99-cad48c36e393", "comment": "Malware payload", "value": "08afb4d1eea5ca092fc3243049e1d737d5239db7d9aa69467f8fd6c742fe3797", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371307, "uuid": "cb79f8e3-503e-412b-9d78-674e4ad6b6fa", "comment": "Malware payload", "value": "b688463a650e498b45e0322980f7029afea673b5", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371307, "uuid": "8888531a-a8b0-43fb-9438-4ca2a78cd6d5", "comment": "Malware payload", "value": "a9f06485a5bc12e0fa2de872b3ec5bcec42f41d9229f040eff5b494e3318424215122ef02f95bb2ed6e476c3befa76f2", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371307, "uuid": "ba2d19fd-71bf-49fb-a828-4d6f7194caa2", "value": "T1E4F44B64BBF9660BE17F4730E5724C2823F26083B661C34B4E41A95E1F67781AE177A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371307, "uuid": "ef21abb2-b0c2-431b-b360-1eaaa1e730c3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371307, "uuid": "0cfe8271-0d7a-4cdb-be42-b199cb887252", "value": "6144:VR6lnC+IxZqDyptc+MFL+4W9UFCumk75ucQqUog2apanlpnyZFlhFGgRmDc+Mx5q:Vkn4jq9F1FVnvwFbRmubzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371307, "uuid": "dc4c6e4e-3050-45d8-bd61-6211d9fa222d", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371307, "uuid": "2537b407-5c9d-4ec1-b458-ddeb251f6f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371307, "uuid": "7d5a44a3-525f-48f7-bd3f-a97e9ccf16a8", "value": "08afb4d1eea5ca092fc3243049e1d737d5239db7d9aa69467f8fd6c742fe3797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d369e68-4c06-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778372483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778372483, "uuid": "c8d19286-09b5-4a66-9b79-1ae4d99b9bcb", "comment": "Malware payload", "value": "88d48185ad4993c72d87c6d43170c280", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778372483, "uuid": "08435d3a-bd49-46a6-b0f6-3988012602b7", "comment": "Malware payload", "value": "09fba51eed948b24faf02a0468b5032313773254af3798d5a8b4faaf563643a9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778372483, "uuid": "850fd88d-187f-4c3c-97ac-0bc3eb56f5cb", "comment": "Malware payload", "value": "1bc9430f81961df55f43981290107e614cc001a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778372483, "uuid": "591095ba-39f7-4614-bd09-78e794bca66c", "comment": "Malware payload", "value": "7181c8f5668eaadd95511dcc6b17d988982d22cafffe6aced0193241c692e373e2fd9638f19a5543ba89ba38dfbe2216", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778372483, "uuid": "c61561af-5621-42a0-ac40-18b85e755362", "value": "T1B5B2E0F1F8ECA43636DD453ABB9CA805A9CF7C2F4DAB7D2014575928411CB1EA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778372483, "uuid": "a2a27d3c-5b8a-40eb-b2f7-8da9160e931c", "value": "384:MVc3s1oisjsKG6qkSgjkjV/A4UAcGE3JNRhQuW5By:3shUMkSgjkjVdUAcd3JN3ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778372483, "uuid": "2d635dd2-8db1-45ad-ae22-4d3689627703", "value": 24365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778372483, "uuid": "3d0de61a-09b1-4f22-9902-548d013588ca", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778372483, "uuid": "53658eba-fff8-46b0-ae89-431813e2bbb6", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bb3c0e-4c79-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778422205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778422205, "uuid": "4f501e87-e217-4ccf-b603-b2334b12428f", "comment": "Malware payload (NanoCore)", "value": "ed27443429ed5b55ace0de469d71d51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778422205, "uuid": "1f851ffa-dba9-402a-a994-86454fd0cb4a", "comment": "Malware payload (NanoCore)", "value": "0aabc0bcec0c5a5d1f9c61dd2f6e31f2881cbcb4431597f6031e298379e1262c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778422205, "uuid": "5e56d5d7-fcf9-497c-bf65-21c32d676c5e", "comment": "Malware payload (NanoCore)", "value": "1f437264157e78837414eba8301196d22fede510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778422205, "uuid": "c987e2e5-3445-48ca-b914-b0f6909daf7b", "comment": "Malware payload (NanoCore)", "value": "5416ba270e5a8bb8398e406ace8a66f115a3efeb572bd94dd9489e4df43f41cd7cc47698230b5acdba70c62358f4b3ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778422205, "uuid": "8cc53b27-9258-4fe3-b193-b20513651b20", "value": "T14114BF567BA88A2FE2DE8579611202128779C2E3ADC3F3DE18D420B78F567E50B071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778422205, "uuid": "85d59be9-032d-41dd-8cdd-caa549cd036a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778422205, "uuid": "df3f8696-3fbe-4edd-b737-c88271885ef6", "value": "6144:MLV6Bta6dtJmakIM5DG9lT9E6CvvHPfI2xu:MLV6BtpmkkGrBfCvPPfIWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778422205, "uuid": "6b189583-036a-4bab-991f-31512f1cb453", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778422205, "uuid": "7890c018-29ac-4441-85ad-6becb110ae37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778422205, "uuid": "7013afc6-3077-466e-a5fb-e29f910064ff", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff7c451-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371387, "uuid": "c1632cd1-e45c-4ac3-bc12-3c06a13310dd", "comment": "Malware payload", "value": "11a2ecac741464d04e8ac2e17b032015", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371387, "uuid": "e3e65f30-ccd4-41b3-8baf-83b897aceff9", "comment": "Malware payload", "value": "0b8a3ac4ff13a4d5e4497444d6a22fc8c9b70c73e38582f80f0e12346b8f368f", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371387, "uuid": "57fa88c1-f6f8-4098-8b50-97802c3c1363", "comment": "Malware payload", "value": "5692ade635992ae89fadf8d0ff3b6f995230a111", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371387, "uuid": "e4e1e511-577a-4f2d-af23-dbbf440f99bd", "comment": "Malware payload", "value": "1ed11903a072a2e848c1ddc17dc0d7d791236d6e91becea4c5006981036ea78e9793fc7a482d6590083253f009cef190", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371387, "uuid": "d772f0b2-96ee-485c-aac7-91f788b4dedf", "value": "T138258D0477F8671BE27E8735C2724C1913F2609366A1C74F4E85E94E2F66782EE067A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371387, "uuid": "86901010-eed4-4fd9-a918-94f782a6699f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371387, "uuid": "3d1cfdf8-3767-42ee-a591-b20a0703c3e3", "value": "12288:OMwv2fjoLGVF2T1nBELF34ZyAbwZ0JLF34ZyAu8Xyj+LyF2TKDonB:OAfjApnBE5327J532u8ij0BnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371387, "uuid": "1580a432-c6f6-41ab-a599-5a131f8797bd", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371387, "uuid": "4dec1cd3-7a48-45cd-b73b-35312f6c80f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371387, "uuid": "824ddbdd-8b2c-4010-87b8-a4d16fa23ef5", "value": "0b8a3ac4ff13a4d5e4497444d6a22fc8c9b70c73e38582f80f0e12346b8f368f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6b6f7d-4c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1778438277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438277, "uuid": "b2ef536b-1d95-4536-af02-875b2b94e500", "comment": "Malware payload (CountLoader)", "value": "7ddb9cf0a1a9d9a5fc1de6d1eceb7429", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438277, "uuid": "91ffa44f-67a2-4a3b-91e6-f9cc9628f661", "comment": "Malware payload (CountLoader)", "value": "0c43a06f9d63fbdc6c84decdda37c8f2f0d32088aea31be0456500bf200af470", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438277, "uuid": "f8f58dfe-ebcc-4e4b-af46-b58e65979342", "comment": "Malware payload (CountLoader)", "value": "0380cd9e1bde39c8f1c8585b587bcfd534d163d9", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438277, "uuid": "745ccadd-4532-4013-b411-9e539b36ec4b", "comment": "Malware payload (CountLoader)", "value": "b1bf04bf23dd9c723ec8b5fa8107305f5c1e47243e381b88bd2d5cc0315abd890244c4cb85b010b639d1963646bf666d", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438277, "uuid": "dcfd9679-62ba-4959-b1b6-0382646b038f", "value": "T1C1A63A11FBDAC4F1D5636630208F666FB732180247389B9FE9847D9D987B762283670E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438277, "uuid": "57b089fc-2e5e-44e7-8f2d-223825401edf", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438277, "uuid": "6cca810d-f57d-41cf-922d-b02fac36df5d", "value": "49152:N1YezUw/447nf45AJReS17mBH2bQHq416:8WUw/564l70H/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438277, "uuid": "79906a91-6534-4b7a-a7b0-9c8b6e0a7d24", "value": 10078208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438277, "uuid": "44be248c-bd0f-4937-aad5-10c968d2ff71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438277, "uuid": "c83ec793-c807-49ba-a49c-ecb4e2322957", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ee9e82-4c68-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778414698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414698, "uuid": "56865de0-49d3-4693-a2c1-a0a519647d22", "comment": "Malware payload (Mirai)", "value": "75a71be33fcf26b61d44eac2e5763860", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414698, "uuid": "e6309883-4047-4269-90f9-af060acc754c", "comment": "Malware payload (Mirai)", "value": "0e2c7aa1dd01fd0f4d62e5f8c6ba5a42cb92eb0bb77cc1d1cddd10507501e126", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414698, "uuid": "c648dd93-606c-4ce2-9a74-7f20a89bc749", "comment": "Malware payload (Mirai)", "value": "32026ce00881a39918b3a7ac15ed046ba503a9c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414698, "uuid": "8b2b0937-2123-4ad1-ad3f-e521aa1e2d2a", "comment": "Malware payload (Mirai)", "value": "4433bd91331ac81e4cb2890da2cbd4c7062dc838629d3ad853d935f20eeb5fdc2c33a2b77b757ef900841d53d575221d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414698, "uuid": "298d578b-3ebc-4c10-a85c-c15a2ab17e2c", "value": "T183F3D75E6E229FBEF769833557B38E30A398339622D0C585E17CD5211F6034E612FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414698, "uuid": "8d42e934-2ded-40a2-b88f-0514d98d9a5b", "value": "3072:nbpr4N57ZLMxkuLpC2X6KnbQo8MtF8f4go8OMJc6fJxf5oFp:1r27ZtQ376BPoFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414698, "uuid": "4f21e750-b1f8-43c6-b9cc-6ee9c6d0daff", "value": 164244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414698, "uuid": "eec57861-c1a0-4f3b-bcb9-084788306af3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414698, "uuid": "9bab54a4-d7a6-4305-9c14-d46736ed212d", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f96e327-4c74-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778419678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419678, "uuid": "19f9cd3c-c418-40a4-b373-f7b619a38f48", "comment": "Malware payload (Mirai)", "value": "34e1a56b1bae11a22a87b485cbc32d4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419678, "uuid": "c649625c-dcb1-43f5-81af-25210415e56d", "comment": "Malware payload (Mirai)", "value": "0e83c6839c18de0720ba474289553f44ed837bbfc994d91c2c2675f71cc9dc7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419678, "uuid": "5a4fd900-2e4b-4b7a-b00a-dd1cabb57e14", "comment": "Malware payload (Mirai)", "value": "a2ec84961e119173e446e618d56db9883d35174f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419678, "uuid": "172f2099-1efb-483b-8209-643d795b1e69", "comment": "Malware payload (Mirai)", "value": "32792a10f6b31850acbb97029b8961f7cadd205e72c9013762874dae2eac5837450428b051ff6d8b2f80b2ec1254016e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419678, "uuid": "976d94b4-29d8-4bc4-a631-5c124d6b1999", "value": "T173A32ADEB8924A2DC6D246B7762E938973755374C3CB7203D8104FF8A68F50A4B36B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419678, "uuid": "f1b584bb-a2a8-423d-a433-18d6407ca0f3", "value": "1536:dzyB30aPV0a6dvkH6DHRQJszA1gQPGDJZgJLUuDAIkdJwCoB:dKEaPV0XdvkqxLz8/PGD8iuwoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778419678, "uuid": "7e14b817-8c75-4d99-86a2-bd324eb42179", "value": 104752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778419678, "uuid": "f9961f78-34be-4a92-8e3e-1f2aad227e38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419678, "uuid": "836f64e3-e7aa-4412-ab6a-569af5a69435", "value": "debug.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba4fb25-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371380, "uuid": "07a5be0f-f64b-48eb-9454-bd57162d1f2a", "comment": "Malware payload", "value": "0d4d655fd0cc6f15b69ad3698ffe3319", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371380, "uuid": "5da05df8-22b0-456c-8f1e-e077c0e271ee", "comment": "Malware payload", "value": "0f624eda993ddc7a8b582401c025a6727a431212be7ef2b068670c4a1a4468b4", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371380, "uuid": "ae6f840b-54b6-4311-aacb-99ee8bfba941", "comment": "Malware payload", "value": "6e78b809e73ead296dd29fc8f4662a1d6b99501e", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371380, "uuid": "3bdb5208-49d1-4c7c-9908-eef81c70676a", "comment": "Malware payload", "value": "57f2637edc8307d64a2887ecb8e02b316fe17d86d35a2a63b81b48a877b67a964ac0c94e371c5246272c00346b1a775f", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371380, "uuid": "492db395-f562-473f-9264-e6818a49ea29", "value": "T11E158D19B7F8670AE17F4771D6720C2513F590736B66C70B8D81E84E2E92B81EE067A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371380, "uuid": "807fcf2a-d24a-41aa-ba5b-4b001a114bcb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371380, "uuid": "fd558f47-e5b8-4f4d-9c55-00b8743974e4", "value": "12288:VAJGEp2WYdr0QvF1YIBLMxoADyB5qLjV78kfGA5iRLMxoADyB5qLjVE08fr6J3oE:eIFH7hYDjOIAYDju0qrYN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371380, "uuid": "161566bb-5219-4161-b188-311471a341ca", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371380, "uuid": "c58fdedf-6e84-49be-85fd-6dbfa3a865d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371380, "uuid": "82ae2f26-6939-415c-8c56-2ab75bd4b49d", "value": "0f624eda993ddc7a8b582401c025a6727a431212be7ef2b068670c4a1a4468b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbcd564-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371360, "uuid": "03d1b24f-cc95-4d61-ae3c-0834dbf1f4d7", "comment": "Malware payload", "value": "4c27694952bf91d0c487aef206a340f9", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371360, "uuid": "610d4832-fe12-4b72-9e35-6da78fda781a", "comment": "Malware payload", "value": "0fe0289579b5859b4f091a492ba52dd1ac2f53c9a0bf9496339d51fa8a5bfb96", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371360, "uuid": "5f85debb-4286-4495-aacd-122f32b52746", "comment": "Malware payload", "value": "1ae1129e75bc23c691c77dcfbc5950539175f763", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371360, "uuid": "a8229482-f79a-44c8-8018-c0b8a9407278", "comment": "Malware payload", "value": "f359b0855ce01a3a33ab918c5cecb93313fb430c72445be9e71166fed389fd574893967c546d348042d8c0f23d46cf1a", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371360, "uuid": "f5012ad6-6e90-4b47-8eb5-ec34da7db57c", "value": "T1F3246A0CBFDEF55BEA3C067146A3086B13F0906312F54B0DAE861D9A9F1A3C2FD56661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371360, "uuid": "9882e00f-2469-416f-8bfc-3f041df4233e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371360, "uuid": "898cad52-66fc-4245-afdb-4fbde748bb19", "value": "3072:xV5osREHSQ9HFrP+Ym+MXsePcLcBAGCpOXLSQ9HFrP+Ym+gJ:xvR29HFaYm+7e0MCkv9HFaYm+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371360, "uuid": "18e55943-1032-42f5-acc2-3b2e5d834c7d", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371360, "uuid": "a50aaf53-924b-48aa-b644-7539a5bd0874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371360, "uuid": "416a0475-5e77-43c6-b62d-02f27ee8e412", "value": "0fe0289579b5859b4f091a492ba52dd1ac2f53c9a0bf9496339d51fa8a5bfb96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9858fd81-4c4d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778403157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403157, "uuid": "332cfa14-45fa-4521-b382-c61c740fd644", "comment": "Malware payload (Mirai)", "value": "bd91b5cdb7b32a2ff347c58fb164a5a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403157, "uuid": "3c2a4c76-729f-43c8-85fc-ce1204a79b3b", "comment": "Malware payload (Mirai)", "value": "10f5d4ee9aba8d77a5ef4de78b57b89873ae16e0f12b38f1d14b598ff8070772", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403157, "uuid": "9d60f6d1-15e0-4a2b-8384-6ed911778ead", "comment": "Malware payload (Mirai)", "value": "374d4f016b627f4f3efeabe0f03fcac15a3ba63d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403157, "uuid": "04fbe6e2-6605-4bba-96f2-0244514d80ce", "comment": "Malware payload (Mirai)", "value": "002654474f9921e11a65e089ce274b594b472bd83bd988f7468f782aac4c3f764be69179a1da8b50a8016c4102a51035", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403157, "uuid": "2b589a9e-7143-443b-869e-11246d0d7a2b", "value": "T1AD831A9EF4E24A1DC6C00BF6763E934A33A15374C3DB7653DD005EA8A68B50E4F36A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403157, "uuid": "cc6162a3-68e2-4d17-8a7b-88ff38e8d386", "value": "1536:ZXb6gjBL7kRlioym3AfYPeAtdGwEKo2AvrXDwM:R7tL7oo/fYlugc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778403157, "uuid": "e34904ec-6ef2-4bbb-9814-0c6352e3669a", "value": 88204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778403157, "uuid": "e6ad8b8e-a702-4ff7-8f59-b9d1b3b7d5a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403157, "uuid": "dff96c80-56e0-4c75-9346-0bb269782c23", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6d3345-4c9e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778438037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438037, "uuid": "fa8f88da-4ae2-450d-99b3-bbca4c894c99", "comment": "Malware payload (Mirai)", "value": "0c3243ccf1542040278405b6c9bf122d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438037, "uuid": "6af1412d-cb79-481e-9c82-aa42b980ed22", "comment": "Malware payload (Mirai)", "value": "126822ef648c3c30dc20c5250ef6cdda0cb75a471093761bcaf24fe0a306311b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438037, "uuid": "a42e2fb6-4416-4bfd-a9dc-38695fa194c6", "comment": "Malware payload (Mirai)", "value": "bad901a72335d8be037cce230b0dca910c2a9d0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438037, "uuid": "aac5b97e-103e-45d6-a561-0d5d62b80b40", "comment": "Malware payload (Mirai)", "value": "0840ceaa982ea63b712535ba026a9dc239011d213d7124a4165b739938465b2dcab298560a7733deba538ba39c49f482", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438037, "uuid": "d0c82b80-6510-4e06-9cb2-0d3348b5966f", "value": "T15F264A65BC5EE553EAC863707B7582D0323EBC889F42D3236610FBAE59F675C8E12112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438037, "uuid": "05f3b460-8a48-40d5-a8a4-37095d42f611", "value": "49152:ih4/Azu/tx36e5NUIf5EbAo7BdCJLdXeiezB1E:w4/Qu/tx36e5NLxE4JLdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438037, "uuid": "5636d800-5e2d-4d27-b506-1c47460e7433", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438037, "uuid": "3e0b5f20-9cdf-4ac6-853f-c8bd638a533b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438037, "uuid": "a3dfa480-a9a6-41d1-a538-3255379c136f", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859721e0-4c64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413004, "uuid": "689083ad-9b7b-4693-9f95-6c8d828b3f4a", "comment": "Malware payload", "value": "1134994e640ef029c90e8b03d4befc6f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413004, "uuid": "dc5baf07-62d4-4712-8c5d-5d3e36034a68", "comment": "Malware payload", "value": "129839185761deca5cefdc69acebd98dd24a8d3c071f719d8faf1b30b10dbc65", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413004, "uuid": "451dd56c-c8d1-43b4-8c80-bb484e8ed940", "comment": "Malware payload", "value": "91a67d975546babaeecfd05d0bfb95377e91f8fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413004, "uuid": "386c09ac-c2e2-48c1-bb4f-1f7b683ec61d", "comment": "Malware payload", "value": "bce1b89008cd8b4bb42c7360940a7417acc7dad3a7e57dd4737b853d6be8fc2dd8df74ffc2cf1d60b14062aa98e64641", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413004, "uuid": "4d84fa49-c625-41d4-b24e-98c34a0698aa", "value": "T179860805ADC53BE6C42C5E7444EACA6522B06D140AF2463A26A4FFE9BC772757F078CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413004, "uuid": "854a27b9-9d09-419d-92af-3292bf789b77", "value": "49152:xrL2a58kqXRpS51Gq0CQpGylBIF3CiIE17Il8Z6w2v55EF:r/LQpJiImD4w8vEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413004, "uuid": "318383a9-8b48-4911-a29a-cc40787e5c1d", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413004, "uuid": "692db060-fbda-416d-8380-1fb101310a50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413004, "uuid": "f35cee58-600f-4511-9834-32bef4ffac15", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58491e07-4c8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778430108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430108, "uuid": "1434fffe-a40a-46e1-ac2a-72076afa9771", "comment": "Malware payload", "value": "a72e6d07c11c81026a0f95a99446e786", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430108, "uuid": "67f65da6-2959-478c-84dd-97a4635202fc", "comment": "Malware payload", "value": "133a79e9094c14c0f41378c712fd9a3f7687e5ab6f781bd5fb94774e64f4b48d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430108, "uuid": "85db18c6-606d-4a54-bbee-7403bc914b7b", "comment": "Malware payload", "value": "1c09a24d0b19b0958a4e754b4db74e8e9baf6916", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430108, "uuid": "16e4d8f9-890c-4411-9efd-59509f99f7ff", "comment": "Malware payload", "value": "870d28af0c1c8d09115df3077cc5795bf3ea72907ece06896cbfa9aedacdd9e154127543df85a7447be40ce9c510e6c8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430108, "uuid": "21cd91b2-6f7e-440b-a154-11316e0fe452", "value": "T1DC53E6BFAB52DA75C441D2709BEF9270A47070702F36212F3B016BBA3E716554B69E23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430108, "uuid": "08bc9305-25a0-4713-8be0-bd0e7bcb5742", "value": "768:pNzUF7028GmcGzp6xGmmCzlv7+yGJrgP53drdnDFIdV805W0yJZzyPlBZBSSch+V:8O2Abz7rM53drdnDIV80U0y3yPzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778430108, "uuid": "84acb3d9-c4a0-4062-baf1-e5ebad9f1210", "value": 62392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778430108, "uuid": "034f84ce-82ea-4e4d-a85d-eb44c02048de", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430108, "uuid": "572f4919-22a3-44b6-a15e-4d3e2cce530c", "value": "exp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95d27c8-4c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778376262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778376262, "uuid": "1b326bb3-2263-4797-a2b0-c637b45dab6a", "comment": "Malware payload (Mirai)", "value": "88d19ddcefd274dfb16d726753008627", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778376262, "uuid": "11dcee71-88b7-4079-b9d3-04b1e684fe38", "comment": "Malware payload (Mirai)", "value": "1394f1bb91eb2cb5bdc1dd3724f5b39302d5498d78ef44a688d955551c55b6b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778376262, "uuid": "25490364-9517-4b88-bf58-7c02f2c7b48f", "comment": "Malware payload (Mirai)", "value": "e3a06fd5633bc21a85fe9224c3791402082b9f8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778376262, "uuid": "1b52e439-a162-4ad0-8712-2d07ace9c479", "comment": "Malware payload (Mirai)", "value": "ea17e07cd89fb70e1838af53aacc4eb0e797ee92ef8ea778b86cf401fe2b906e967acc05edcad75d1cea90276d8383da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778376262, "uuid": "5315179f-732c-4641-a604-83aa1bd73120", "value": "T1E824B95E6E328F7DF2A8C73047B74A24975D63D627E1D684E2ACC1101F2425E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778376262, "uuid": "20b48f57-6200-4995-8ab4-df8b835d2c8e", "value": "3072:HVWov6chVZSnodVi/KKL6dno388Ew0P3RYLfIt5:176cAno/Kuosdwa6Lf+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778376262, "uuid": "81dcdf6f-adb1-492c-94f5-d0cdf304b03f", "value": 224732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778376262, "uuid": "ba4d56ce-ab00-45ab-a769-dea64dbbfb48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778376262, "uuid": "bcfcd3e0-747c-493d-9d2c-e7bc3f3a11ae", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717f0dad-4c75-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778420272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420272, "uuid": "bf68b39d-29e2-493d-b73f-8aa44423c95e", "comment": "Malware payload (Mirai)", "value": "c929ed52f5e9856206d16d8cfdad29bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420272, "uuid": "00ff720b-3f8b-4d74-9c04-3036eb4652f0", "comment": "Malware payload (Mirai)", "value": "13dc2da6b27b423effcb823cf2a4798fa324418bbb81e8f3c7d7eeeb1eb92872", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420272, "uuid": "1d2ed05f-6518-423f-9823-307e94af6323", "comment": "Malware payload (Mirai)", "value": "603d37c57dcfe82321f4d6ada9f9769b6b87215c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420272, "uuid": "ab664c26-9149-4ece-9b02-f4321a6e5133", "comment": "Malware payload (Mirai)", "value": "ed951e18c310cf1c44a2a299ff653639478c7793cd187afee5271babfc2fe1eec1ca59e2e135a37282d981c15789795a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420272, "uuid": "582343b6-f4ea-44c3-82df-b852212e49b1", "value": "T150E3623A7E21EFBFE27886310BF75FB083A561D236919381E1ACD7185E7128C489E754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420272, "uuid": "3f85dae1-da2f-4077-9383-a2e66b2589fc", "value": "3072:T5O9mOB35qUmUwwRMNfxOM0Z4ti24oHk6muc7bTaw2RLY:T5Xc35qUTzRMNfxMZ4ti24Mmuc7bTawb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778420272, "uuid": "f5e9778b-3c5b-4415-86eb-f4b0a93b4977", "value": 155073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778420272, "uuid": "9d4e66dd-b2b0-470b-baf3-6e0ee80f0a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420272, "uuid": "11fdc260-6729-435e-98c2-9bd677c052a3", "value": "zyre.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82080bc2-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371337, "uuid": "22ac8149-2c33-4554-a10c-7b4003322098", "comment": "Malware payload", "value": "02c308130a9b7e93836cb08dcd8c7666", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371337, "uuid": "7025f12e-a6ab-4b81-b2d3-1849057f0bed", "comment": "Malware payload", "value": "15b428bc658467ce8e0557874507e122ec6222818b6e14aa24c756cd5b6d057b", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371337, "uuid": "41fda65a-054c-481f-b608-9496ffe65f06", "comment": "Malware payload", "value": "b5afcb07f2afe5828c2f9b8e4bfd08c08cb4099d", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371337, "uuid": "33d52b6f-a4f9-4bf8-ac77-38dcb6fb9667", "comment": "Malware payload", "value": "3d9c5c7075333b9656f06f267b26f310233a7afb4a1e864e3b4467ad316d51ee6480a0bff8d0aaa72acaa341ef3356f9", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371337, "uuid": "a5fc3705-1638-49f6-93f0-7a72f1c1d49d", "value": "T1A0B4390873F84626F1BF0B75E67261188673B953AA61C34F0D91A04E1EB17C1DE9AB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371337, "uuid": "c16f991b-7c13-45b8-85f7-d880f60cf63b", "value": "6144:TQJpGymtMNyuWe8fiIqj9ta+eAonHhIt0FK97w9bNUCUYrOSN5cR3kXA7:9GkuqEaJFnHxFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371337, "uuid": "398a0deb-81bd-41d8-8541-e49271205a7b", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371337, "uuid": "6cfd1753-f2b7-4b84-b837-9457beb062fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371337, "uuid": "92cad9b7-e2dc-4046-87f9-686049f43ff0", "value": "15b428bc658467ce8e0557874507e122ec6222818b6e14aa24c756cd5b6d057b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df01a0a8-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389532, "uuid": "bee72b59-47e0-47ef-92fb-8cf0d73dbd77", "comment": "Malware payload", "value": "d2a8b8217805a8833770b04766be77be", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389532, "uuid": "89b2b0dd-b62b-4259-b6c3-2adaa8bb1135", "comment": "Malware payload", "value": "16dae44c9ae8fad42d1cd9239f4a1e7a2c188f6d19e6e284788f6fc499fdacf1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389532, "uuid": "0a4808a5-d4a7-4333-b8cd-680092e545be", "comment": "Malware payload", "value": "cae41f2322b858d639a06e0e4c7eb61fe20ec697", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389532, "uuid": "00d572b1-51e7-4549-8855-7c6107ac6f3f", "comment": "Malware payload", "value": "e2b5deea42ebaf0ecfb3d1972ff505b76e725c461b69844397690424073d2ff25c67c9cd5da7f680fcfac5bb32d20d5c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389532, "uuid": "1b0bee07-c71d-490b-8ce1-56d28196223b", "value": "T184315ECDDDA2F1D180D8AD047089D1439C88A7C7F4862B8AEBDD26A292E0E10E371FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389532, "uuid": "9461cc6a-f3ad-4567-a9d9-5a7a902574a5", "value": "24:8ekeKNIdeJKXeD8leSheveIcklessefhefhe4heyE2leosheYcxn:8LumkTlHI1l2CCvJE2lIax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389532, "uuid": "707a3c96-202a-4a45-ad9a-31b10d93557d", "value": 1507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389532, "uuid": "8778e375-58a9-44e3-9f2a-178d2863ae33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389532, "uuid": "4a59e65d-064f-4fbe-8060-d38d3acf0a60", "value": "www.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0ffa90-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371466, "uuid": "73b093a4-7097-4d47-a7f8-a3c726ea0173", "comment": "Malware payload", "value": "692dccfc50a5e532769ffc29dd6cc4bf", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371466, "uuid": "78540de3-a430-4085-b32d-b754fd2f8e8b", "comment": "Malware payload", "value": "172dedf7888fa812e4ca3d1291f908f483a4e00a66d5384b44ec33dabda6e70c", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371466, "uuid": "95ef9e25-5b1e-449c-b747-a38891a54aac", "comment": "Malware payload", "value": "80108d035fdf729ebd98a84ca8268387c02942ee", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371466, "uuid": "2bf117fa-d8a5-4ae5-b22e-d1066bfb3c52", "comment": "Malware payload", "value": "238c6ea07cc8f1b76abda2da677a086ee25f12560f523ffb77f3df142a6361f40a61268a9068a7d7e5be9c358d034663", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371466, "uuid": "f5b3e9c2-f75c-48f5-9d99-9a7686de4723", "value": "T146944B0463FC466AF6BF4B35A57341188773F983E511C34F4E51A84E2EA2B80EE55BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371466, "uuid": "91bbb235-f76b-40e7-9eeb-87c4c3991c27", "value": "6144:FzS1bL6HYhsGQltdRipRIuGwBSssHO7c9b4ks0C0cLEY1:S6HhcSwBBsuLEY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371466, "uuid": "d9787230-1474-41ae-a0b2-b81f1850b156", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371466, "uuid": "2209125c-4ec4-45fd-9460-f1833466cab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371466, "uuid": "4d869298-f59d-4908-9daa-7cf0f097ff8d", "value": "172dedf7888fa812e4ca3d1291f908f483a4e00a66d5384b44ec33dabda6e70c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72207cd9-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436164, "uuid": "b8bc5e66-dade-4a81-b886-f2dfcb1915e6", "comment": "Malware payload (Mirai)", "value": "890c58b5cc4462b387ede9e3dddbe232", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436164, "uuid": "524f787f-f6f9-4258-a15c-57c5e2dd0f0f", "comment": "Malware payload (Mirai)", "value": "18620114cde9de764d25911d4b759522caf203b0489261582bdc348442d9f313", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436164, "uuid": "b052f7e1-2a93-42ea-9dfa-93a06c7e288e", "comment": "Malware payload (Mirai)", "value": "bbbff162baf6ace0e42af0bbd17bb3cbb630cd4c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436164, "uuid": "e73b8c75-9da6-4f8f-b1de-678f7768f255", "comment": "Malware payload (Mirai)", "value": "21f30931f5eeff36635e430d80b621e11a1bf2402dfd1c3ba7092109e5885fcbd401387ce3fee2ef3135f253cda4060d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436164, "uuid": "940c1025-1e60-4dff-b7e3-dd3069ae41cf", "value": "T1C4432885FCD2996AC6D013BAA72F358E33A1B3E4D1CB3603CC945B25738968F1D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436164, "uuid": "ad783da8-d1ab-4c88-90af-f39df8787e77", "value": "1536:nRpDfwhNTvjG82EFMH81AMLjRKDt5Z79:nRpDIhNTviTUZIZ79", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436164, "uuid": "8d19a00c-7090-4071-8cd2-4b00f4463e1f", "value": 55884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436164, "uuid": "0f008bf7-b0cd-4baa-8dbf-fa37cd0c7e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436164, "uuid": "29da21be-222f-4183-9755-f1996cfbc5cf", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e586f5b-4c6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778416025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416025, "uuid": "aa7734d0-bdbe-4045-9ed3-b3913875b290", "comment": "Malware payload (Mirai)", "value": "109387f311a5d7ed5d907fd4d72cf7f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416025, "uuid": "61887ec2-b6f4-4086-a7e6-53137bdcfa4b", "comment": "Malware payload (Mirai)", "value": "186ccbf47d74bf9530b971ea56d0501e8a0aa273b3d806635a6694a9f6812e23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416025, "uuid": "9d9265ae-8ba7-45c4-b7aa-2dc6f95e6649", "comment": "Malware payload (Mirai)", "value": "1cc9db966ebbcdbfd0ca994f65b361761f72968c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416025, "uuid": "6bbb89a3-9630-4fe8-9b37-957421f84eff", "comment": "Malware payload (Mirai)", "value": "fb02ec5771ee4433b0bcf0bde8b00e775463d63ee75d03f90be65010d963d6a8e49054f1fb4d1d292cc9100ec2123a8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416025, "uuid": "8690e81f-ee62-4cc5-a72f-5720deedc83e", "value": "T1C1D3399AFD529E06C5C606BBBA6F128C772913B4D3DB3103DD110F68778682B0E37A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416025, "uuid": "03e0ebe2-df89-4317-b170-9a64485cd5d5", "value": "3072:NDBzjJZ26oaBKPiW8M1UtSA8l4CTqcuyqBf:NDpjJZ2baBK2M1ESA8l/qcuyqBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778416025, "uuid": "ba421748-8438-43b0-ba94-3429d54de13b", "value": 138104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778416025, "uuid": "a4a11fc2-8829-4774-87a4-a838d5891f4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416025, "uuid": "e125bbff-bc75-47e2-ad59-4d64e4e159a6", "value": "debug.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da07f084-4c69-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778415293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415293, "uuid": "ad370bc7-972d-4b1d-8a2b-ef77ed3289b4", "comment": "Malware payload (Mirai)", "value": "dcdc48448af468e00e93ddcb915718e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415293, "uuid": "b3d331e6-c8db-4055-9903-1654cf7dee1a", "comment": "Malware payload (Mirai)", "value": "198a44a82a793fe22b3fc38a8c1cdd9d11a5b48b9cf761f1a02df651fd888c73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415293, "uuid": "aa991d45-68d3-497d-baa7-c430016819ed", "comment": "Malware payload (Mirai)", "value": "01cfda82730d3b7b223b63366ef17178f7aa891b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415293, "uuid": "587f40d8-2de5-480c-af28-c4643ea02379", "comment": "Malware payload (Mirai)", "value": "8dadd0a4244053aaf2b2690d0c3a9acf6551fcf7feaa34f948f0dd7f2ce01839bf5bdfd81d0edda07f1a669e9ce15355", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415293, "uuid": "5dd72520-9fdf-479d-9692-621a21bfb657", "value": "T120C36C56B603D4F1CE0109B0101BFB3A9AB5A432005DDDA7FBD9FEB5A862B82C41779D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415293, "uuid": "7124f87b-0a50-4d54-bea3-5b4b684dd17f", "value": "1536:DMwptIgWzmjuTjBifQSHt/8J0O0xMPRBNr8oNDMUM31EyqFAvrXDwA6r:D5ptPWSuxUHtUixM5RwiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778415293, "uuid": "60213e7c-2821-44c1-bdbc-c826c96fde01", "value": 128852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778415293, "uuid": "2e1d6fa3-27e1-436a-9ebc-0a24b698adc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415293, "uuid": "714969b1-077c-4643-bdaa-18fcc492700f", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403e4311-4c78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778421478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421478, "uuid": "eaf63158-cc89-4d77-ae20-30c5485ae453", "comment": "Malware payload", "value": "60f972ef2f506645b35b7a33cbae476d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421478, "uuid": "e20174da-92de-4f29-8e60-41fd2acdc3f3", "comment": "Malware payload", "value": "1ae7e583f0438f67eab7b20800568a67e9c0ab1f9cad5ac67b95169bf822a678", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421478, "uuid": "cf499ab2-71a2-4508-88c1-843e9930ccfe", "comment": "Malware payload", "value": "5380520c98e86b79fe21fbd8e5c1b7dff9af2176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421478, "uuid": "a97fc4af-5aa4-4e6f-a4e0-83f64d0b9550", "comment": "Malware payload", "value": "d0685f45f55aad0c311fd8f4801ef3bcb39f8eae670ccb93a14b951a244d13fa09170235821664a7a9a1778c5a997f6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421478, "uuid": "2bfd39ba-4cb4-4739-b50c-f2dbf7121640", "value": "T15D761957B8924942C4E43A37B9BE81C432630EBA8BC712576D15FE383EBE5D90E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421478, "uuid": "57faa086-4210-4dd1-884c-6b2d345cfc13", "value": "49152:ERTn9+hnm7xf/bZ9GUQsKqsOtMSyK7BV/BJtTpiB+MuF5EP:El9b7xf/bZ9GUQs3LVpJtdiB+xEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778421478, "uuid": "8ffe8a78-3010-4128-b2f5-272c2fddddc1", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778421478, "uuid": "55de70a5-86ed-45f5-b059-8ef9d780950b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421478, "uuid": "2198f6a8-6816-4740-a222-f239a877ae2f", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9602539-4c90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778432096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432096, "uuid": "9a36d078-c631-4156-8e1d-4d15f7980169", "comment": "Malware payload", "value": "68fcf1b0aee7fb5ef4367f4f6d7b5b66", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432096, "uuid": "25e3f350-c6d6-43ac-a326-754c5417cddd", "comment": "Malware payload", "value": "1b963ea63828c83ff15a12fe84ff83ab970e02bcfb9996e5835052e9537224c3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432096, "uuid": "014256c5-9154-4570-9192-56e4716841b3", "comment": "Malware payload", "value": "12d589e04eafe6940ac26c27dceeebab9599d506", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432096, "uuid": "ebea2b74-41e7-4490-af25-dac8a3b21570", "comment": "Malware payload", "value": "a5cd8ef5fb78a640fccb9e2fdc6050858b3e237ae9e7706a73b0482356e1f6c21a6d16f7f2525de06e9ac480edc97d86", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432096, "uuid": "dd9497d0-d5c6-41f8-a468-594ce066489b", "value": "T12F968D07EC9155A9C0AAE6358A729253BA717C485B3123D73F90F3392F73BD06AB8750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432096, "uuid": "e16394d8-aeb2-4fbf-bce7-b5f05e85894c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432096, "uuid": "11a9d503-4686-4a29-92d2-88ac4b1ce180", "value": "98304:eoM7vbdbj6O/qZqwTtuwvvEw9AS+jNXPXskV3eJ5svhUE:eoMLbdbWO/eqouwXEAAhjNfcCuwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778432096, "uuid": "6a2c4add-4afd-46c0-8fba-bd3ddc79c3dd", "value": 8744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778432096, "uuid": "56afb0cf-59b3-494f-a39d-f2cbee1cd438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432096, "uuid": "1f2de2f7-f0e3-4384-b258-d65e5d23f6cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a505310e-4c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778438397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438397, "uuid": "1ae95bf6-2ea6-4c70-aaee-17f5b96ffaa4", "comment": "Malware payload (Mirai)", "value": "34b09cfa84a398bf370751b37594df2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438397, "uuid": "3cd25c70-9065-4566-afee-265dc4f85deb", "comment": "Malware payload (Mirai)", "value": "1c208b741db0ec0d9278bdb1505a16abed25c5ea0e94d1d1c0187856739bd557", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438397, "uuid": "ab2f9baa-b4e9-4b44-abdc-4ffd3ddb8d38", "comment": "Malware payload (Mirai)", "value": "e9efa331deac13b5e58eda67520d5ab238ebdf0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438397, "uuid": "40c49235-3150-4db2-a3bb-1068edfb9702", "comment": "Malware payload (Mirai)", "value": "542eb22ec5b8a39ac846a25118cae8c6e3530f29205271b7372b8bd2f3d9492dec7dd340aa6d87c9ce0c9f6d78ae17f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438397, "uuid": "2ba9fbdc-7b1b-4ba7-83be-73464c202a88", "value": "T11026286DFC0DE452EEC863746BA187D232397C84CF42D6136221FA6EB5F73949E52122", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438397, "uuid": "ab0a4de7-4a0e-4d94-a59b-c48abfb9fc03", "value": "24576:8L9aBkFeereoGtZb4hcp9scEZJn77TBWJYvifAOXEletssv+mXk59yjy/7j7rfLe:8oBSrApvYKrkosgC5E0T8+I/0qQB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438397, "uuid": "9bd1b390-f3eb-4013-a40b-3110b8301b4a", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438397, "uuid": "a8fcbaf4-2d16-41a2-958a-c8954009f78c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438397, "uuid": "ed032715-86d4-476a-8756-b10c8e2a8b35", "value": "android_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7baf3f-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412457, "uuid": "1122bb01-5163-49ca-b635-19d62549d14b", "comment": "Malware payload (Mirai)", "value": "5793e8ef156e24614c017a2ac45f405f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412457, "uuid": "3afe3d72-b858-46e0-8a4f-ec160d9dec20", "comment": "Malware payload (Mirai)", "value": "1d2fb9e62366f88b3b9a9906393abc00fbcee3c3853ee9b42b0ae87955b90c5e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412457, "uuid": "5bc1a629-6017-4d6d-ada9-1bbc171f2f68", "comment": "Malware payload (Mirai)", "value": "439f26db343421b878f4aadf7e42b236e3eb2dce", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412457, "uuid": "9a17205b-3c59-456f-9e16-84686e50111c", "comment": "Malware payload (Mirai)", "value": "127f8e82edf09d3e5118861d5d740984098cf024e84af5232c0cf19adf22b6f939c9808f73c0d76f7505eb7521471b43", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412457, "uuid": "0dce9479-1442-4b6d-a790-ad64edf2e4fd", "value": "T10EC345397F11BFAEE678823007F76EB0975526D636E19240E1ADD7085FB024C189F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412457, "uuid": "52b27f54-2465-448b-ac91-eaa2be1b4f9d", "value": "1536:+lpvhXdJaITBmoKReQjWEAPwE/E01esnWz60nE+E9cz6NeNxNMCUTmeCGTRWa8/+:+XdDvOeTRl8/wci/BAHjhCY8HFMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412457, "uuid": "b76327cb-e1a1-4e86-9efa-b5d4406bab26", "value": 122204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412457, "uuid": "69ad5b0e-dc31-4800-af90-1cefa57bbd5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412457, "uuid": "82137174-71e8-4484-af8d-ee678f1f04f5", "value": "xtc.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afda049c-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371414, "uuid": "a43a59c9-f09a-4047-abe2-24b115cd2831", "comment": "Malware payload", "value": "35f3319929668e72940caf8b6f76532c", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371414, "uuid": "4a4c58b2-dad2-4b46-b983-49833f19a3b2", "comment": "Malware payload", "value": "1d52581841083f397e0f61054e0e1b4da61a9a66918961f43adc36335e9b7d67", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371414, "uuid": "9840b774-8e14-4196-bb43-338a06594d29", "comment": "Malware payload", "value": "c08b25bf396450002cc3ae6b6aaec727094e8ed9", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371414, "uuid": "7cea17cd-993c-42be-802c-a6c25faa4ca6", "comment": "Malware payload", "value": "7ff6ab6d0b4658a4a38867cb9c848d39dd7c9e1a2425e3f643a8774a5dbc38631836848809e5d9169093e349fc56edd4", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371414, "uuid": "7c13bf0e-87e5-49fc-8daa-f70cbdb2cfbb", "value": "T175054A24BBF9661BE17F5730E573082813F2A083B661C74F4E41A94E1F67781AE167A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371414, "uuid": "2dc31816-8e2a-4063-bccc-3cdb6728d2cb", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371414, "uuid": "ac1c43f0-2be1-4ad3-ac97-f36d1ff3e1be", "value": "6144:nR6QnC+IxZqLyTacXaaag795FCumk75ucQqxo2ZqjnlpnyZFyS5GTV7OPa/6aa6r:nBn4jq9cZFgnvwFN5O7Oi2BF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371414, "uuid": "b458e3f1-13a9-4ef1-a77c-e77ac35e1377", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371414, "uuid": "33ef1f20-e45c-46c6-a21d-d4609622d2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371414, "uuid": "647fff0c-767a-4f77-9999-9efb9c7da059", "value": "1d52581841083f397e0f61054e0e1b4da61a9a66918961f43adc36335e9b7d67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fbb764-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371283, "uuid": "91dd4c9c-b37a-4b5b-a4e1-0dea79f77e63", "comment": "Malware payload", "value": "746e52eeea6cc18d5f62525218422f46", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371283, "uuid": "676dfea6-ff7f-41c1-9635-370c56f63a10", "comment": "Malware payload", "value": "1d61726a656a2984cea745f935e1b7b504fd43f77a15b59bf3bf97d5a852b038", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371283, "uuid": "cc8f06a4-d353-498b-9d8f-71341166a629", "comment": "Malware payload", "value": "d28dc3e0bcd04ae8fd21c3e0250d6437d6788efa", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371283, "uuid": "d9d44f74-b646-46ac-8af6-243b121ee6b4", "comment": "Malware payload", "value": "8b7e3c9935192b0c4520c56492b41f0a065e8f249dfc060ffd0676be617e8ba541fca305c0fa75b5f1c0e6fe4488360e", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371283, "uuid": "8933b745-96d5-4a7f-b2f9-eaa953e44e74", "value": "T1DF25282477FC520EE1BF5B39C6B25C9A17B6B8936A15CB4F4D02640E0E62B81DE52373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371283, "uuid": "9cdc15bc-f1b7-4f80-8c54-e9045bb630ae", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371283, "uuid": "4f154b2f-3f80-4403-9219-c284c7c53a63", "value": "12288:eT1a/XErjTiFc9aI311FeU2yIj7QjFcFwjxjBYHYm:sWXM9aI3HFeUbq2cYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371283, "uuid": "7a0009bb-ca0c-44ac-8af0-277124a3d58f", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371283, "uuid": "bb35c206-482c-41bb-9ff9-74112ac120b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371283, "uuid": "1d6d77db-de4a-4f68-b015-aeee2a7a0693", "value": "1d61726a656a2984cea745f935e1b7b504fd43f77a15b59bf3bf97d5a852b038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e592bce5-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389543, "uuid": "aa03f7f3-f5cf-4dfa-bb6c-416f21dfb15a", "comment": "Malware payload", "value": "4ea45a515dab27b9b96ec1768b856d8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389543, "uuid": "84f9f11b-4c5f-4097-9ade-544ee2db0674", "comment": "Malware payload", "value": "1deba6ff2b02a7ed39ee87e88dc598a0f14a8c9808b1b45bd1277b495a0aa3fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389543, "uuid": "4cbf296c-1995-4aa9-804d-80c310be0fef", "comment": "Malware payload", "value": "fc5e956804cb8d412b0000c5b50eebd8a1eab69a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389543, "uuid": "f919d37a-99ae-4fb6-a3df-acd5c7e29a2e", "comment": "Malware payload", "value": "f237331346512a1429a57711a3647ebc1c89be5674cf6b45b28b2a1cb128d8fe730d5a14732e5584100f312e96dcf078", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389543, "uuid": "a4ed552f-b253-4334-80fd-52201846a62d", "value": "T102064C80BB08D26DE95B0A3248270F7473A12E46D5F0892F531EF75F06B26E7990FE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389543, "uuid": "25999098-2f59-4576-b5b7-4919f1e6b70f", "value": "24576:G5a6kpe33H7s+i5wZu2VE/h1keQYvwiPKMrXY2IEgmvHggJSaiI92dK09JlezgDS:cCk7s+42VajNIiPKMrXY2RjvAflrPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389543, "uuid": "d6095ff1-8d5e-40ba-9525-3ef8b0939e47", "value": 3932160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389543, "uuid": "9a9381a5-f7e4-4abe-b36a-5038a827c080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389543, "uuid": "f6395dca-28f0-497a-8283-dc057f71cc1b", "value": "linux_ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de57a32d-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389531, "uuid": "96f3e547-fa5c-4aaa-8ad3-ffe592af6632", "comment": "Malware payload", "value": "78a1fd0e98b0f86aa8953781a79e055f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389531, "uuid": "15a98d72-07cd-464e-8af6-5370971d8a22", "comment": "Malware payload", "value": "1e85b6ecc131aa5779776c5ded0cadb2ab5232289bcf73e5ba42c3aa6fd7cdd8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389531, "uuid": "7cfe6d7e-1047-47a5-bfa9-a2884906e98d", "comment": "Malware payload", "value": "74067b7b5220c795f3f2aae96e603912502c7654", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389531, "uuid": "ce345a83-a417-446a-b75a-e31922203d31", "comment": "Malware payload", "value": "2279a5ffff3b740527e27c0a3b84a5682fa344e164cabde655329d2245b565d1dbccc132e8a1b487d648cffc6c4d15a3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389531, "uuid": "a28959ca-bc11-447c-a4f0-f5ddde15093e", "value": "T17A11FAC841E0704B96BDDD10746EC3065480C6CA3AFE7E99DDB4A56BD8C9111E07CF5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389531, "uuid": "ea3fc6a1-6fbf-45f6-933a-5f850f1927eb", "value": "12:3J3jfbX3Axjf5aAxjfCKAxjfGVoIAxjfWKAxjffN3Q3qxjfjJxjfZXxjfm7OxjfY:3J3DbnM5aMCKM1IMNMRrZ9m7SdBcfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389531, "uuid": "396d15f7-f695-478a-94eb-0b87d8ecfdc9", "value": 912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389531, "uuid": "d324ba39-9141-41b5-8bf8-40f951ebe983", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389531, "uuid": "031af08c-6f8b-4a46-86c7-4d80347f36cc", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c9d61f-4c96-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778434563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778434563, "uuid": "29d58a0e-ecaf-46df-a100-65270a519eb9", "comment": "Malware payload (AsyncRAT)", "value": "21fe3e10589f6abac8be95cd4d9e9c12", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778434563, "uuid": "089ff573-9d93-450b-90a5-0aa42e03a7aa", "comment": "Malware payload (AsyncRAT)", "value": "1fa8719f420b8df0d7cef0da91a2385ba23137445c7f000542ed217464af0d82", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778434563, "uuid": "0260d7ab-a39b-41cb-948d-d8a733f43467", "comment": "Malware payload (AsyncRAT)", "value": "4d748d9d30762afff4cd92acc01f394188352d52", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778434563, "uuid": "cd1570b2-32a9-4669-bbc3-cc4643d352f1", "comment": "Malware payload (AsyncRAT)", "value": "f11eae668e2d5e2b3b07bb0403d6bd6e15a4a7bf59e644d122fb03f0b81047b2dfea7d1abf4da01ff573adf0a30bc75b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778434563, "uuid": "4e5ccc55-6ddc-43c7-8d98-99ac55bd704c", "value": "T1F6B37F0737988322E5AE0BF479B265FCC52FAD227AD7FB4A1C40315603336E65A115EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778434563, "uuid": "a5382a3c-001e-4fc5-a383-2f6fec7d47f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778434563, "uuid": "30ea6a10-ad36-4a42-882d-559618c46d98", "value": "1536:iuqOJTPNY72oKU9/bXXSbHQhATnZkdt9p:iuquTPNo2LU9/bXYUA6b9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778434563, "uuid": "b768672f-e392-42fb-81b7-10a8b232ddb7", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778434563, "uuid": "66e9e423-8119-47f6-8db5-bc4baed19298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778434563, "uuid": "52ae13bf-dbd0-402b-8bc2-ec96199cdaa4", "value": "Discord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10920896-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448456, "uuid": "5427254f-be44-4442-bdf0-805eeb66e754", "comment": "Malware payload (Mirai)", "value": "9849db42af0a1770b9e332404d96a211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448456, "uuid": "5b5a54f1-d359-4d39-927c-5f2302ca5d77", "comment": "Malware payload (Mirai)", "value": "205dd57eefadd7c7cb2ed303bcf04c6d26fa29607b8eadaf693fd60ae0f78588", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448456, "uuid": "190b7fdd-5953-415e-9780-6f3574c2371b", "comment": "Malware payload (Mirai)", "value": "8efdab0cfb10f4bf2f7946bff00884060329c84c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448456, "uuid": "b8542fc1-6fdb-43e9-92f1-e1c6855626a8", "comment": "Malware payload (Mirai)", "value": "59a3e5920ec1f0357256f1190e652d071e5eee4eeb774e601467d90b66f17c34d78a0450d8819f6fe53ff6112f5c0718", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448456, "uuid": "026fc03d-9c4b-480b-847c-38df3b050b80", "value": "T16BF2F121F687D92EEBA7FFB0AD82D6E8FF5A4F1DB365C840119CDA114607592241EDC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448456, "uuid": "4c4608d4-607c-44d0-8fcd-b97275fa32e3", "value": "768:sk9hrdmlHU+zafgbM1m2fThyptALUWnTnAcOAaqy4uVcqgw09Y:sk9Nd6H7zBI1m2fThyptAQ4nAc6qy4ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448456, "uuid": "efefc32f-07dd-4830-920f-c484d756eeef", "value": 34324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448456, "uuid": "e6c831db-d8d5-49be-8b50-4d87237a851c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448456, "uuid": "39995ff6-c139-4610-b78d-43d3bd451d77", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659eff0f-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371289, "uuid": "236b8593-3be8-4f90-bfa7-7dda98b419ac", "comment": "Malware payload", "value": "34897897554ff2eb0e4e58172c0a3e7c", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371289, "uuid": "d97626ba-0fc5-431f-932f-cb8f8a065e21", "comment": "Malware payload", "value": "206681cacad6611887880bc83dda75cbbad4b2c9ae9c301e3f45df27cd94aee5", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371289, "uuid": "a855d026-7fb2-4509-be39-bfe60eae59fc", "comment": "Malware payload", "value": "ac2b1b27819d58773df408f0e6cfc3532919bce6", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371289, "uuid": "047d487b-b8f8-4f87-8193-ba94c5fc8671", "comment": "Malware payload", "value": "af989fb76e996f3deec94c00b38704cc92727a89482ee26139abfc9095dd842b88f297c743f6e5b289e4b99c0c52d6bd", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371289, "uuid": "101b020c-0b42-420d-81df-07af528a0958", "value": "T1EE257C0477FC671BD23E4735C2B38C2953F2A0935A61C74B4E96E84D1FA6781AE126E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371289, "uuid": "cb3e19f4-fa24-48ac-9a7d-a277ecd01b5e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371289, "uuid": "865e0a4f-1a5a-471e-92f1-14ac547d2658", "value": "12288:3pJD3VNdFrjOo4AkXEPaaVPj4AkXEPa6u8AxpZwfFrjOAD:TZ5j74AeE7j4AeE5XJdjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371289, "uuid": "1dff9ca4-d2dd-470d-9b34-72c968400ab8", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371289, "uuid": "7c08bdd3-301d-4bc1-a02a-baa56cbfac70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371289, "uuid": "8e7e313e-ae54-4964-a4d1-0023a264c28b", "value": "206681cacad6611887880bc83dda75cbbad4b2c9ae9c301e3f45df27cd94aee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4dd279-4c59-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778408105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778408105, "uuid": "dc341885-6253-4aef-9160-9dfe0b104cf1", "comment": "Malware payload (NanoCore)", "value": "fd9fddce6e80d4e63fabd257b1b106f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778408105, "uuid": "2a10d3cf-a214-4058-9274-55e6ea0301e1", "comment": "Malware payload (NanoCore)", "value": "206d7631a04e49e9536eb6249293651c76c8911dfc08cd33dff8df887344e7c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778408105, "uuid": "49b3f14d-9cb3-4256-8ce9-40386b9e2ea2", "comment": "Malware payload (NanoCore)", "value": "23ac4f24149e34f6c50b31500355b887914dc108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778408105, "uuid": "f28e44ae-1648-4c3c-9920-cefc8de787cf", "comment": "Malware payload (NanoCore)", "value": "0a015dbbe9d188999714aea5110b0dd4587e14e223ba97a84dd2a414c2be9e25505e2e0ae5f36a8eab51e94ad29c2bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778408105, "uuid": "cbcc1c62-8c75-4333-a3de-ba9c3d68b648", "value": "T13514CF2537E88A2FE2DE86B9711201569379C2E398C3F3DE28D455B79F667E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778408105, "uuid": "667e518a-9a9d-4858-9dbd-60f936ebad4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778408105, "uuid": "c73608a5-935c-4744-a4aa-c5839e60da30", "value": "6144:MLV6Bta6dtJmakIM5ZcGLYiO5C3e6s7338vSM:MLV6Btpmk8YiOS1k3TM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778408105, "uuid": "a4e2f1d3-7f29-4cba-853e-0e5d7aa7560d", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778408105, "uuid": "9608313e-2fa6-491b-ba02-a6c3e194ab91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778408105, "uuid": "e2f6d83a-359b-46a5-8ddf-1b7a2bdb3daf", "value": "hotro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ec099a-4ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778438662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438662, "uuid": "c41c1c87-b3c8-4a9f-8f83-6612b430507c", "comment": "Malware payload (AsyncRAT)", "value": "8f8743131055e1e181f7d7c4ff527065", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438662, "uuid": "d57ad6c3-daab-49ed-9b77-53820eafa5c7", "comment": "Malware payload (AsyncRAT)", "value": "20da7c750b4c1162896320d3381121eb4bf71a19eee85234e9425d78c92c865c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438662, "uuid": "35f89260-25fd-4c7c-9654-4dfd27b956d1", "comment": "Malware payload (AsyncRAT)", "value": "92ac3b84d67138f1c98d3b6a9764263550f63dad", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438662, "uuid": "92baa860-c81b-4cbc-82d2-ff9190635256", "comment": "Malware payload (AsyncRAT)", "value": "175d9f9e763b0389c8cbe717736a6b5b955171c788c38702bf8c5cb0f02218aa5c28f1875bb0c3976f9c565a2470d487", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438662, "uuid": "086600af-013e-42f0-b166-2caf4e3b4442", "value": "T15CF38A01E0E4AD0ACFCF623610F8DB059590B94EA1779188B9DB60E719FEBD4DCD32A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438662, "uuid": "22254022-293c-4b2b-ac8e-56bca2b98cf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438662, "uuid": "ca9dbdfc-57d6-44d3-80eb-00fe516edd21", "value": "3072:gKqV65eA/58HvPiWgA5TZ0rbU6MzuXDE478n0IuLG3qT:jq65j/58P6WgA5dkbLMzmf80IuL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438662, "uuid": "0ebde82c-b5c2-4da6-b09a-966c284fae5f", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438662, "uuid": "a2fae203-2f66-43dc-a483-34ed98aec437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438662, "uuid": "792f9c6c-2e74-442f-9ed2-80a6ef3c2c4d", "value": "kop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00aa65d4-4c76-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778420512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420512, "uuid": "776a6c36-af70-47b5-b6d4-eb7b84564815", "comment": "Malware payload", "value": "5a4a839a2b0af6b6e375c0d9da557ca8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420512, "uuid": "68a71317-882d-4970-a227-9efb5af78f9d", "comment": "Malware payload", "value": "222f2b5de0c9e3dbaaba95c7be6b7b152d40c17264c6a2ff3a4a9351539c19b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420512, "uuid": "c5dfe2ad-578d-47c1-83c2-50fae84471f3", "comment": "Malware payload", "value": "10699f95108256fed569d2fc4f67d0ca9291849d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420512, "uuid": "64c3522f-58ab-43a4-95c4-85f52547133f", "comment": "Malware payload", "value": "19bc0431c8355749e2eeb1c2cf534cfcbb54e8144bbb0decf37989eca3733edb135e68dd9636e0ac8cfcdc3a656ad827", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420512, "uuid": "55134784-a22a-4bef-ab4a-50ccbbd3018a", "value": "T167B2E0F1F8ECA436369D453ABB9CA805A9CF7C2F4DAB7D2014575938411CB1EA019B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420512, "uuid": "01c18ff3-35ac-4da7-8a02-cf407f2ebe23", "value": "384:MVc3s1oisjsKG6qkSgjkjV/A4UAcGE3JNRhQuW57:3shUMkSgjkjVdUAcd3JN34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778420512, "uuid": "09851207-0497-4abe-a5f8-f6e5ac062a97", "value": 24263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778420512, "uuid": "28831d23-98a8-40f3-9bb3-01008257300e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420512, "uuid": "c0de1362-d21b-4037-ad91-0cb6da8631c9", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea48482c-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389551, "uuid": "a781bf72-adc6-4866-ae32-691b1d6efe02", "comment": "Malware payload", "value": "dd1873a2643e0ae069be9c06f019e70f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389551, "uuid": "bc7637dc-7a9a-4374-9323-25ff34e7fed4", "comment": "Malware payload", "value": "223e176c965ed6a99eb49c0b2bfd6c597f622c4975bb5fe315b82828129789d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389551, "uuid": "131ca209-052f-4062-b07b-5220938b33a0", "comment": "Malware payload", "value": "b2ec99c270b6aee5ad8ac133c1fb9491a4e64e3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389551, "uuid": "d060be1a-2d4e-4f6a-a994-915d5d918e70", "comment": "Malware payload", "value": "0c6481a6f8a81c453d3c52d70399ad6d8bb3f4fff4d5549abdccedf5a6feacf29a1d09e7c7f8ac89f1273eeb5c83d399", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389551, "uuid": "2c7c84a6-96ab-41af-aa67-8b9df31db867", "value": "T1D32618517F44EE5FE2A821349AA7C23873C57D04C6E036379726F7192FBA264991BCC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389551, "uuid": "0c69f301-af0b-41f2-915c-32eed7f0b4f5", "value": "24576:NUPeIylsgTiCS6s82qr39vho93yAbj8lPqhZOJgUumWiv:NUPeIVN6s8H3c9iPlPAZO2pi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389551, "uuid": "f654e20a-99ee-4a0f-9205-573085e25e35", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389551, "uuid": "40bd3e66-94ba-4bcb-8243-c84b824f8994", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389551, "uuid": "8d8d6824-3a3c-4b99-bd4e-1b827b8def0d", "value": "linux_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4028a148-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412458, "uuid": "5b1be896-017f-4d47-866d-2d46a66e8f76", "comment": "Malware payload (Mirai)", "value": "9a0309875b1f8621c5319260be570804", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412458, "uuid": "8f727c15-10ee-4eaf-8ce8-045987537fd0", "comment": "Malware payload (Mirai)", "value": "22ee6a56690aaa637dc669309b264cf59a7e18677fd73850702673da7323b914", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412458, "uuid": "4d61c923-12ac-45e8-bb29-6dba8a83785b", "comment": "Malware payload (Mirai)", "value": "0bc0befa8d9103675ffad8aeb30329289933ee06", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412458, "uuid": "d58207dd-689c-49b2-9a40-02a064187b2b", "comment": "Malware payload (Mirai)", "value": "5c5cf3cf952d0c7d055a5f0d0b7a84d070527b51f53e82a871d7b5dfd15eb372a8c1b01a5be17bd7e7cf6c0154c4381a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412458, "uuid": "2d510fa3-9979-4936-9810-d8b7dfae1b70", "value": "T15A730ACAA962AFB7C005B4F078F95E79075EB8565A1F09D96439D6E0034F5CBB00F3A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412458, "uuid": "7dfd1840-e69c-4b15-9e11-22f6d62e1efe", "value": "1536:A1vqHuxuZRg5YNn1PXVleSKpNle7x46RXACaqC1GIf:A1vqpJXKVpS3XAQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412458, "uuid": "3cf2f3ff-be77-4c71-abe6-64ce027c60e7", "value": 76168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412458, "uuid": "34576cb2-3146-4f02-a75f-c71e5ecc1068", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412458, "uuid": "96c33db5-3eaa-4de5-a514-13b24ab3b8ca", "value": "xtc.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b65b92-4c4c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778402854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778402854, "uuid": "465b6e72-d3cf-4345-bb72-7d2445cb7310", "comment": "Malware payload", "value": "180e6b1049af8d2b678bc52f01c9ffed", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778402854, "uuid": "8feb5fb9-5eb2-4ee0-9276-5d6f5516b11a", "comment": "Malware payload", "value": "2398012e1899ba2d9f81337b9769ad8150c81708f57ca107d17205001479541f", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778402854, "uuid": "89af444c-c2fe-410d-8fa2-30d101dd7792", "comment": "Malware payload", "value": "b03b48baf7ee369e2378f8ffc21c0b81aa1a23c9", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778402854, "uuid": "a9b926d9-8a9b-4d9e-beef-338813d6e908", "comment": "Malware payload", "value": "174a9424d4ff85520eef19e8669a5c64f43af306dc54b801c2cd6b54abc5afbe1a6b5ab13730edc21b799465a5b73879", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778402854, "uuid": "baba6140-2131-4637-905e-d2e445a4aec7", "value": "T10BF5337D3BD506ADCB7C803D4A7C9E1A761B96E6EB0FF39A1A4D0244712139C4DE702A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778402854, "uuid": "e0839d17-807a-443d-bc51-d9a8f5bd1ea4", "value": "3ed54f968889d2bf289bb98b554cce63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778402854, "uuid": "caeb8f6d-3062-464f-8587-7c3ac37a1828", "value": "98304:o85vGF8YdCVMfg9nSNJWKbaysFE5nQy3TiXy:RNVIiMfgA7W8sknrDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778402854, "uuid": "22c09526-1cc9-4a02-a9b3-09c2d0bc41c4", "value": 3440640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778402854, "uuid": "4875c95b-bd69-4122-95af-59cd92f49187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778402854, "uuid": "b072060d-5838-447b-9761-5962d8c18e47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb355b9c-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389552, "uuid": "34f45c3d-0b91-448d-a47a-7d8b9a21f2c5", "comment": "Malware payload", "value": "5ce4b2d43e4d61fe2a59093608d48aae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389552, "uuid": "fd116116-f91e-454b-be28-c02974364d4a", "comment": "Malware payload", "value": "23cd612541bc3aac8e2157b00cbf147255e7a6a20ff233b52e748cd0a1bec9f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389552, "uuid": "ddaf0b24-f701-475a-a7ef-5c7dc6ecef25", "comment": "Malware payload", "value": "c899dcd7fc12f6a53b9e300443a6dbd422d29e91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389552, "uuid": "204e095d-a7d9-4fcd-878a-8321d1430558", "comment": "Malware payload", "value": "853c878fb4462c7d5c4bbe3cc933a566be05104990d62316c10ec976f722053c453c7f4f71ca5560d80e93809f917bc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389552, "uuid": "ce70e9b5-fbba-4dcb-aa15-0d714bd319bb", "value": "T1FB2607573A68D70FC76811385872CE94AB3D2C8945DAA917B341F309B9F21AC49AFCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389552, "uuid": "0196e649-a377-45f7-9011-e2118217004d", "value": "49152:O6/ziONtzr+BtDcmAcz5n9NgcCrnjBF6n5h8sKrn7BFLeXwRqAx3ncyL73bb7NFy:p/zTroSO0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389552, "uuid": "bb2e2146-bb04-486e-ae22-e9a0240df643", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389552, "uuid": "3be2e13c-c9b0-4dd6-97a3-72e2d277a063", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389552, "uuid": "fedf9e7e-d12b-4504-aab5-ac2325cbc1fa", "value": "linux_mips_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebf48e4-4ca4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778440373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440373, "uuid": "6aaae0b9-3a62-4cda-bf01-a490569f1140", "comment": "Malware payload (Mirai)", "value": "f033d7b15e69b08cd03b6e44f13497e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440373, "uuid": "ef407b59-a748-4a99-b26d-054207c547ab", "comment": "Malware payload (Mirai)", "value": "23e37779745bb02c87070fc99facee24678c8bdf55ba67a75daef376c96191c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440373, "uuid": "b1bb0e00-0b29-49dd-b633-e7d745b975ba", "comment": "Malware payload (Mirai)", "value": "939b7d31c00cad0e4cf641c9934e17269c1fedb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440373, "uuid": "d5535479-9ec2-4304-8de8-566c194a150f", "comment": "Malware payload (Mirai)", "value": "7ad4ed954dc8f22bd3e5ab5022c0acf4275b61a5e21d3cee63e4d4ee56499469bec28a24b17958849dd31292f230ea67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440373, "uuid": "a9d523c9-3878-44e4-8871-701068a6190e", "value": "T12DE38C73C8792E59C620E5B0B531CF795B53A694514B1FBA68BAC3B48083ECDF2453B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440373, "uuid": "e82c600f-1ba9-44d6-b619-39bbecb1bc80", "value": "3072:84Bsgm4FB5Y7y5K9s7bnzV53m+jxwW6s/IHIrD:x6V467yQ+7bzWoZ6sEsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778440373, "uuid": "ef90d73f-abeb-446d-a2cb-920f74287475", "value": 154172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778440373, "uuid": "516af6d3-86fb-4481-9337-9722db30fb0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440373, "uuid": "05b40a08-3b06-4077-8706-1472d2dfa33f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b9ba5e-4c93-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778432996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432996, "uuid": "78c7ea26-c996-42c1-b56d-d252138ea420", "comment": "Malware payload (AsyncRAT)", "value": "fe550ecfe27e666e63de6c2e4b5d96d5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432996, "uuid": "fa4e4d6d-c057-458f-8965-f38b0472f9b0", "comment": "Malware payload (AsyncRAT)", "value": "23f6796eba20ffa6dc716278cd1ba92537f993690e93f474da0fd8baa331898a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432996, "uuid": "d00d72d7-2584-4206-8fe4-3997c21c911c", "comment": "Malware payload (AsyncRAT)", "value": "bae695bfd303e267bcf6cd2211cad28b915188cb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432996, "uuid": "0f8bdbfa-03ae-4bdb-a3fe-7902799f2f72", "comment": "Malware payload (AsyncRAT)", "value": "a39680add38d9a06ad061a55bbdf3d490cc519ead409c07ce2a9c885552a2717359408146cd420005a535d88f5c2e773", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432996, "uuid": "6dfa8094-2919-48fd-bc1f-9cbfa07b2154", "value": "T1BED23B0473E8C662E2FC47BB883396008775E5574913DB6E1FC890AE2A23BCDCA15BD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432996, "uuid": "20cc50d8-3ff3-4f8c-92c9-017477e30ade", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432996, "uuid": "610ce293-5067-4ba1-8a43-046c562be2f2", "value": "768:TqzRHaua5EeWfK2wIb1xBibnxfuXln+T+:TCHa75EjwIb1niDkln+T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778432996, "uuid": "646b9c47-3168-46ed-b6c7-f72b2687d48a", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778432996, "uuid": "8d8edce4-a6d2-4c7b-a634-c80c52603ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432996, "uuid": "936d6424-f874-4613-9445-dac00342bd87", "value": "AU88APP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca054e23-4ca3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778440177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440177, "uuid": "85660a19-ab34-4b10-a853-449740e01a5d", "comment": "Malware payload (Mirai)", "value": "9dbcdb60b923a0940693a24a7ac757ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440177, "uuid": "97ab3dda-a246-40c0-9834-51db5d14ca6d", "comment": "Malware payload (Mirai)", "value": "25835c443aae464af9bfb61e968be38faff5d4be07c839abef1ccbb99b005210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440177, "uuid": "e1d8dbc4-c066-41b2-b465-797cc9903b88", "comment": "Malware payload (Mirai)", "value": "04cc2c5db0b48244216057686d24bfa86717e31d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440177, "uuid": "1f3d64e3-07b4-4fe9-bcf4-240571daf41d", "comment": "Malware payload (Mirai)", "value": "92f78e8d4c2502b7d503dac1601bcb111669698a3e00d14a3547c2ec79785561bfb23656d31754418fc30b6db66d856c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440177, "uuid": "ae9fd9d6-65d1-436a-84f9-22f13d511569", "value": "T1BD24C70AAF610EFBD86FDE3706E90B4635CCA54722A43B393A74D924F50A54B49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440177, "uuid": "3a5bb232-04b5-4a96-9628-4047977a2c99", "value": "3072:Xi9eclC8lyGL6bQfhIAmPGADN4IIDzwkH5U11L1QYAaS:XigcDly6pfR3ADNbIvl5aL1QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778440177, "uuid": "3e658493-cb84-4b56-86e3-ad70e0e7c1df", "value": 228288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778440177, "uuid": "7e685fb5-de0c-4cb2-9703-6ace9a6a21a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440177, "uuid": "d6dc7883-af59-46c2-9242-26039218dcbc", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7094799-4c07-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778373144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778373144, "uuid": "2bf1b2de-b7d8-4c99-ac0a-06616255481b", "comment": "Malware payload", "value": "acca83942c3c3d962c0237d5a22d4d8e", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778373144, "uuid": "48b3190c-cdd6-44b9-9247-6a54677883ac", "comment": "Malware payload", "value": "2649dee7214dc737957254b86f25e0489baebb0631b64911e9e887d117a96042", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778373144, "uuid": "f47d5085-abe1-4fa4-bf8a-f3bb76241586", "comment": "Malware payload", "value": "941ae07697a3669f786984dbdbab100f54ccff6c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778373144, "uuid": "049ea054-8065-4c53-808d-12a9e3402741", "comment": "Malware payload", "value": "c4623500a227fac4e22ad3b6a7462f7aa763eb6338969bfcc00019f1933250a15abde3500d647afb40d77cc2836689a7", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778373144, "uuid": "366b6cfe-9e43-4842-8bc8-45ecd803c94b", "value": "T1D5D3DCEB559E88EC879F6018023F6D07C6EE5123495EC5907AAEEE913F13D7130B9AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778373144, "uuid": "e05b4dfd-6a4b-4150-989a-143dfbfa687b", "value": "768:kRLSNCk/JVvD0k2mfefKXMbCRm9940Whh6H0jh7p098PFWFQ10oihEhkKFamT9G0:LDdc4d80NgKxJ/Mwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778373144, "uuid": "bf526916-fce1-4313-b64d-43fa7cd7b042", "value": 138673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778373144, "uuid": "f7aede94-14c3-467d-9451-86257bf714fb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778373144, "uuid": "d8774fff-9caf-4917-8273-44b9626184e1", "value": "Notes_London__79.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f770f519-4c9c-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1778437247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437247, "uuid": "55fd49a2-0703-4255-8e0f-034a73c3e5f7", "comment": "Malware payload (njrat)", "value": "7653de8629e657dc33eee458688ec8b5", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437247, "uuid": "6ab8de5b-3835-42fc-a2e7-88c253845b67", "comment": "Malware payload (njrat)", "value": "264f2f1e6c9d09a332df26de494c112f24d020ce495324e4b5251b61cf722329", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437247, "uuid": "efc0468e-3d07-4776-95ca-ac11f1c7e44a", "comment": "Malware payload (njrat)", "value": "ef77216d96c9a3b5b0ec3aa158b88f0e2ed83321", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437247, "uuid": "efb85022-54e4-4ba8-826f-a36ba9d9cb1d", "comment": "Malware payload (njrat)", "value": "d24aa14953f0080a4a4bcef6d81f7cb7301b17e51a503f6852c221166c59bd9aeb03574a275484cffbfc3424f72543f1", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437247, "uuid": "a13dde81-32f3-4ae8-8dc6-fa1213ae522e", "value": "T120233C003BE98126E2BE5F789DF1114187BAF6633603D65E3CC841DA5B137CACA51AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437247, "uuid": "aae26fde-357b-448f-b180-714041cb846a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437247, "uuid": "587979d2-bf45-405a-885d-7d428740924f", "value": "768:1rq/z5bX/wPLsekOicvHk3eHlWMPbPgF0qSneOJjFYI6OCABtYcFmVc6K:1r7seXvZH0ub4FrSneCD6OtxmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778437247, "uuid": "924ac5ac-1d4e-430c-8de2-4bc926acac9b", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778437247, "uuid": "e529d082-cfb6-4414-a2da-b693f9d5d348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437247, "uuid": "e42d27af-765f-4b3d-9302-d78c7bcb09fa", "value": "OPERA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c5dd1e-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371296, "uuid": "516f7f54-0b2f-4ec9-935c-60cdc2914742", "comment": "Malware payload", "value": "e45848dbaf6c4976eacdfcfcf2fdb1a5", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371296, "uuid": "6568640e-35d3-496a-aa1c-8640b183b6b4", "comment": "Malware payload", "value": "27542daffa9be79d8c5dac335ceb51ffb46fe3ec179615ff406a78dcbb97b8a2", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371296, "uuid": "51274e6b-1a12-4500-a771-8812458003f7", "comment": "Malware payload", "value": "3bc536b004740052d9d028d05c428866f7e12a05", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371296, "uuid": "b562e0fc-fc54-4a18-99f8-cc9ca73084c5", "comment": "Malware payload", "value": "6ad4b5d571eb7c0d967654136c7da738c038f038edbd370345b5f623ca28651d9645f587ab9bd1699879b91a991de154", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371296, "uuid": "696fb3fe-1928-4b6f-b045-98b0ad7eb007", "value": "T1A2B44B04B3F84625F1BF1B35E67350184673B857AAA1D74F0D91A01D1EB2B80DE9ABB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371296, "uuid": "7d8c6dc3-35af-4069-adea-e75455841d26", "value": "6144:/eqPgMIU2Wohc1ssrr+I+fkD4eU4L7Y04XdJ/fX9ZJmSKx7w9buUpUqrOSN6cRkE:lIjWuchrAkD16HX3JmSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371296, "uuid": "dfbb8dad-2fdb-4a60-8764-b9782bba3818", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371296, "uuid": "e0b089a4-b38c-4ff6-9ef0-96ebb81558f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371296, "uuid": "2ebc7984-cb9e-4d1a-a029-80fca68b9dbe", "value": "27542daffa9be79d8c5dac335ceb51ffb46fe3ec179615ff406a78dcbb97b8a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e6b211-4c4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778403187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403187, "uuid": "0905d410-9f34-4de9-a7a9-11b58977f660", "comment": "Malware payload", "value": "1ecc3702b16bcc926be3c8d95dc06fd1", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403187, "uuid": "eb3bb972-93a5-4c23-9f04-a4a4ef9249fd", "comment": "Malware payload", "value": "27984f24969cdafc6c2eadce6668bc0dba993b090d9b008ae1c92bc7ba952069", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403187, "uuid": "9979019b-fb6a-4d03-9a6d-755d97a9dc26", "comment": "Malware payload", "value": "9238d234eb837112a8811f351deb68ccc68aa402", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403187, "uuid": "11cd975c-a1be-46b3-9cf5-4e2beb24c0b7", "comment": "Malware payload", "value": "97687162c229cbea005b1c164fe5858337a1e6b698e6798fcb23a1924c8bf3c727a0cb07e4f6d56cd50ac53a71c6960f", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403187, "uuid": "417ef7ef-382b-4ac8-8b09-2c3ec5cea83a", "value": "T19CB09B101460563DCF4FCE158195C2124C293005537541D175314514790456DD316545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403187, "uuid": "9d51f71b-d2c6-4507-b26e-7a42180d4752", "value": "3:VSJJFIGFGMFI1oM3KAJJFId1sqPJH0cVERvBuIFqKcun:s8GFGMFI1R3Ks8zsO0cKgKcun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778403187, "uuid": "b7964a6e-7975-4b7b-a004-79e103681e20", "value": 120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778403187, "uuid": "9eb8f145-7021-4247-8e31-083411f9db45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403187, "uuid": "0a7f3139-bea2-471c-858e-e674e31fffcf", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9974b8-4c72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778418952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418952, "uuid": "d3f0607c-3b36-44f8-b335-a47b49e74d87", "comment": "Malware payload (Mirai)", "value": "a45d67ae06271133661e1b729dcdfc77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418952, "uuid": "65ff0795-74d5-478b-aec4-17d6876622b0", "comment": "Malware payload (Mirai)", "value": "27d62ffd5e6487f70520209221eb167827287d8f48cee58376b2a751335221cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418952, "uuid": "ccdd93d4-2d99-41d6-8c09-a96f595a6956", "comment": "Malware payload (Mirai)", "value": "0f54ead21e583d54f44ab0a9fd6c49162fdea0f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418952, "uuid": "79e74423-0428-40e0-9a16-bdf544e2c306", "comment": "Malware payload (Mirai)", "value": "a033e0108a187e9653b22bbb79fe36e195ead751fa035052b8f69fcc1f17314ca8d6e9085bc8a7c735dd5107c79aac3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418952, "uuid": "abfe7fc8-e1c9-4749-88ee-1d88f230f1e8", "value": "T194C35C938313D5F6D8150931E037E736EAB9C52A512AED81E3ACDE34EC96E0285237DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418952, "uuid": "5b3ea2e6-fd49-4407-9374-fa9f9690af52", "value": "3072:dKoya3DgNc4gO07lfzlN7gUcJrvPrD8YdJVSQVzBp:Eoya3DgNc4gO0NxN72JbVSQVzBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778418952, "uuid": "84824664-2bbc-4969-a1f9-05b291cd0558", "value": 128844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778418952, "uuid": "c791a247-0763-44e2-bf98-1172320a684a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418952, "uuid": "c386a9f0-adfa-40a9-8bfe-074482efb477", "value": "debug.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2e7ed1-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413690, "uuid": "0fb2bff5-66c1-482b-aa64-fc89cf892a07", "comment": "Malware payload", "value": "2d7f669689a6bd333a230dda2a1b3487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413690, "uuid": "17a2bbbc-22e7-47be-9b94-f9ebf04d3179", "comment": "Malware payload", "value": "2813fdf8140b523f241f39aeb0c93917657a7dc0937202075703ee33d6d5ebfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413690, "uuid": "0782c29e-4aef-4a28-9103-8402d3f3d100", "comment": "Malware payload", "value": "1c7284cbc21b5b968fee1c7791acfe77cd1eedd8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413690, "uuid": "aa239a0c-4e3a-4256-a697-f49023085b38", "comment": "Malware payload", "value": "1b405fb1267a5d81abb363e7a63b2bc34e3a6307509b1481f01ee3b7650232505ac129d1cd113591d011cf00d9d41fc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413690, "uuid": "7017d7bb-df12-4ad9-9dc9-78d319d349ae", "value": "T10C560857B8D24992C4E83637B8BE80C433635EFA9B8652566D05FE383EBE1D90E34714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413690, "uuid": "28a9b45d-a4db-4609-ad29-c6b62c62693b", "value": "49152:OxC1ER/PO0REwH/obas3r040CD4aK2Od2yg5EX:ATbB7UK2OduEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413690, "uuid": "66e2c6c5-9455-4d14-954b-b28815dd398e", "value": 6226068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413690, "uuid": "403cf7f9-4fc2-4fe1-aeb6-fbabe591f23d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413690, "uuid": "b2c775c0-136f-4135-9676-a050ac1945f4", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2cd03d-4c6e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778417335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417335, "uuid": "e9c1e0b3-d84e-41cf-a2a2-84d75d82973e", "comment": "Malware payload (Mirai)", "value": "c3a4f0eee4556a956e55219d294cf262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417335, "uuid": "3ca9db8d-adb8-48ee-ad27-6a322f9fc8d5", "comment": "Malware payload (Mirai)", "value": "28bc298aba9a2c8510dab45ba97f56a22bf21bc4a260e88e446da9d8c14298a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417335, "uuid": "8adab2a3-d097-4db0-9afa-d45a5d21cd02", "comment": "Malware payload (Mirai)", "value": "f73013b55ff7f9f84ba46b80a5d53a6256ef9d58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417335, "uuid": "8d59222f-e066-4288-867d-a574bebea49b", "comment": "Malware payload (Mirai)", "value": "22c093020edafd115ecb93226d6638cae021b29c7885cbdf192996ddde4440926cd9ab4376d4751a87ce235344a7c8cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417335, "uuid": "70f9b262-46d5-4126-a2c3-8dd95f8440ef", "value": "T153C35B96BA8084FDC589E0741AEFA172C4B1F1BD52787A9A33C0FF263D4DD405A3A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417335, "uuid": "160c766f-8861-46d3-abdb-6ace3caca15a", "value": "3072:vM3tFc3j53TmBON2ntThPtp912kkMm1/QNt7ZVG+iej8wpl:vM9e3j5jr2tFV3oYN1rGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778417335, "uuid": "c36ee38c-5634-4e8a-8c63-d0973e4dd832", "value": 125976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778417335, "uuid": "1904c85e-a9b1-4233-8220-681ece7fc1d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417335, "uuid": "4e70edf9-72f8-46a8-8511-0562508b4974", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed37047-4c71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778418388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418388, "uuid": "172bcdc0-58ee-4e86-9139-f290e1e93b5f", "comment": "Malware payload (Mirai)", "value": "7acdfe8c45cfdb19b7bb4b625182e56b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418388, "uuid": "4f4bbee9-86f0-4ebd-98c6-ce605b8d6da2", "comment": "Malware payload (Mirai)", "value": "2903832e570e9ae1d8d762008426e018af150d90465733bcc5c4b0c683cca249", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418388, "uuid": "2d740c1f-e569-4a6f-9ba5-cc5b0cb1fcdc", "comment": "Malware payload (Mirai)", "value": "b351894191ea69b0047cb0bd452132719c771977", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418388, "uuid": "0c538641-5239-4727-be0c-e43e9a95323a", "comment": "Malware payload (Mirai)", "value": "c06eed96dc6888e6a3cce0115ba671b2afcf21d1d74763c2927abf00977eff3af38adef09e980d681bc081a24eb499de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418388, "uuid": "b6c27d69-2c58-4188-bc4a-d5c3694c408e", "value": "T1BCE36B523AC180FDC549D1B81AEFA136D9A9F0BD2368764F37C0EE261C4DD604E79B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418388, "uuid": "ae24161b-d016-482a-970f-ef4e423ea771", "value": "1536:+l7y+RLBIc6Qw/vvtIXOeRzZ6QJYFjq4/uXKkrQJ86Ydh4uIM2aqF33/3fJGel9h:/+lB/GmnR4WoJ8Nh4uUaqFvf7lwR3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778418388, "uuid": "12623ff5-7ecd-4c2f-94fd-52c4e47847b4", "value": 146456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778418388, "uuid": "af0404c0-4ff3-4c24-8f8f-808e4756c93d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418388, "uuid": "386ecccd-9e58-4cc0-82d3-797785289705", "value": "debug.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c5cb85-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413649, "uuid": "2325264b-6c38-4def-99bc-942bf6fbeaf0", "comment": "Malware payload", "value": "30a6ffecdbfc82d1a251d2923d508dbd", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413649, "uuid": "56eb8b4e-81cf-4003-9ad5-aba5d5412db6", "comment": "Malware payload", "value": "2a55bc2026b35bab0ef9573a35522053b8d4404622d762b5adc3b49a8e0e563c", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413649, "uuid": "efc1d820-8a6d-48e1-a56f-dbc2f32e0852", "comment": "Malware payload", "value": "4bf68690e47c4cd6b14bf2a44998c950a0b2312c", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413649, "uuid": "a9a09906-5fb4-4a97-862d-191800ccbfa1", "comment": "Malware payload", "value": "d9c514355eeda81a5296f16598166a91d4af8234bfd3a9dc25cd04841fa1d063b825157174c175c5495ebfcf0ce1ed83", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413649, "uuid": "78b82c26-836e-437d-ac03-52cc58d2aea4", "value": "T16C8533FD6BEC762A9E1E5A33D7DF66D0960618CC0098831E051BDA76D072CA4BF9841F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413649, "uuid": "54f2185d-ba5c-4f8e-b9ad-cb484c02568c", "value": "24576:1t74gEq/5Qk4TPQQyb1cJa/StBTXUFlBpcPjYx15iyJBCgOv16+JSJGXhihCqO8B:15tn/aVPR4OB5YxXWJhWI8Q2C5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413649, "uuid": "ff98dd9b-c730-48f4-9577-f27c790bcda9", "value": 1776696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413649, "uuid": "d0532106-03a9-4770-bdee-6a6643707247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413649, "uuid": "20717011-10ba-4db8-aaae-6f9b70b106fc", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d8da66-4c64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413087, "uuid": "65fb70fa-3ad2-42a2-96c3-df233ba5c202", "comment": "Malware payload", "value": "c9104bd09aacb27fd935feb4278efdc7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413087, "uuid": "637535a5-f77b-4b89-ad5e-c9e214ee2404", "comment": "Malware payload", "value": "2aa11ed98b93031e1aff86bb86d04a467ea6e83ff8e6d1d5df7f9db992758206", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413087, "uuid": "9326c917-a97c-48b4-8010-d6f0e2b87f29", "comment": "Malware payload", "value": "167ca8c9998d33c6e8a7dc023cc387eed58810c4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413087, "uuid": "ac6e7ce8-71d5-4332-bf4b-73d6ca6641af", "comment": "Malware payload", "value": "96273523d8815e21f6e02f4336774b29fb967359797b94064adb2b35c9f70ab76d8b349fcdc765a991fe76d8a123a05f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413087, "uuid": "bc7416aa-f224-46e4-b966-4e71afd20655", "value": "T1A3865C47F89115F9C5ADE63086629223BAB17C495B3123D72F90F3282F73BD06AB9750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413087, "uuid": "b42cb1ef-9dcd-42c6-ba60-0f41e955cb56", "value": "49152:f7NqB5LoMRIW0GYsk3YjKwOQaaG5OTogc4CtB9tWX7WSBniWc5EYY5iYwfssG8IM:D2+zshvG0TonY/OEYYfrMTqfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413087, "uuid": "7293f7c6-e39d-4e20-ac2c-5d8145e000d6", "value": 8212632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413087, "uuid": "0e0a71eb-8b79-4f45-88ee-4cc5872dd02f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413087, "uuid": "04e332f0-b5be-44fe-a605-3be129d48266", "value": "sysd_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958c1aa8-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371370, "uuid": "08f1819d-4dc3-4a8f-990a-eea691d2f617", "comment": "Malware payload", "value": "c6d2ee0fab33db4471504b295c687455", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371370, "uuid": "d4f26aec-56c4-4a69-89cf-94212fe2c76a", "comment": "Malware payload", "value": "2ac32eebf495e33b5b5500cd4428d721c2f6f0658662491e5f58812358dd9189", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371370, "uuid": "7e79a211-1484-42be-b186-7e36c99d706e", "comment": "Malware payload", "value": "045de7565c26d984f8ff0c9f7d3d0faa041d48f2", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371370, "uuid": "45f12165-05d6-424d-9f36-27de9506abaf", "comment": "Malware payload", "value": "36e2f5abe3c25fe78e1f31d5fc16db4ad7cee543effb813617502a4da1a8a7daa31a3ea560a90e1a86cdd0909bffe32f", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371370, "uuid": "1a1a6472-eabd-4212-892f-82e0ea8545e7", "value": "T119944A0463FC562AF6BF4B35AAB34118C773B947D511C34F0D51A84E2EA2B80EE55BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371370, "uuid": "c5310ab7-0bd0-47e6-b7bb-c6e9137c0fbf", "value": "6144:Ap1b5ud9Srn/F/0I+pT/ui3YCghHO7c9b4ks0501jD:yudYFwaCghqjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371370, "uuid": "4a6d6741-d886-4bbb-88c2-2605bb6d284e", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371370, "uuid": "8e23d7f2-3678-4588-9511-c300c6ca09c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371370, "uuid": "ddcdd2eb-f0d6-4536-9522-ef0c874206f1", "value": "2ac32eebf495e33b5b5500cd4428d721c2f6f0658662491e5f58812358dd9189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11285a65-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778414097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414097, "uuid": "7de45500-ecae-4c51-bff1-23d179442427", "comment": "Malware payload", "value": "4ae7719b8158d38ff6daa9359287fcdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414097, "uuid": "61d39676-c216-4052-b40a-94a5b055929c", "comment": "Malware payload", "value": "2adc59e4787473cdad3cc9b39b2d1e94a1ce978929bc9150b9867eebad9e509c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414097, "uuid": "e99a640f-1a65-4fdf-a8ff-2bce7db9601c", "comment": "Malware payload", "value": "048daa0a5891bdace5bccfff57fdfc94f0e8d2ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414097, "uuid": "04517ee2-62ad-4d62-8936-5cc36c9ca859", "comment": "Malware payload", "value": "e39cb8b6b42d4fee0966347f08ebd50306e7cef77e9a658539b804493da0ccd1d2f7138863840872ff7c7eeba2d03c37", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414097, "uuid": "7bba3a19-a407-4139-b36e-ca21b15ccdaf", "value": "T147762810FECB50F6E903197144BBA22F63316D054F24DBA7EB447F2AF97B691593220A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414097, "uuid": "b8f5b92f-4e60-42ef-80f8-739411bcbb22", "value": "49152:dWp3yS58D0RiaYx8K8J5T0mrBcVRzNUxXKssKLgj4xxJwBgxmOioB86mnoxfNlJd:08S5qx2Jmz4tEjggOsaMgEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414097, "uuid": "79921ccc-a3c8-4966-a4ad-48ff2c29f144", "value": 7286968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414097, "uuid": "3a44762d-1d1a-44fe-848c-ed41a0729c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414097, "uuid": "b738ceff-3000-4c2a-80a4-13177002cd55", "value": "vulcan_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fcadbb-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371319, "uuid": "0e28743f-c2b1-41b3-9785-6e31f4a6f137", "comment": "Malware payload", "value": "57a83939885dd7ba9a1bc2e434a7b6bc", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371319, "uuid": "da49e2d0-8bff-41fe-b4db-6527a1b924cf", "comment": "Malware payload", "value": "2addb10b2d6d352c5585bd505c9ae1a74095b9da76b9fb8e45fa5d3c4591f80a", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371319, "uuid": "ab1213d3-ad62-4732-8c17-3b77122cf519", "comment": "Malware payload", "value": "47719dc96edb0f879b4f983d14dcf4d2045bc920", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371319, "uuid": "bb85ce4b-8769-473a-89a3-86680a4730cf", "comment": "Malware payload", "value": "b03fdcbd7e67811214d4353a4c2f7bb1142e66e798b35c9034805cb9a585f01e059f0ff74372ddf84e15c8844739e2ce", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371319, "uuid": "1f2ec003-16ec-4b0f-8fed-7c51a097b04c", "value": "T191054A2873FAA60FE17E4775E1724C6B53B274A36611C38B4D46649E1F63781EE032A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371319, "uuid": "6ccf347f-853e-4de3-b4b8-39826ecb5dae", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371319, "uuid": "5cfcbf64-1292-40b8-a029-00d0cb49f960", "value": "6144:4LAxAvUGW/WQUrAc395FRJmk75ucQq8o6vuUTwgCcG1ZQ+n02gyDmKraY4sf9XgL:rwia7Fc0sh2OWmFVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371319, "uuid": "b4354d41-e22b-43bc-b170-43d37c196aa4", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371319, "uuid": "b1ff79eb-69e8-4392-912f-3de0f479b109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371319, "uuid": "738f1b6b-9343-4516-9755-ae2ea14f1ca3", "value": "2addb10b2d6d352c5585bd505c9ae1a74095b9da76b9fb8e45fa5d3c4591f80a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0974bf-4c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778438520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438520, "uuid": "d820f1c7-5eb3-448a-8e6c-3f6fb10fdb28", "comment": "Malware payload (Gafgyt)", "value": "a35f16a0415a13c8ed71302df384e0cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438520, "uuid": "acfdebf4-90b6-4db9-8259-0c6f80a9a933", "comment": "Malware payload (Gafgyt)", "value": "2c0dc3ccbc9e975567325343a45df0466b8263de130cef1ccd1f51d456bf9e05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438520, "uuid": "539ea74f-86bf-4c01-97b5-24764fb1695d", "comment": "Malware payload (Gafgyt)", "value": "6374fc0ea75b333520d562ac9226e4a8adf98bb7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438520, "uuid": "d8613088-9ec8-42c4-a09b-26f477fdd0b5", "comment": "Malware payload (Gafgyt)", "value": "3de0b71700e46e75bfa8c908dd85016ac95e37248340c03174a3b9cd8e3c26d15abbd61175552b667f48ca266e1de001", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438520, "uuid": "1ef5dc43-8f9b-49b1-bc36-83e343aba844", "value": "T10FC3E145F39F6066F3C2853245A3D56E27BA8B6022D1C35BFA061E329CF436A649F346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438520, "uuid": "c5d227ee-69df-4040-98d0-83177761fdb6", "value": "3072:1U/suahz+XmAY5NBe9KDIUCeMM8E3cVjMWy2G000IL:1dLSuQKDvUM93cXy2G000a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438520, "uuid": "e52611c2-f76c-46c3-bc47-61b9c28f8898", "value": 123522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438520, "uuid": "dc89e1b5-c3f7-4ca8-acad-19ea5ebda82e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438520, "uuid": "64840f95-2164-4349-b9fb-75022c1955bf", "value": "bot.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd87966-4ca2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778439677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439677, "uuid": "a12f0cf0-7d91-49a8-bb85-04429a0e7404", "comment": "Malware payload (Mirai)", "value": "f5ea178b3fbaf832d7e75b1d263c5428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439677, "uuid": "5c102690-b72f-44bf-97d7-b971cd1d4b56", "comment": "Malware payload (Mirai)", "value": "2ca78509027f3a0b684652f9a6a652ffdf5cda2f73587e4c59a42e30b7fe781b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439677, "uuid": "376cc754-4981-42cd-82ad-b43a1cd7cc50", "comment": "Malware payload (Mirai)", "value": "c68222688bc0246c7ff65235fe8c180851ca3d51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439677, "uuid": "85503739-0d88-4a5f-8306-57f0708610b1", "comment": "Malware payload (Mirai)", "value": "4ecc88dc1970b675f6e6c37223df3b3f47091b9969a8805b83a1b1d6ed4d6938792250ff14e0111f3f296605b7d65336", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439677, "uuid": "0a14d694-e4d8-4820-8279-d3b198de4f5e", "value": "T1F5562711FECB14FAE5031E3104BBA27F67315D054B25EBD7EB407E29EA3BA911936209", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439677, "uuid": "d154c9d4-25d2-47cd-b87f-fdeb9295d86e", "value": "49152:cWYzMTjOhpzU1fefk5Gkb2BVAmjidMyze7ylW0fIg1ghhXI/5Ed:uITjOQZak5dbu+dMyy7IybIREd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778439677, "uuid": "f364021d-909b-4640-b67f-ea7dfe4227cf", "value": 5886114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778439677, "uuid": "bf95eb54-2ad7-4314-bb76-5bc9cb569ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439677, "uuid": "04572b64-c58b-4519-9825-467ab945e645", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c423bb-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371483, "uuid": "7d33e24a-fcf1-48b4-9fbc-67c0b98acc93", "comment": "Malware payload", "value": "7933851dc50ea44eb367d312b8deff51", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371483, "uuid": "8353b02c-951c-4f25-8bfe-4d0e00e343fd", "comment": "Malware payload", "value": "2cedce5f054e2557fcb7abec6a56306dcd20f8c669e798eec731304786a3c37d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371483, "uuid": "a363941c-a684-41c2-9784-19062ae1497d", "comment": "Malware payload", "value": "3870528f00e52d0e315ac2c81673065686e4993b", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371483, "uuid": "e85b79bf-f80d-4ec1-bc95-fbc72021970d", "comment": "Malware payload", "value": "fe18ceca9624530c274efc869cf729ab18b021bf2179b902bcdbca9ee17990a2de47a8126b96989cbf1d478a88885916", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371483, "uuid": "c7543900-6286-49eb-ad61-f82148d285c4", "value": "T16CB43B0873F8422AF1BF0B75D6B250198773B95BEAA4C34F0D41A44D1D72B81AE99B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371483, "uuid": "314a7c21-a6d7-4214-89b7-9a16ddd99530", "value": "6144:X8VIlk+bh403voFBw2iQ5hlr4xdfm5ALeDAQ/K07w9bYUrUGrOSNdcnm:jk0q0/dQ52dkAQ/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371483, "uuid": "46f00a5d-c257-4e54-9844-a7e710c3cb36", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371483, "uuid": "96aba985-659b-4368-96fd-861ec0e33fc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371483, "uuid": "121307a8-1545-4d23-a84c-3a24264b2f4b", "value": "2cedce5f054e2557fcb7abec6a56306dcd20f8c669e798eec731304786a3c37d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ea5ab0-4c39-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778394515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778394515, "uuid": "199854bd-fa46-4b3b-a607-b664f792ee6c", "comment": "Malware payload", "value": "477d37ed9605060ea8aeb069ffe241c6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778394515, "uuid": "f0a81614-edf6-44d9-a468-40267d65399b", "comment": "Malware payload", "value": "2d39820cb3766c5faa1f7555df5311778b8c692d812c6441b01a9b61b893c902", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778394515, "uuid": "fbd177a4-bf7c-466f-83ca-701db5294eb2", "comment": "Malware payload", "value": "52f3d1e26cc9a2ba1b304cdd12929298ffc4cc15", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778394515, "uuid": "9e9f2882-d88b-49b1-b5a6-9d67647bbfef", "comment": "Malware payload", "value": "5f2448072bfeb49ef7cb48e145942354fdd9fbf43a559d63b4c29f01d9baa8e858ee99ce04a249a7588a0b100b2d9a58", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778394515, "uuid": "11b87561-cc95-4854-b6eb-e897c773c634", "value": "T14DC3CB8999EE89B4CB5F6438461F1C478A8E9223121DDAD4BADEAF453F115F031FD8E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778394515, "uuid": "49237839-9a18-4381-8ac9-79f85a507297", "value": "768:Q5vVuphV6qcymTsdfWbEPy8WEf676i626T6jQhJ2slU6exyG0vD0jWpwIwu6obAq:uVCXuvYNyMh0bqtV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778394515, "uuid": "8fbdda16-6293-4b31-a05c-d57220eea1dd", "value": 126164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778394515, "uuid": "6cff468b-ab55-427f-8e55-23d5eb2bb8b7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778394515, "uuid": "6f98fe40-3b69-4dbf-bb14-f7a53898fbc3", "value": "Document_Holiday__70.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e496fbe8-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389541, "uuid": "d92498db-48be-4aa3-bc27-2a7913ccc57b", "comment": "Malware payload", "value": "344151a23917b73d8aabb2bbd4ad5b19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389541, "uuid": "fb103e06-6b4f-4752-98e7-a00ab66d823c", "comment": "Malware payload", "value": "2d7531ca67925bf1fd575c24b8cfa7c86f2ca835ce47169434f89e36fa0ea18e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389541, "uuid": "895cc3c6-65d4-4624-97ab-53055aa6271c", "comment": "Malware payload", "value": "7f8dc2796130e9e149b49c29815271aa11afc83f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389541, "uuid": "58b8b8aa-467d-42e9-a274-45249f4d6df4", "comment": "Malware payload", "value": "2c2300a48db269511844cc5112b0532c15a407a4e4eacb81165e3eff0ee60820965299587fb80775accbbdbb70fd2a4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389541, "uuid": "bdc4c8ab-51b3-4409-94e4-77e922c4a56e", "value": "T130061A57B8914A82C4E4367ABC7E41C432A31EFD9B9A12676D09FE3C3BBE1990D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389541, "uuid": "1d2c5fd0-05a7-4467-97aa-5ab656cfdcf1", "value": "24576:shFm1WKf51ltR5lAENuDm5Oc09VtqdYDYrtA0BYTDQ9m+njlVRM7eZAEIw3cguuh:f+jqD6T2HU799k4AfLJ5zHHD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389541, "uuid": "5e2fa4e8-7156-4123-a5d5-ccdea112973b", "value": 3997696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389541, "uuid": "0a10424a-b39a-45f8-a04f-800e09a180bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389541, "uuid": "7e03ab7c-7fc7-4d8e-9066-4c30663c24b6", "value": "linux_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7e0ee4-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436264, "uuid": "9fd61c7e-7ece-488f-8dcf-4fc3cbd22c03", "comment": "Malware payload (Mirai)", "value": "0c0ddf5438ca0502a944921aba469e29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436264, "uuid": "ae98ba40-32de-4617-ae8a-64988c4c3092", "comment": "Malware payload (Mirai)", "value": "2ec205499410031daaa235a0114038f30aaf7316667b8d5f94ccac596fbb7946", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436264, "uuid": "df3af3f8-edc2-4d5d-b716-31ad7f2a2aa1", "comment": "Malware payload (Mirai)", "value": "bb5bf4e3277ad765d6a92da0ba8dc0841a74054d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436264, "uuid": "ed0bb17b-12ea-46ff-a8f6-b811a6fb9fda", "comment": "Malware payload (Mirai)", "value": "d77c20cbb9fbab2a7b966916483279ff22733f49ffe1792e158b68a06d4c156941b288f293c0f7083a3c8b0dea3f946e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436264, "uuid": "b93af9cd-3b60-43f5-953d-2ee557c4cfb9", "value": "T1926629137A68EB4EE22871304DB1CA9567291C8546D7A917E391F31CF9F31AC896ECF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436264, "uuid": "fdd36cf9-07a6-40ce-8335-c319fd2ffa7b", "value": "49152:9Vwzd9lb3oNZgo1mkI7MUiR+pPViG1PdQZPQifYu12SN6B9GfZBBrvXOafwuwHHD:ybPKnMa47n4jEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436264, "uuid": "b3e1d4ac-9110-4bef-aaa0-4be8e4639ea1", "value": 6684865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436264, "uuid": "48665f31-8308-4019-b78c-54056ad0d732", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436264, "uuid": "b9a367a1-4549-4070-81c6-55e469568dba", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f82de96-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413665, "uuid": "c6d9b27e-574a-4804-adbd-aa38af313a0b", "comment": "Malware payload", "value": "e7e5831e3b13d3cf1b1e353f432bae36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413665, "uuid": "7ec2c5ab-5f0c-4302-ac3d-269377ee0660", "comment": "Malware payload", "value": "2eed70f8db62d817125f084037cbd1128eb30e377bf22c32d03699698d790f3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413665, "uuid": "752bc1c6-9346-490a-9b42-0504f0d0dc0f", "comment": "Malware payload", "value": "8a4fa0e221e750ae26b765dc4adb450faa7edb05", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413665, "uuid": "b06f7426-2247-42e4-90ec-cb98596fcca4", "comment": "Malware payload", "value": "8045bba72376d06e57318f10792adab76131066f832b4261497aeb693a2eb90fc8ca97603a0259e38b9ef411b7f2795d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413665, "uuid": "a579e93e-e92f-457d-9390-c4f96d5ad9ba", "value": "T1D985338376E86E32CDA35074007BCEA75E511C8DC46379EE5A2A5A08C576F3AF4C835B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413665, "uuid": "bd914066-ad34-4196-b2e6-44bfa1786e39", "value": "49152:su3zkWThoeka73HQzqVPIjtUm21fjrxlI8CqX:b3zkW1oh+HqowtB21fX7I8CO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413665, "uuid": "9e407076-b2aa-4727-9f60-d30312227607", "value": 1857492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413665, "uuid": "2c312125-f98b-4e19-876f-2546a7b04462", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413665, "uuid": "017889d4-9c34-40ff-87a9-3ce33d4fa22d", "value": "ksoftirqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122f4d07-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448459, "uuid": "d48ba958-e049-406f-8743-8df7238dd62f", "comment": "Malware payload (Mirai)", "value": "de312fcb8c796f362c1df3cb7821e332", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448459, "uuid": "810c1c63-829f-4356-983a-3f99fa92b52a", "comment": "Malware payload (Mirai)", "value": "30bb356868a4d40763f6bbbffe79f3df2bfaf57b1e64d507b073773faeac4e7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448459, "uuid": "a7ccc037-fa57-4896-a1d6-b415f2adde43", "comment": "Malware payload (Mirai)", "value": "8ddce83710065b6ccdbc492f97cf9050db558028", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448459, "uuid": "2a6ff8aa-51dd-4fa7-9b3e-b98fddd08905", "comment": "Malware payload (Mirai)", "value": "60dac4820ea206c57966d9963b7da0888ef8d8df765447d678edb4abd104917c22f5b40e5bd9352d749ce9daa119b392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448459, "uuid": "ecb123c6-fafb-44f9-bacf-f8bcd0ea4ff1", "value": "T1DE832A97F400EDBDF80AD77B4453490AB270A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448459, "uuid": "8d9b6f21-ac89-4a29-b96f-ea47eb7cfccf", "value": "1536:quKG9194wgWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTHxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448459, "uuid": "ea0880c8-f1a9-477d-ac85-bb4cc383f899", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448459, "uuid": "0e420568-6743-4fee-8a2e-b4f78c8e87f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448459, "uuid": "23dd48f9-9497-41d6-aebe-0f5f5ffd8576", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1536b272-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448464, "uuid": "d2b6f442-6998-448e-a4b9-be4d97682d54", "comment": "Malware payload (Mirai)", "value": "be2fa815d4be9f8b6e3caea12badd646", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448464, "uuid": "7fc5b72f-27d9-4564-9794-060565febde9", "comment": "Malware payload (Mirai)", "value": "32f1ed6e060cfccc1e8e3fd81d531158c964f7f342209aabab91ec54477e8eae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448464, "uuid": "13ca50dc-a173-4562-8845-52e66f96717a", "comment": "Malware payload (Mirai)", "value": "a33a114a3ffb29e28d7b5fc9306064cb071fb792", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448464, "uuid": "b3ccd484-9a2b-4e93-87cb-45f040a2db72", "comment": "Malware payload (Mirai)", "value": "808494f0b35d5cc23eb04a8de6982a2d0bdd85c610e6b1480ccbbab43a2b593563ef7764279ac179bc064676b85e6d88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448464, "uuid": "e286e634-2ba4-456b-baa0-f5c417383601", "value": "T1BAF2F1BD16108C8DDC12D5BF06D48BE1B8452F6769039D8AE039D672ADEB6742D13AD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448464, "uuid": "82ea0fb5-c1c6-4340-9b1e-3947d0df6f9c", "value": "768:gNYKyukZoTMKeC2CtG88tgGAN+FVBg5f7JkGVOmcs8ZfJgGlzDpbuR1J9:6YdWlen0+FVBgHfVDc1ZdVJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448464, "uuid": "d539c38d-fa55-440c-a244-b32651a491e5", "value": 37076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448464, "uuid": "d3f261b2-257a-4a3d-a612-60925582fd51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448464, "uuid": "2ac91c5f-af98-4c11-9d9a-d77b653a77d3", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6800fa64-4cbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778452039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452039, "uuid": "c45f69f8-44f4-4934-a8fb-7ccf0f4a92b2", "comment": "Malware payload", "value": "d3fb9a73e703d6510979862ebd765374", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452039, "uuid": "87117c97-43cc-4b86-b516-74d32515513a", "comment": "Malware payload", "value": "3374898733454761691960d5c78ca0140fbddca32442936a63e9424e01a79559", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452039, "uuid": "4d140b6e-307e-4162-911e-91d5657918bb", "comment": "Malware payload", "value": "2c83eab80cb5e7035efd6af9638ada234cd7ad95", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452039, "uuid": "b12ece6a-cafc-4385-8dd4-9940da2b2c7c", "comment": "Malware payload", "value": "5dc628abd1ca9c167cc22e168afecaf55bca95561fb3c145f42af4016cfff4b7f8b294768cb539f2e329a171b1f295c7", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452039, "uuid": "a09c9c28-1cb4-49e9-9838-985e14714668", "value": "T1F8B5AE573D9190F9C4AAA63158F67195BB20BC080F3527D72FA1BE742E72BD01D7AB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452039, "uuid": "bc9e08ba-0898-4047-857c-85bdea29af16", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452039, "uuid": "008015b4-c1e6-4892-8644-6c484a3ea024", "value": "24576:H1L47fmi4AzLxmrdrAWOs7+EIDYp7Ddmc0SDq/uhZoOemzhFheletn926ULT:VLkP4ABmrdr1iEhdw/EPR9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778452039, "uuid": "92bed9c6-53fe-48e7-93d2-55ca2495df64", "value": 2446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778452039, "uuid": "3f3d94ad-0b44-4db3-a0e2-476c4e2b9a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452039, "uuid": "54cc5899-5698-4b6d-b579-bfae9ee63af3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440327d6-4c6e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778417189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417189, "uuid": "5df5e15b-91b0-47de-b925-12067916cd23", "comment": "Malware payload", "value": "136983c9e4b1aedfdc3c407eeaaa69df", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417189, "uuid": "c3de53ce-afdb-4b64-87fb-048f7b7e97d9", "comment": "Malware payload", "value": "33c7c2a3018ebfa9e7d362ef4ec97cfb292da332d8748e0d4ba29780decc1de7", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417189, "uuid": "d26f8899-951c-4646-a5fa-24442ec59b84", "comment": "Malware payload", "value": "0e171486fbfc4d078f46ce77cb7c7949523fc86b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417189, "uuid": "80a653b9-6163-4c9e-a827-5d8729e4bcc6", "comment": "Malware payload", "value": "c89aeb175be332f766326633b724903f5b453a1a1464659be29d19f5c68ec01be129a686362980c0b8f2213a34c87452", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417189, "uuid": "046d2a23-f046-4e21-8335-a8183d9d969f", "value": "T19DE533072E93D68DDC7E4DF409B50A7BD5E1ABC6D76B259EF6B440C70B0D3C6A802A90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417189, "uuid": "aec481ff-8959-4209-9d41-738288302ab5", "value": "4dd1e4bfa52bc3c47c521b6a44d08055", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417189, "uuid": "1320d893-acc4-4eca-82b1-2091a7bacfa2", "value": "98304:D8mIWC1+dS04LdWY1fJaPrqJCjZfav1MlxhsuZ:DZJC1+dGLoKRwta9MlP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778417189, "uuid": "512a77e8-714c-483a-a56c-b133ad43d1d0", "value": 3308064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778417189, "uuid": "115e434e-ffd0-4266-afcc-880914036a2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417189, "uuid": "da0c840e-4b03-4274-b948-7c541512bae3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3daa9525-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412454, "uuid": "4f6ef1ac-0ad3-48f1-8d77-d15eeb2d97ba", "comment": "Malware payload (Mirai)", "value": "79308316947914beb0366c95c8cbddf1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412454, "uuid": "21f54e65-cee3-4140-8ceb-360ed30f13b9", "comment": "Malware payload (Mirai)", "value": "342e9f1a8dfc430bf002e8848abcc710dd8960ad701479169298c380629489a7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412454, "uuid": "f22d0ab4-ab57-4ab9-8dc2-834d3f2b282b", "comment": "Malware payload (Mirai)", "value": "431ce180ae120bd9dfe11aedf961d456e0555ab7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412454, "uuid": "b76d365d-1e77-4e6c-80b1-7cebb8126dd9", "comment": "Malware payload (Mirai)", "value": "7722d134ec1aef15c6c63265a64d767a54df5ea0108da45219533f23a599a616ebf0659356e72a05ecedd41cd9d52f33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412454, "uuid": "7b250b52-2001-4b38-8bc2-eec8f53c1097", "value": "T17683F888FE15971FC3D272FBEB9D038D762A1F69E7E6311699315E9133C1A90253E120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412454, "uuid": "731ee0a0-0bae-4043-85bd-d075895c8391", "value": "1536:oQVkTfL/vzMaPZbboLZ6shn0fDF3FAvKFEvEcOVFuCNgNmIQmOh52xm:ZVkTjHQcboV0LGKFEY1BIc2xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412454, "uuid": "4bef2808-61b1-41ab-b4c4-c635d7386624", "value": 85240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412454, "uuid": "133f8e18-132a-4e46-80dc-6e75ba31498c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412454, "uuid": "d84bbf1d-2fd5-4676-96f1-a23aaee3d4c0", "value": "xtc.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a2b886-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436143, "uuid": "5555bf41-5b03-4611-b211-e074b059e6ee", "comment": "Malware payload (Mirai)", "value": "678d3cf2ab59ec6f30934fcd0d8f8695", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436143, "uuid": "1b1a34c5-3725-4234-bf44-74f688b2fcd9", "comment": "Malware payload (Mirai)", "value": "34a31908e7c6aa57bbe22795c9790dfa0ccbe69efe2ae60cb4638a6b0b459764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436143, "uuid": "9e0074f5-7a94-4959-bf4e-bfd1e6cfcd49", "comment": "Malware payload (Mirai)", "value": "a80c46f52a021752bf2a2359388ae7fc81f334af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436143, "uuid": "e4527387-ceb6-4211-bd79-2b14672768b3", "comment": "Malware payload (Mirai)", "value": "5285bf5e59f4cd47ec360f9688757a5eb8fbf938ef62acedfbd57aaf1ce956a96fc834c7fdb62288ab0205db2408b11b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436143, "uuid": "67284c0b-ec7a-429d-9fe6-4ac9f052ce7e", "value": "T1C3A32946FC814A21C5D512BEFA1E318E331357B8E2DE72229E149F3173866EB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436143, "uuid": "6ef1d156-8725-4578-aea2-e300d340a415", "value": "1536:wAnky0uiMdiA/5JHa9yiqppEGBEqQxEE3k7uaRrtOXrD0Rilp2x/F0v7Xh5GYWP6:Qxf+ppE9uik7uaRgp2x/F8ThULP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436143, "uuid": "d6f75dda-ac1e-483d-af7b-5879afeab590", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436143, "uuid": "b396e9ab-11e5-4ca1-91f4-10c0038f59de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436143, "uuid": "4dbf18ac-cd4e-4ea3-acad-4c950401d492", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1251cb2-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371443, "uuid": "460cc7e3-6da4-4da8-ac8e-5d00883471ca", "comment": "Malware payload", "value": "39eb83e9387d6cc8c5b0415782d85bbc", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371443, "uuid": "bbb0f87a-8816-48d0-98d8-44e27b4996c4", "comment": "Malware payload", "value": "34f2fb7cccd1d0e9720e500c7b3c529efc7a8ea93d59840227afd759fe9d2214", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371443, "uuid": "cf204a47-b1c1-431a-ba66-1ba6bce7ef8c", "comment": "Malware payload", "value": "de54e8a75abc56543262c5c6a642c5145e389e15", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371443, "uuid": "c6c0092d-5e69-41f0-b8e2-6efc139784c7", "comment": "Malware payload", "value": "ad19fef13d7b24f3c33c5101ecc65737a48676f0fea9f8d82bf0518df4ca755ddf725eb4b46eec7484d879d37c958d15", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371443, "uuid": "a2cddf8e-f098-46e8-bc75-5247f810e0fc", "value": "T127257C0477F8671FD17E873582724C2913F6A08356A1C74F4E86A94E2F67782EE076A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371443, "uuid": "ca098b1c-03f1-4de7-b842-7f607f05c0be", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371443, "uuid": "bf8fb4b0-4eb0-4a5e-9abc-599f3d975426", "value": "12288:Qwv21JLLH9FqALXAB/2nZm6kfgMwZ0h2nZm6kfgIKRLUFqALrAB:EhbABemdfbImdfl1vAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371443, "uuid": "3e2ba67a-847d-4957-98da-2686457dfaef", "value": 1009152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371443, "uuid": "bf72389e-4b4d-45b2-95ba-7083cae1ab2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371443, "uuid": "0d5e9e88-f11d-4d71-ba78-acc5ece91468", "value": "34f2fb7cccd1d0e9720e500c7b3c529efc7a8ea93d59840227afd759fe9d2214", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e28864-4c90-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778431980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778431980, "uuid": "6078a10c-191d-4cd5-b34c-f246dcf41e0d", "comment": "Malware payload (AsyncRAT)", "value": "fc866701a8a70a24a4eed5303f66599c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778431980, "uuid": "681b2def-3804-4e2c-b872-59f2dd824157", "comment": "Malware payload (AsyncRAT)", "value": "364e7cc930ff193dcd65548699117331d76e9f754218c4030c8fcf314cda7180", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778431980, "uuid": "3aed2e4d-7362-4791-a798-407c76a8460b", "comment": "Malware payload (AsyncRAT)", "value": "6c9082fd573ee7ed2751b97edd01f7453149d361", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778431980, "uuid": "e0dbedaa-985e-481b-9b78-e4dc4abfed5b", "comment": "Malware payload (AsyncRAT)", "value": "7e70d822fe60be0b25b40c3ce8f9a391eb903f3bf8af06712e9364e6165e5a0e406c07d45e88c69630d9f8d1309ad0a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778431980, "uuid": "b26f1fef-40bd-45cd-839a-fd0e7243b05f", "value": "T1B2433C0037E9C227F27E4F7899F22246867BB2277603D65E2CC4519B5A23FC685425FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778431980, "uuid": "a95c32a2-a604-4c09-b133-59039a1647b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778431980, "uuid": "68586be6-c7a9-4374-bf37-344545f8643a", "value": "1536:TuhuJTPOY2k7533YsPhJbfWMQcmslafVTzdaujnCa:TuhOTPOY2k75HYs5JbfW+Xa9Tz4ujnCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778431980, "uuid": "b1506d75-f998-4564-9103-fa586e73f84e", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778431980, "uuid": "ea2081c8-d896-47af-a8c7-8058cc887358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778431980, "uuid": "b4b80b87-a536-4161-8ecb-de58ca17f101", "value": "playgamesonlinetogether.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e779f433-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389546, "uuid": "4868b11e-5267-4c47-af40-0f658b4504a6", "comment": "Malware payload", "value": "b8883291317abe6131411ad13c874181", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389546, "uuid": "7d666012-c060-44bd-9647-5231a47e260d", "comment": "Malware payload", "value": "36a6f21d92dbc36ce2d350587f9ff12d68528827fbc941e7e5e6e98dbd3625d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389546, "uuid": "bb259352-1041-477f-a1b6-3b23c612df50", "comment": "Malware payload", "value": "04d5d4bef6d0856c4f809a3df2e15adc9c30db43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389546, "uuid": "866c54b0-084b-4ae4-91f1-6e32b832722a", "comment": "Malware payload", "value": "4c8b17734073d867d1cdd3251d321c901cc54e9045d285a2b06d2fd95adcc4d1f39d702468071f392fe4de88b6307726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389546, "uuid": "3ef5557d-501c-4910-b963-03dd8c6c4a8c", "value": "T100061A57B8914682C4E4367ABC7E41C432A31EFD9B9A12676D09FE3C3BBE1A90D35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389546, "uuid": "58bf5760-9a3e-45c1-98f0-cde09e618dda", "value": "24576:vpo/KLNhe0FKNe+ppBsptY8S02vIyi0mnbthDhAgBwNJ4GMecgpiCzXI0KWiloQr:X17ko5WGfJcfgrIgLRHj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389546, "uuid": "18e9e695-6288-4dbb-a1cb-66f5ab5752f8", "value": 3997696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389546, "uuid": "25eb7473-6158-45e9-9769-d886550a33ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389546, "uuid": "cc7d5d24-ed82-4982-bbd4-8dcb6d113a3b", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef5f6c7-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412456, "uuid": "b286c6df-56b2-4916-9002-2000e2bdef03", "comment": "Malware payload (Mirai)", "value": "484d5e35ea9b0e6526d53c8be1ab4bab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412456, "uuid": "4b9f6fd5-91a0-4cac-b293-d59571fb0b00", "comment": "Malware payload (Mirai)", "value": "36b78bfc84e968cbb25826e386c95ed94d4d1c17e15b422d61e07759ef459de9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412456, "uuid": "ade3f06a-63fe-4f22-a477-e1aa0503de50", "comment": "Malware payload (Mirai)", "value": "0b5c3b59ff627b23a91801cbcad3a61fbc27e196", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412456, "uuid": "52392367-26fd-41b0-b208-a679490884e0", "comment": "Malware payload (Mirai)", "value": "32d5fc864c524d467017f4385b0457c0e8c7b4024e8b4838fd1dbe9dfa72cf0221d62502b3b3239ef02dfe38e35ec18d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412456, "uuid": "523425f6-c9ff-4dd6-bf12-03d76c3a852a", "value": "T1DEB30948F9546B19C6E232FFFB8E428E33135FA8E3FA3025CD315B6123C5A961A35521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412456, "uuid": "220924ff-eaaf-481c-ba64-0fc960af9dab", "value": "1536:2enX5SI1foTXpL4zU/YsQmaMlGG6H67GlwyAIiiQ4l588jnjcZYL:r5SINs5c+xQmaMlGG6ex4l588L4ZYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412456, "uuid": "ccc83550-ccfa-4098-b068-24c1ff0f8b8d", "value": 107912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412456, "uuid": "a036ecf9-c594-4578-8e26-7579f15deb26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412456, "uuid": "a91790f8-c897-403a-8372-9092c38c57c5", "value": "xtc.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1903ab7-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413964, "uuid": "b43c86dc-e656-4968-9ecf-52f294476403", "comment": "Malware payload", "value": "52ffc6a4576457ef135ad32d8db1eb37", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413964, "uuid": "269db671-5a9b-479b-b71d-7eeb5d0af50a", "comment": "Malware payload", "value": "36e5160299948ad67b6315bdac64a615de501666fd6559a227d96930d5c61f51", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413964, "uuid": "7283387d-1b2b-4d1c-923d-7f091cbd38dc", "comment": "Malware payload", "value": "fe531dac8d3281afe0c53c16f6ef687bddacf87b", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413964, "uuid": "d2f85e42-3015-440c-bfba-21adcaa210f8", "comment": "Malware payload", "value": "55dcbb63e202be53076802e5f2b3869846d253ef619a8a88826344c805ff4aaeb8d3e11785bb55e699c187c5bcbbdfb1", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413964, "uuid": "eefec3fc-0c01-4519-93a7-2e3ed46d4915", "value": "T1A59533171FC789ADD4F02C0D3AB21612351EBCA85D8C4CD5F18F07A4479AB9BEC58AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413964, "uuid": "c60ef906-bed1-46be-ac44-88ef1d23ff59", "value": "49152:E3ylHyUQgGSEJOwIMfKDYPaL+aUvX1t4Mqvt42INm5TSlVepn:ey4NgXhMf6YyL+tNHD2IQ5TSlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413964, "uuid": "4844635b-3590-4c35-8ddc-5e0750d93f06", "value": 2026916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413964, "uuid": "44505f87-3815-4e83-af3d-84565525b366", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413964, "uuid": "33c310d4-5ee7-4fb5-a199-3faf731ab14a", "value": "vulcan_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa0fde2-4ca4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778440616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440616, "uuid": "a036b926-7193-4bbd-9d4f-e43e2bb6ad9c", "comment": "Malware payload (Mirai)", "value": "9d328e8fdea78dcd3058b36d5564641d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440616, "uuid": "b3f3cf6d-6b79-42d8-bc02-2d8b48e663ec", "comment": "Malware payload (Mirai)", "value": "36fa706d37892da106c48c495a8c022f20f7bef7bc16fe23436e2440c1347a03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440616, "uuid": "fbbb2587-90c1-4028-a42e-1baf456c812f", "comment": "Malware payload (Mirai)", "value": "25a6a1e04b9d670db2366e013aadae3b966415c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440616, "uuid": "44902653-cb71-4c58-93b3-029f8d60dbff", "comment": "Malware payload (Mirai)", "value": "d8189186f482cc10f5718cb428028cd6193d0e957154e49c40ab6a130c9516291cf4d0fd9a4a9c7457792427d364060c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440616, "uuid": "0f9d4d61-a848-43dc-94de-67592842deee", "value": "T1F9263A07F85191E5C1EAE130C665D292BA717C885B3023D32F50FBB92B76BD4AE7A314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440616, "uuid": "5d8f572f-dc74-4f76-97dd-a2414c617439", "value": "49152:uBPfbowrb/TGvO90dL3BmAFd4A64nsfJifYnPmvfz+Qi8e74Pz8dDo/j2sWy+5EI:3KQ/e08E2uO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778440616, "uuid": "0cd7d457-2b9b-4f24-9e8f-78ce2ea420f2", "value": 4669440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778440616, "uuid": "f2182787-2a73-4017-8a5a-d94cf3f3e2f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440616, "uuid": "4a708d3a-aaac-4cf9-8697-ebac1de7b45b", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85eda3ee-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371344, "uuid": "ae420046-236f-4fb9-b219-8bf7901a33b1", "comment": "Malware payload", "value": "017d5e73ed9938a5e5c27afe6fcd11fa", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371344, "uuid": "5d8f9a7b-c63a-43b8-b955-78867c5b46f5", "comment": "Malware payload", "value": "371d58965e834eb7e1ffa25d53b6729d46324bd269ba87d199776aa965418d84", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371344, "uuid": "54e5f139-d934-4445-aaef-a1755a30ed57", "comment": "Malware payload", "value": "58a09b03ffec6b219a4697e48e0939d0fb835f3f", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371344, "uuid": "e6cc2fc2-7c8b-4d9c-a907-8d13723becd5", "comment": "Malware payload", "value": "bd5254128ea4e72b7ee7e1382ec52fe51634d8471f583b1d49cf89d86af848d991c6984cad72f7e36ef4fcb51922dc9e", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371344, "uuid": "d2e7ed75-fc42-4a61-a46d-5ee525b667d9", "value": "T19C24590DBFDEF55BEA3C467587A3186B13F0806302F54B19AD861D9A9F1A3C1FE061A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371344, "uuid": "0425dbac-5e0f-4274-aa62-a5bc6dde2da9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371344, "uuid": "0a4bdee8-f0d0-49f5-855a-5e8c904bcc7c", "value": "3072:s6HybmgUSQ9HFI9Mm+9bZyCs5/nQf/pnQNckSQ9HFI9Mm+:s66mt9HF9m+pZyJ54fhQNF9HF9m+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371344, "uuid": "1fbbfafc-285d-4d0f-8150-fceb949b2578", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371344, "uuid": "d56c0f6b-0029-4c50-86db-fde5f974245d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371344, "uuid": "6db95df6-0ab6-45da-9f30-bd8b16a852c0", "value": "371d58965e834eb7e1ffa25d53b6729d46324bd269ba87d199776aa965418d84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91748c8-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371456, "uuid": "987fad15-f64b-4b82-81bf-2d83ad5b9577", "comment": "Malware payload", "value": "c3f09c4e66dcc6af382a364b8b3e654f", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371456, "uuid": "22f838b7-bc97-42f3-9d5e-e0da969779bc", "comment": "Malware payload", "value": "373ce1be7e290e0c11d44043df02b2876522eb159d54579ee07a096ede0ed94e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371456, "uuid": "fdb70707-ce25-47e3-a47b-d1c212169720", "comment": "Malware payload", "value": "352e705a7247beaa94f873c4ca39f4a504a84778", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371456, "uuid": "deb71419-a69c-48fb-9a98-504a37a4fda2", "comment": "Malware payload", "value": "1656605b3db123d742d0e5e8f60393c71919fcfbe432722dac27658e81a005a56f0e886326b3e04f38c34f3d5704e345", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371456, "uuid": "97e4b9fb-1321-4f45-bf0d-982195f37510", "value": "T1C8B4290873F84726F1BF07B5D57264194673B99B9A64C34F0D51A00E1E72B80EE9ABB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371456, "uuid": "70515638-586e-4290-9889-dca7b440ac2c", "value": "6144:3vsPsZKIGTmIc+Jwg/fWa/AC+8QCF+XarKnpClVK07w9bYUrUrrOSNCcnHi:9K1KIc8X/R4CLVNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371456, "uuid": "2b52ae39-76dd-4728-a088-6141e8783bb0", "value": 510464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371456, "uuid": "0b34555a-2b7f-4b4f-831d-82c3ed6ccfdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371456, "uuid": "ef22dc77-2ed7-429b-99df-efcdb4482316", "value": "373ce1be7e290e0c11d44043df02b2876522eb159d54579ee07a096ede0ed94e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6807b950-4c6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778415532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415532, "uuid": "376a468c-761e-4ee5-867f-b37d817a4885", "comment": "Malware payload (Mirai)", "value": "68df256906f64c700c948c255d6f95eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415532, "uuid": "90824e7c-255c-4a17-9621-dd983d7cc2cb", "comment": "Malware payload (Mirai)", "value": "3748ac46365da967842bc6208c880ea7bab92458f2ada64bafb2c911f4c0af90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415532, "uuid": "51a6b2c7-839d-4358-a849-3ad938cb1a79", "comment": "Malware payload (Mirai)", "value": "efa81b1f2b989a15cbcbf69f4cacd632140f0260", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415532, "uuid": "5ae075d1-be50-418f-ac82-57e337797370", "comment": "Malware payload (Mirai)", "value": "ef337621571d635e5d1b00ce09dad1ffdca824f79873fcf97938c9a0503fabc6d25f537eb1ec967fbe95c805cbfc4b51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415532, "uuid": "f95180ba-67b8-4c63-9f09-e3a2e68ba5d7", "value": "T112363B17EC9586E8C0EAE23089629253BE717C495B3023D72F50F7392F72BD4AA79744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415532, "uuid": "5046d60a-a740-4628-a531-ffd321b54db1", "value": "49152:6D3PCIClAuQ8L12I7GbraWm5EBbSbZYZo8UxYh5a64O:pIClZQ7I7QiEY2hUZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778415532, "uuid": "92ea56bc-d8b6-4794-8e06-07adce2491a4", "value": 4882432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778415532, "uuid": "5313eabb-5e78-40cb-9e18-e6c3dac09bab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415532, "uuid": "fae2e9e4-5449-4fa2-8ee6-a27946089f48", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4fd236-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412455, "uuid": "7b8907e7-b7be-4729-b981-b6774141ca9a", "comment": "Malware payload (Mirai)", "value": "a0f1e4349a515c43e2cccd51721384e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412455, "uuid": "3ae02247-3f06-4a59-8654-ada10d6fc3eb", "comment": "Malware payload (Mirai)", "value": "3772d371c8d92668e9c6f3b34ab854546afe9e5adfeb802057bb45e7ee3efeb9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412455, "uuid": "e046ce4e-5a72-4721-baff-d5a0eafb6d51", "comment": "Malware payload (Mirai)", "value": "fcfa637616746c9452b8297fabe4cd45a47c5988", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412455, "uuid": "5cda1bd4-bb67-43e6-8823-c4cd714a6d8a", "comment": "Malware payload (Mirai)", "value": "7ccace9edadf3b674ced73f09dd03e6a332cdee3f6e9401a6bfffff6103495ccb2b6dd5b43ac9f9c4d87528e3eb7f105", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412455, "uuid": "450cea0d-09e3-4cab-b4c0-0c2f5e4b168c", "value": "T13183E888FE15971FC7D272FBE78D038D763A1FA9A3E6311599316E9133C5AA0253E120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412455, "uuid": "1d9dbe2f-4817-42d3-b494-7901f7093bf6", "value": "1536:UQH5ibUDMfDqZK41xmlLXd3serBKQpDPXkbRL1uEEQYEsyO9Fim:dH5iood41xcdccppDCu/EYim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412455, "uuid": "2ba0f33e-536d-4df0-bfe3-bcff168bbbbd", "value": 81896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412455, "uuid": "b8844656-9142-4e2d-ba79-2e541b876c66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412455, "uuid": "c64d08e3-c89e-4a6f-915e-2a5e33f6ca24", "value": "xtc.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c959f0-4c8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778430178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430178, "uuid": "7fc988fe-1025-485b-b5a4-ec861369ed91", "comment": "Malware payload", "value": "74bba660352bbaff376ade9fc0331191", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430178, "uuid": "95abe27f-679c-488a-8025-60fc6b936201", "comment": "Malware payload", "value": "37be3c5511017c2c7cd4023bb2385cbb2c6a0aa53c5bc6b18781cb6c208a482a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430178, "uuid": "a396b538-44e0-4daf-a900-d31057136e35", "comment": "Malware payload", "value": "42eb7ec6cfabb608cace2159f0f3719c80a5556a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430178, "uuid": "bcc96695-161d-4f24-8d73-9e37ab14a94a", "comment": "Malware payload", "value": "3e7ef3e4ef0c0b5da00f9f9900372c1eceb4755ddc72249550d81eb1e9d120379fdfc12f36941d69933b077505e4ed43", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430178, "uuid": "a4af4148-f0d2-4229-812a-de2f15f794da", "value": "T16A53E66F9B52DA75C441D2709BEF9260A87070B02F36602F3B016BB63F716954F79E22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430178, "uuid": "02b205f4-f2b3-4cd5-b545-5abdeba28855", "value": "768:+5NzY7ISWjrs6ZOeakmAIXFbV+8iAgi+Lm39epmJ0T41G3aGHLHZztY97uuTch+D:+omtVAzH39epmJAtKGrJtYgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778430178, "uuid": "03b8d175-3bc9-4323-9d25-e01f126fc2ed", "value": 62320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778430178, "uuid": "cbee9991-6da0-43c0-bc52-7a5347846db4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430178, "uuid": "162e0f6c-4828-44b8-a655-6c25f91e4272", "value": "exp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869ee1b7-4cab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778443500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443500, "uuid": "f282a40b-8377-4991-9168-93a7d1e9f538", "comment": "Malware payload", "value": "2ea94e18b229b3141d456675eadb0c9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443500, "uuid": "6436039c-4e88-4f50-b007-4dfce33386e4", "comment": "Malware payload", "value": "3809c0330ed8a544039551113a725d9a44872acf540a6944750ee551bf090ca7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443500, "uuid": "c5e996cb-669a-46f5-b0ad-56bd2779da17", "comment": "Malware payload", "value": "9fea7cecd9e14533b124ca395d4019cdf3a325ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443500, "uuid": "ee320ec9-8413-4c3d-9464-5ea540f79814", "comment": "Malware payload", "value": "afcc0fb6e38e81f44f8877d0b52af35c81f3c3e9859237cd930943dc0e335f024871766ca83dea86327f310387c04dfc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778443500, "uuid": "c49f447e-1ec6-42cb-99b3-dc6b847786d6", "value": "T1DAF3129C7BA3F2D5C6F4B4ED19E50FA50A962A9974EE87546897B1CC02D0132CE22F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778443500, "uuid": "5694f882-e91b-4b39-84ca-97a6a4591b16", "value": "3072:66qndvjuyyKyvryA77R3nd1iPSRfC1bZOLdNgn24ZGk0a3YVE0hKTxZE/rIbPZOE:66oJxyKwdJ3uPSRfC1dO5NM2fM3YVdK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778443500, "uuid": "4ddf6ad0-8f42-41e6-a2f5-931e3ee739bd", "value": 162672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778443500, "uuid": "0126a3bf-e5bb-49c7-a142-50f8b608e40e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778443500, "uuid": "aed7b086-4039-4687-801c-a2c33548fbe3", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7239644d-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371311, "uuid": "7670d7a6-4d7c-4988-88b0-37836cd327da", "comment": "Malware payload", "value": "40754dadaef5befc572a4d0adbfa56ed", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371311, "uuid": "19ab1abe-8457-4a33-88cb-7e89deb15d5b", "comment": "Malware payload", "value": "384b43c88f91f720909dc82a13e151242eeab90056bda83035483fac6e3ffd64", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371311, "uuid": "eb72c239-d6fe-4b00-b8f6-0bec536195c7", "comment": "Malware payload", "value": "37c2e71904ec4b248ec3c5ec06192d39eb6161c1", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371311, "uuid": "460e3bc0-a1df-40c2-ad2b-5cb5d46e2900", "comment": "Malware payload", "value": "ddee814a4b8b6bdbf57ea992deae2f09ea13b9990c91b5f9bec0582bdbd12ac4911fb789f11cbf773abf1d581559640a", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371311, "uuid": "cfab3747-5f18-4e34-9eae-5621d2b1ec36", "value": "T1DA745B2873FD6A17E27F4735F172882853B260837691C74F4D51B85E1FA3B81AA067A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371311, "uuid": "e9b9afcd-eeb7-4e85-9ada-c032b97f20ed", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371311, "uuid": "4f3e2583-b3b5-4e64-bc28-bb93665594c3", "value": "6144:LE/LJ59Tyav+6QwRnX0xylTA9AFjICD/mk72ucQq2oF:6vdX5NkuFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371311, "uuid": "de59f8fa-1969-471e-a8bf-78300406764c", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371311, "uuid": "2dcbe298-2ef1-484d-aee2-efaa9ad85d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371311, "uuid": "c3d5eb44-6835-45f0-bf48-45617ee36f79", "value": "384b43c88f91f720909dc82a13e151242eeab90056bda83035483fac6e3ffd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff94d04-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436134, "uuid": "a97ccb40-d4da-4978-99b2-67efaf05cdb8", "comment": "Malware payload (Mirai)", "value": "cdef849ef54e924b357927ee6103f56e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436134, "uuid": "e62c18f8-14da-4231-a6bd-0b2ceb29cc28", "comment": "Malware payload (Mirai)", "value": "385ea3e8820978f2ff0a2cf3abff6a0f54b43fe496cf88131dd5b331cb6ee6fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436134, "uuid": "41cb10bf-77a5-4021-9876-50bba92d204c", "comment": "Malware payload (Mirai)", "value": "9d188ed0bcea559719aa95d8ea21e151b2b07ccd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436134, "uuid": "d8090da3-d728-4e21-bf46-c5657f78b457", "comment": "Malware payload (Mirai)", "value": "4d8b043e05f4284940ff9d1b9d0cbf0608e92ae4fe62116474a3472094b5eacd964e3eab4a8c18fbf2bc39ebadf8b631", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436134, "uuid": "7cc045b9-64fe-4850-acd8-678f0710e72b", "value": "T1605192D7220607316DE29D22BEBF88693594D1BB64C7EF59ACD8BCE4428DD083C4168B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436134, "uuid": "6e84b26b-06b0-4306-9dc0-d943c8b20e2c", "value": "24:ItZhesZqNqIhOEZTr3ZomAZiKPsZKRZwT6wTGF7JZ5n5GAZC1LZ666NINksZodr+:i3LEJ30C6qTXTGFl/ALrJyr29TxV/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436134, "uuid": "2ac0b188-f1b2-4882-b2f3-0aeed333d50e", "value": 2729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436134, "uuid": "2a40ac9b-05d2-441b-af56-a2e1f0729bfc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436134, "uuid": "674826ec-8bbe-4b4e-ac24-20b066ad394f", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385b8fbf-4cc5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778454536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778454536, "uuid": "9151221b-0a52-4815-9c26-50712cd20ec7", "comment": "Malware payload (AsyncRAT)", "value": "af936b56e6f109e234bc06134041959d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778454536, "uuid": "a7e2285c-f34a-48f6-bbf4-adbfa3a172f4", "comment": "Malware payload (AsyncRAT)", "value": "3941d2e13d9ed19d7f867bd266338e9ec0c8eb986ff656743c83c6d1a03555cc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778454536, "uuid": "6cbc756a-29ae-48ce-9216-4c36d17fdaa6", "comment": "Malware payload (AsyncRAT)", "value": "e92bcf0d7f2ed18a78af57734e936e781d7fdd53", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778454536, "uuid": "85005d30-b4ff-4f16-9667-051436c9c89c", "comment": "Malware payload (AsyncRAT)", "value": "afc28c3e2719117bde0e77caeaddc95178579e89c40fc18d1b9ed09d7d57d758e44d04a0e4d47585a8251a2a6a035fee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778454536, "uuid": "965b5e94-722a-4d9f-a670-58d263abb94d", "value": "T16E231B003BE8863BF2BE4FB898F26145467AF2673603D54D2CC452DB5623BC696426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778454536, "uuid": "fc42b1ab-85bd-4de1-a7b4-f17467779a8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778454536, "uuid": "c09d4ddc-d949-41bb-9e8d-b97b6bea6acc", "value": "768:ZuoqdT1LxHaFzWUfbmBmo2qbNpL+Vl78tPIWzjbkgX3iuQXfvMZD8KLqoGBDZrx:ZuoqdT1LoG2CU3W3brXSuQP0ZtLOdrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778454536, "uuid": "57b55a3e-1d06-48a9-af3c-f39254e8296b", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778454536, "uuid": "9ff02366-c1c7-45f4-9abd-d60b88c835e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778454536, "uuid": "f812779e-8683-40dc-9c75-80baedd4a309", "value": "nacmayne.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6337d38e-4c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1778438287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438287, "uuid": "8ec91409-23b3-46aa-a96a-7ae8f0a60408", "comment": "Malware payload (LummaStealer)", "value": "4261b69428d4e6fe140c3669f20d2230", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438287, "uuid": "0d4bdaec-8099-443b-b616-80b69291945c", "comment": "Malware payload (LummaStealer)", "value": "3b7785f621180031a5ca50a3da53f3eb4ba435729318f08758470094a32b9706", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438287, "uuid": "4ba470d8-d723-492d-b4d9-6679a2127fcf", "comment": "Malware payload (LummaStealer)", "value": "9dc621e05cb65e1a8b1e78ba8216474ad571efd9", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438287, "uuid": "cfce9cdc-063a-4ca9-b952-85199ff7b6de", "comment": "Malware payload (LummaStealer)", "value": "9ff2a4db6d18c156d79c9c6c8d0380e9f825cdec60daae75594f3eb2314f49bd0511404b1ad0de04c3144e9b20dacff3", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438287, "uuid": "901dd3d0-fe60-447a-a49a-b63cd8566e36", "value": "T15295128276D023F1E0384A76A19A01B2773B7CB56B5967B70184F23949C31A397F2B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438287, "uuid": "97da2e84-396c-47cd-88c1-f6d2261e1067", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438287, "uuid": "ca64aebd-9cbd-486e-9ba3-5c302e07fa16", "value": "49152:ljWYzXYzpmchqG9ucmsp4F2jX6s/Y1cZSA5:MYzXYzpmchqhcVp4I6sQ1csa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438287, "uuid": "00a4ca59-11ab-4ea9-9b8d-2cdef12332a0", "value": 1970176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438287, "uuid": "612d2402-8c60-4ddc-80b9-0ba9b2cdd141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438287, "uuid": "75d1ac27-83a2-495f-8777-29c563031194", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bdd90c-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778414107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414107, "uuid": "7bc56bf9-4861-452e-825d-2860104a7c25", "comment": "Malware payload", "value": "17aa08ec8dd1884ddbe33c6f2c7c60ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414107, "uuid": "eb9e7a59-4cb7-4595-b939-186d7ca1afc9", "comment": "Malware payload", "value": "3cdf09771b8685ac6367581da95e820ea2569c23efb2f235ac805572831e91f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414107, "uuid": "9370c378-1967-4f0f-95d8-7054995bde08", "comment": "Malware payload", "value": "4caf46dcfd0a0da1b582cc90e4bc5d65de860d5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414107, "uuid": "cd42d0bc-4b81-43f1-8719-07c0bb14101f", "comment": "Malware payload", "value": "0a803f495af7449700cb94fcf643a0104919b956e27ebe66d8c29372b759ffb89c3adb27996a45622d68922943d01c1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414107, "uuid": "a9b651e2-c401-4650-97d1-cc97e78a05d1", "value": "T1C7760897B9924942C4E83A77B8BE80C433A30EB98B8756565D05FE3C3EBE5D90E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414107, "uuid": "ff57941b-08f1-4ed4-bbf8-6eec74ed5d85", "value": "49152:mQkAUXcxmDWNgssdJaAZJKSW9t0zJi5i8vGp3FHHs9DTuqqKsw+oai8lchtp5ece:7jCWNgssvGThtpJJ6aQES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414107, "uuid": "e745be0c-9cc0-4bb7-a3cb-b5755a426ba4", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414107, "uuid": "f337854c-be17-4f42-b0e6-860cc1a6ac21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414107, "uuid": "b19d442d-4f74-4e4a-9574-ac964d0a3697", "value": "vulcan_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3687c9-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371304, "uuid": "8144dbcc-370d-4fb6-94a9-c63cd74fa5ed", "comment": "Malware payload", "value": "3027891528922923c1c2fc74b4713023", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371304, "uuid": "52aa9889-4bba-4e45-b508-8de340418c2e", "comment": "Malware payload", "value": "3d9f3e535c5fad70257067b9aa2a939401aff8109e05de4d16bafc27a36f2ff2", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371304, "uuid": "8aada4a5-45fd-4dda-ba29-94d9fc8c1d24", "comment": "Malware payload", "value": "a03988d7ec5f77da45545950fcd7087a2bbc4108", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371304, "uuid": "70417766-9ad7-41a7-954e-d9525223140b", "comment": "Malware payload", "value": "206d6d527bed805b697a27f9d5ca742f3b951de8f0dcbb8bacb3349f1408571498fb3196cb4f6e911cd446fa245c6297", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371304, "uuid": "7a5a62a6-2d75-4324-9419-ad19d5fc13af", "value": "T19C85D05473F84625F1FF4B35A972550886B3B89BBA20C74E0D52544E0EB1BC0DDAABB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371304, "uuid": "6680652c-e47b-414b-8a16-9abb3fd6f263", "value": "49152:gJ3LjciH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:m9KloSWVTR5Nhsm8A6xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371304, "uuid": "9336268b-1e0f-4f90-9449-3d6467ceeceb", "value": 1869312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371304, "uuid": "bc55ae4c-d4bd-4ba4-b14f-c994db319023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371304, "uuid": "571c2195-3870-42cd-81c9-778f6cb2ffdc", "value": "3d9f3e535c5fad70257067b9aa2a939401aff8109e05de4d16bafc27a36f2ff2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05c428c-4c0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778374421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778374421, "uuid": "cbcdd4d7-4e37-4021-b42f-14d45f4c88f1", "comment": "Malware payload (Mirai)", "value": "b6e60fe16f605295735f30ce87cdbf18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778374421, "uuid": "04619cfd-2696-46ec-9c92-5c55033c9c0e", "comment": "Malware payload (Mirai)", "value": "3e55d03b565ff3ae20fb4157f8b6cd5b29e34fbd361184f70e76a3c7ecb49650", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778374421, "uuid": "055d59a5-f6d5-4c13-8ccb-2689dea8c507", "comment": "Malware payload (Mirai)", "value": "515587fea42960d8e407540f9c3c17357b657c0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778374421, "uuid": "3002cb76-fea5-43f0-99c7-072ad4383ae5", "comment": "Malware payload (Mirai)", "value": "6b48a8fb2eda321d697e95f62f46efeafe5142d76e3b0e23f8a61d94828723d605f6f039cb262975ec0155aada678ee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778374421, "uuid": "379ce7b3-fb8c-41d4-834b-ea645ff161e2", "value": "T12A730A86A962AFBBC105B4B078F95E790B5ABC565E1F09D86439D6E1034F4CBB00F378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778374421, "uuid": "bdef888f-359d-455f-be49-ee485f288055", "value": "1536:rfL2VuxqZRg5YOBBSXLleoKFqu174yAGyC+/fQp:rfL20WXAPFreGyKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778374421, "uuid": "216fd80b-178e-447c-b007-2b330a465605", "value": 76040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778374421, "uuid": "f06335ec-f6d9-4e7e-bb7e-c601f5a98521", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778374421, "uuid": "dd82f213-e2e1-42dc-b0f4-c7f026110412", "value": "8USDaF.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae24027a-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371411, "uuid": "047432ba-c221-438c-a19f-3ac5d8f63cf9", "comment": "Malware payload", "value": "a0edc21278e98d79bacd1d7e482c0620", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371411, "uuid": "61701e39-3ab3-4374-8b65-08ec17011863", "comment": "Malware payload", "value": "3ec425509bacfddece8e72a58164033a58c1e95fd3a6e684e7a103704f4f4372", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371411, "uuid": "cca433d3-9c82-4a70-bd4a-02755576e2b6", "comment": "Malware payload", "value": "656cff218e65444bd57a546e144446e86d8aef41", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371411, "uuid": "60d19399-9c10-49fd-a558-80d1cb055185", "comment": "Malware payload", "value": "ced44d0cc07881d882fbb704006a0fc7628cc823038d8514a6497164250b21462ff6c0226add0eaa2819331a8ba3a52e", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371411, "uuid": "3564a288-6000-4f05-b1ab-ad52ebfbd739", "value": "T13ED3794934BB08B509A2243A411645429EF18B2E7F45D6FA312FDBA13F0CBE05DDEAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371411, "uuid": "bc107a6d-ea45-4550-8071-6ed348cccce7", "value": "3072:EJDJN6bge7IOaWPju3mnVDUnOVdd9yd3oz:EJDJO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371411, "uuid": "1f55b307-9c26-466a-b86d-dad2811b0403", "value": 142346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371411, "uuid": "bdee186d-1465-4017-8d5b-678d3ad9987d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371411, "uuid": "4bdac250-8a2b-4793-897e-cb43735e4786", "value": "Office_Config_Beta_277.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c19b557-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448556, "uuid": "e8c0fa83-5dc2-4ec2-a4f2-d4f61184908d", "comment": "Malware payload (Mirai)", "value": "6828a144f2c4759d93e4f9f466d814b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448556, "uuid": "d5a80aa8-b3fa-42f4-9726-27f636d29615", "comment": "Malware payload (Mirai)", "value": "3efa704cce64c3fe9197d775132fdf7714903ca51470ae610ae32744e14b9154", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448556, "uuid": "f8d6a1a9-5d8f-4730-94bf-eb6ba92732ec", "comment": "Malware payload (Mirai)", "value": "f77bf60a9297b0dd9880600774ada2cab3b812d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448556, "uuid": "e7d0c565-2397-4568-86b2-193199df1155", "comment": "Malware payload (Mirai)", "value": "8db89a8adce393a903b8a8f428b8f19d76a3e8def90d8f1c6c64559755e983da5abd16d44e2b3c81ba0d2272eba99a35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448556, "uuid": "eaba56c5-feb8-451b-afca-fbc7861d7480", "value": "T16F831895B8818B12D5D512BAFE1E118E3313177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448556, "uuid": "58d58166-bdb0-41e2-9d31-d11b623fb595", "value": "1536:ijna/CzPC7fG77nmhsUrrar1FtQtMEig+wG3if7z7ueY52Y0s/hG:rwP0km+Urrar8+wG3if7zKeYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448556, "uuid": "0e322857-99ad-4407-8f5e-4e399c6fc9ad", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448556, "uuid": "d82fd9ab-751d-409f-a63f-f8d9a0c39c13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448556, "uuid": "2bdd78a7-92a7-4a09-a1ec-26b8250e249e", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fef1bef-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371334, "uuid": "0c0d2329-e792-4746-be79-f891a0a32e15", "comment": "Malware payload", "value": "9cff5daa37237fa57d0bbc7ce5a07929", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371334, "uuid": "cd8f9ed7-b663-4b7c-b367-6debba5968d9", "comment": "Malware payload", "value": "3f6b12a7064385963f57156d7ef173af8a6bf7db9f4765cdaa951cf01ec1c4ed", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371334, "uuid": "0f0e13c6-bf4d-4baf-9672-dc24e2ef44c2", "comment": "Malware payload", "value": "f042f67e05d8220801e0b15953708f166e4c0c17", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371334, "uuid": "4d64ef7a-1d7e-4d16-820d-82694710be0d", "comment": "Malware payload", "value": "5f886d97dc575ee0d5f5191d91b515c3c4b2fefbccaaea86fa96fd7dbbb19d27dd3140211f538a7d59a3faa51bd5e369", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371334, "uuid": "41f24f71-3ece-40d6-b626-c6c4d1a7b380", "value": "T1F0F45C28BBF8A61BD17F8731E572082853F26083B662C74F4D81A54D1F67781AE167B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371334, "uuid": "8354a9cd-d49d-4a73-8ed0-dccf616b2a92", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371334, "uuid": "0d5de540-31bb-4e80-8855-bcb64d51687a", "value": "12288:S0Z3d6BAAFclgapx+GLlbvtRyFclgasTl:/Zb/ln+eBRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371334, "uuid": "62ac27a6-76d3-4a0d-bf0c-799344ae1b7b", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371334, "uuid": "e2420379-99d5-4d10-801e-41771e8f83d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371334, "uuid": "75288563-a116-4478-a5ef-faca455776dc", "value": "3f6b12a7064385963f57156d7ef173af8a6bf7db9f4765cdaa951cf01ec1c4ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd8eba6-4c78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778421470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421470, "uuid": "59aae984-9a85-4deb-aa17-93eb1001250f", "comment": "Malware payload", "value": "b35ed52314eb6739bfde0ba64eaa89f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421470, "uuid": "c2a5ee50-4dc9-4d61-b21d-b983d61560b9", "comment": "Malware payload", "value": "3ffe848a8b85f1cbcf294686d5147c2a2bb67b48735d494b34c7cbafa49d4483", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421470, "uuid": "686c15f6-fbd2-4879-8610-138df3dcb235", "comment": "Malware payload", "value": "26ba97301fb92266524b8df6f7e3fcba7556a800", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421470, "uuid": "2cbf1792-345f-4a5c-a320-d4253702ece5", "comment": "Malware payload", "value": "c76e3478ff430acc8971637f378de6565350a78a8b878f8c4b44e1913f1f5e65dbbbad59d9906a07dde375cc2e9371ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421470, "uuid": "9c3627b8-7855-4707-9bd3-a3f22901091c", "value": "T1B9865B137A29EB0FC62821301DB2CAD427691C9682D79157B745F308FAF21BD49AECF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421470, "uuid": "10dc2412-c973-42b8-b975-07c31fe3a204", "value": "49152:84Pyvf3ICJGomQFzbQEM6lNkz5pQGgbTd6TmG+rgZOMTgHQ6RLEIPF3zrXia5ppi:OHNAOWgxiQ0TJVCBJnUjEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778421470, "uuid": "28c65aab-bdab-4657-be47-e1922523d066", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778421470, "uuid": "2d8f25f8-2850-4928-9afa-aa4a7cdadbef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421470, "uuid": "d0fe650d-2ecb-42c3-98d3-e51fce248cdc", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6275555-4c9d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778437567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437567, "uuid": "021ff756-2009-44f9-aad5-cf4b254dc295", "comment": "Malware payload (Mirai)", "value": "4bffe0e3a69cb604e70f5b0b0bf4ec5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437567, "uuid": "e3ef353c-7ec4-494e-8c4b-c536be64c15f", "comment": "Malware payload (Mirai)", "value": "41636c1901c2e23dbb4947fc1a0fff52283ff909364722fe6171eacb5ec0b62f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437567, "uuid": "6d2e96ce-1db2-4d11-8398-e6d401db7c7e", "comment": "Malware payload (Mirai)", "value": "27ea7b1d7a37514acab219a1d922861acf658309", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437567, "uuid": "bbd80087-3dde-4008-86eb-dfa4d150a477", "comment": "Malware payload (Mirai)", "value": "79091138f8af355042377352774a45c51b843995d1669c62ad27d81fb73fd892f2b06a4430fb82009a9d2444a2793943", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437567, "uuid": "45dce6d5-2aa3-4152-a8ec-9ff349aa01d3", "value": "T105560797B9924942C4E43A77A8BE81C433630EB99B8752675D05FE3C3EBE1D90E38354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437567, "uuid": "1fcb663d-c9a2-457d-b04e-de45de4d3b6b", "value": "49152:c4K4/Ux0sm4Ss0/YCQNezSBREwU52R5Ep:e4/Y0sm4Ss0/YiCREIEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778437567, "uuid": "629c3b7c-3f86-49ed-a71c-cec3246b38d9", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778437567, "uuid": "dcc6fe03-9fdc-43a3-bd57-d533c11fb64d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437567, "uuid": "c7011ae3-e3cb-4fe7-b024-c68c53eb9502", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3056a20c-4c68-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778414579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414579, "uuid": "e46c521f-7cd5-443b-8be2-3523a1688cfd", "comment": "Malware payload (Mirai)", "value": "b8b7566f7d230929b0797f9db661f03c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414579, "uuid": "30b7ece8-db4d-49a4-a590-eec291278801", "comment": "Malware payload (Mirai)", "value": "429882997568346a590225ef6298dd5043e2c45ff2010d58e5f6178419cd55c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414579, "uuid": "cdcf433c-bed5-49a9-af16-2d9b61deacaf", "comment": "Malware payload (Mirai)", "value": "743e6b3fcb08495d1b9f4f7bd2a1c5e38ec2cda5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414579, "uuid": "795e37d1-e425-4a7c-806c-af55cc739f52", "comment": "Malware payload (Mirai)", "value": "6ef612aff3f9a5701f1dc74254de7274dc5be9a95b4b4c77fd44b658af9684aa0df6a389bf05f8d559ad8f81510aa700", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414579, "uuid": "5367f4bf-86f3-4641-aa26-aca08a627d08", "value": "T19FC35B03773D0D43D2A21EF03B3B27E553EEA59225A1F1813899AF1E80B5E364946EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414579, "uuid": "29083a00-c492-42cf-b112-c0d178351fe2", "value": "1536:dxorxTrar12SUaW+kaZU/A9CPW6LisNizgbd2SAvP0eah9VdkqaqjJyZ9AvrXDw0:3CTCGaZU/AM3D80bd38UVtaaFZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414579, "uuid": "b9bba3ea-b461-4b8b-a10a-9ce8ff4811f2", "value": 126100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414579, "uuid": "1cc44928-a714-49bb-9eae-befd47821c8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414579, "uuid": "834d1fd4-7f70-447f-ac05-dd624369fa92", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f4a43c-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371350, "uuid": "6e0fabb8-c01f-440b-beb9-45c4c690da3c", "comment": "Malware payload", "value": "10b02d62c4785d8205a7fb2b028c9454", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371350, "uuid": "68a95674-e754-4eba-b501-f37303b36424", "comment": "Malware payload", "value": "42d51495b580eb436f3dc19b07b6b326a9bcbddf28768bb8b2d3b13e641318b8", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371350, "uuid": "2f662c51-fdfc-4205-9c49-bd5fc38742b7", "comment": "Malware payload", "value": "870b016a6d4edd789fc041a2dbd6b94bc92b106a", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371350, "uuid": "bd8f58cd-a5c4-4e0b-bc65-18cc4e25be03", "comment": "Malware payload", "value": "deb5efcc1f5f6a66bb08f17ebdc4f96d80327e12d53b17e8b13c7b87d1bcf0e694b5164acaed4054959dc72c5a8cc3d3", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371350, "uuid": "a2460cd1-b8a9-4c8d-987c-a51112cce03d", "value": "T144B43A0873F84226F1BF07B5D5B264194773B897EA64C74F0D91A40D1EB2B809E9AB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371350, "uuid": "66c3f867-1a56-4ce3-871f-8d90df5c1a8e", "value": "6144:p2/azi3RoDBIITF5HmZ5wC/sWUDV9gt/6Dc9RGK07w9bYUrUlrOSNdcnTlV:q3RoDBfTrAsT+Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371350, "uuid": "768f6a80-0423-4bec-96ea-b8626153f28b", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371350, "uuid": "0a36de81-50bd-4c7c-8dbe-f7390052e226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371350, "uuid": "a7325623-c13f-403c-8736-7a21e3e27c4c", "value": "42d51495b580eb436f3dc19b07b6b326a9bcbddf28768bb8b2d3b13e641318b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471dab11-4c0e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778375963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375963, "uuid": "c0d16939-fd41-47af-94fe-e34d6cc2564a", "comment": "Malware payload (Mirai)", "value": "f44637e5211001f5d226752bb6e4865e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375963, "uuid": "eac0f8c5-6966-413c-9346-2b46164bca2b", "comment": "Malware payload (Mirai)", "value": "42e118f15398e7467639346573f8934badb6ceee6b4a666e5d8690dd292c34f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375963, "uuid": "158b51f6-3dd5-43c5-b2ec-970936864239", "comment": "Malware payload (Mirai)", "value": "2b06ade3d7104a112290d764d43d6dff614dd655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375963, "uuid": "4bd14a19-95ca-4868-a249-76aa710aec8d", "comment": "Malware payload (Mirai)", "value": "ed988d14b7258a01c334e67cf89221518db7663d3d365371e5247afeb1f0bcec7475b86d6f54dae0a7f8a0efa937aa8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375963, "uuid": "62d75a42-b051-42ce-8a71-e2a2f66f7fdb", "value": "T136B30A48F9146B19C6E232FFFB8E428E33535FA8E3FA3025CD315B6123C5A965A35521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375963, "uuid": "a86ad4ac-a88a-4e55-9716-4abc094f2169", "value": "1536:2vnti/EcfoDS1+3bkk/YsQmaMlGG6H67GlwyAIiiQ4l588jnjcMe2L:Ei/D8JrzxQmaMlGG6ex4l588L4MdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778375963, "uuid": "92cdb643-d439-46aa-b226-bbc82a87c561", "value": 107784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778375963, "uuid": "c05987a9-c086-447b-9827-e14d8b3f848b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375963, "uuid": "89542d96-5db4-4260-b562-85f32b5940bd", "value": "8USDaF.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1f3f34-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436290, "uuid": "cc24e3e8-9645-41d4-80c7-5d7665c819a0", "comment": "Malware payload (Mirai)", "value": "489e20be2a4956b290ee0fa8f68e0b2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436290, "uuid": "ccbaba53-b11d-42b9-991c-7e42aa42014f", "comment": "Malware payload (Mirai)", "value": "43f41eb04c64b4b3fb615fa62dc4accecc811cc314451419342a51479db2280f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436290, "uuid": "a4eed0d4-e6c6-4398-a695-d35e9b3ef299", "comment": "Malware payload (Mirai)", "value": "a23a4ee25175501cab6a4c429b436a1f9cb86294", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436290, "uuid": "cfff3ca0-4321-4924-a929-d5f2ec462559", "comment": "Malware payload (Mirai)", "value": "e303c9269b8f0bfeb07dc9a6b3e34769fa33db23aa0586ec2342ffb19424592ba3b724590417c977ba110410c49f1449", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436290, "uuid": "1cf9c17d-cdc0-4577-b217-109bfb3f14cd", "value": "T1AA736DC5EA83C4F6EC130A351136BB379AB3E53E2169DB93C368A525DC125C2DA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436290, "uuid": "885c4a39-9c39-4717-bbef-e6153511e20b", "value": "1536:9sXS6v5iRk8Gnos1LNxVZW9Z3J8h3qaccSJZq:9sXX4kZnokLNx+9zs3sZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436290, "uuid": "8373c4d2-b9f6-428f-8e3e-86236891c75c", "value": 79444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436290, "uuid": "51c1a901-c37b-4e6e-94fa-a6cdbd656eb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436290, "uuid": "aecf703a-bd0e-4429-a731-c67137d8025c", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2abc678c-4c85-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778427025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778427025, "uuid": "9794b440-d9fb-4af0-8290-e59d6d123cdb", "comment": "Malware payload (AsyncRAT)", "value": "1bd8744cc2d2f4e8c95e1ec2bd2d5bb9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778427025, "uuid": "9f5a24f8-94a2-40a7-a71a-fe77b777c37c", "comment": "Malware payload (AsyncRAT)", "value": "4401ef9fdc2418ae7a6f329637c768c21c1402b29be14b26f24be3bc0aa0394d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778427025, "uuid": "ac85d615-7c25-4ebe-9410-9cc1f22e88df", "comment": "Malware payload (AsyncRAT)", "value": "2959836d36c2e3cb3d981b9a7f33a3ff15df0a2f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778427025, "uuid": "4904d6f0-823c-4e57-8c48-cb7fba6c842b", "comment": "Malware payload (AsyncRAT)", "value": "f1c1d6c6bbd795e370005a466e5bc1398af408ce1afb66702c6dff9380cf68fc238d60c797a596de7095155399ea144c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778427025, "uuid": "b9b26a6a-3c9f-42c5-86a5-2c5504be0fa3", "value": "T168C35B073BDCC1D1E1395634BB62D6A0C67DBC736882E50E39C07F4B293AB91AA116F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778427025, "uuid": "1d2ddfa6-bd93-40b9-af12-879562e230b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778427025, "uuid": "0dace1fd-4e2c-4808-9817-6daf702382b1", "value": "3072:Uul6TE9X25xbGKn3bVsN68DGW+0Xhrj/IRMLsPta:Uul3GWm3b0GEFbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778427025, "uuid": "0b4d845f-1321-4939-8e9e-8ecc52f27b85", "value": 125952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778427025, "uuid": "b93d3db7-3522-4894-ab78-e2215bdb3590", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778427025, "uuid": "c32c219e-529a-4329-a18d-31bdd6f3269c", "value": "python-3.13.10-amd64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a212e3d6-4cad-11f1-a769-42010a9c0008", "comment": "Malware payload (Loki)", "timestamp": 1778444405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778444405, "uuid": "0c111907-5426-4baa-881f-ba48963fafe7", "comment": "Malware payload (Loki)", "value": "17c90d25e449cfe53fd275649a19d32d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778444405, "uuid": "10f49dfd-9ae6-4be5-a9bb-7af75610eb91", "comment": "Malware payload (Loki)", "value": "4524b41122fe4c00fb1f97ad22e259e2ad55bd8e91f1aae6874c9cbb2c473dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778444405, "uuid": "3c255984-22da-47da-8a7f-b88ee9d353a3", "comment": "Malware payload (Loki)", "value": "27c32c5a9ef36901aafc39c62fca67f57f78eeec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778444405, "uuid": "1f35b083-450c-485a-b01f-8a227e673436", "comment": "Malware payload (Loki)", "value": "92f1fe102fe0e12e6d205767335397932f9a3d8d6de9ddf77c4affa85b43da2eaaafab62c611c1c074fbaedd6ee1d3aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778444405, "uuid": "19b33533-2d5f-4d90-aea1-e72f9a21fd82", "value": "T103A31A42B2A5C030F7B74DB2BB73A5B7857E7C332D22C44E9352459A18215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778444405, "uuid": "ab66e05f-0cfb-4d1f-be31-daf2468d58c7", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778444405, "uuid": "7f077aff-6144-47e3-b494-a2fca4e3787a", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778444405, "uuid": "f003830b-2bf0-4387-844d-a6e8d686cefe", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778444405, "uuid": "26919234-7020-48aa-be21-236f7b52ae0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778444405, "uuid": "473c9c9a-b644-4f74-b786-e97d54ed01de", "value": "17C90D25E449CFE53FD275649A19D32D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c39dad-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413650, "uuid": "3a4e1235-0c76-4c02-9a4b-6d8efcc768fe", "comment": "Malware payload", "value": "dcc78bc66e730bf84e0033077cabaeb4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413650, "uuid": "94218ece-909b-4b28-bf03-64054155290e", "comment": "Malware payload", "value": "454b6d31ebcd196f65010de78faa98b3fcaae9460e70a452733d9471fed0b30c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413650, "uuid": "faa3afbe-5b3b-4a30-ba83-b27ff3d35f5c", "comment": "Malware payload", "value": "9072d09462d8570d6a5f973a0f4e36d794afc6f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413650, "uuid": "306cb115-9cd1-476a-acc3-33c6e75f731d", "comment": "Malware payload", "value": "7e4faeb6110a148e0910631e27c592b6b248819f2f67bcb84d7b9911a4908bbf844b2851e8d93d1f31f4c5971a335b31", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413650, "uuid": "d5ee50ca-8d5b-4877-884a-beee8bdd5b1a", "value": "T1808533B8540A128F9C7FECD45CAE5C11EA6A13FBF0E9880175AD9F08069D509FD9CDCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413650, "uuid": "a6700099-575b-4c91-82af-7d5c228186e8", "value": "49152:hzC83Va7CN+rmDNkrSe37sbGipq0JOeMCGzordduUn0t:hzra2N+rmDmYb0gSordbnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413650, "uuid": "ced2d0c8-f640-4213-a719-ede3c81683e8", "value": 1733136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413650, "uuid": "3d60c97f-cac0-468c-a98c-c3febd156457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413650, "uuid": "41938d9a-c4d1-4df4-a5dd-ed813f3df0a0", "value": "devfreq_wq", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb4c1e6-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778414196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414196, "uuid": "6478c0e7-9449-45f8-bbd8-9130f1f9b373", "comment": "Malware payload", "value": "8e5ab2b24ec0ac4ec0b961a778d36519", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414196, "uuid": "d6688a11-0fb4-461d-8873-263cc91f78ee", "comment": "Malware payload", "value": "45aaca0cc4b200b1ec9b2944f5318534c07688cd7745d169e3948dcbdf64b007", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414196, "uuid": "1923bf03-aebf-432e-8b6f-392ea185644e", "comment": "Malware payload", "value": "24cb22fb2cbc732ca464b0e805725f63eb631987", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414196, "uuid": "9515a6ce-9277-4365-9660-d489afc0741a", "comment": "Malware payload", "value": "ee7365562c6d3722fec03a62d824e0cbe5516cd8155801c07e2d1c6ec2e8ba920cc276b3914771d201196b19e647166e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414196, "uuid": "7df85263-28e1-46af-ac9e-93a727a458f4", "value": "T13E86E615ACC52BE6C06C4E7440EECE5222B46D144BF14A3A26A4FFE9BC762747F0799C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414196, "uuid": "6c23ca23-95a5-491d-a2b9-198eed0973a8", "value": "49152:6neU9d43eVhN2Z7cNUGTZ4X2cDPGSM8e7ISUV8RJ/xO/lT4OTgg5EJ:IHTZEAIVdTlpEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414196, "uuid": "6ef3f01f-c94a-43c9-bd62-95c8c58eaf9f", "value": 8257751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414196, "uuid": "583ef0a7-d3fe-4cc5-8d1f-49d835aef892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414196, "uuid": "815f51df-6af3-444c-b078-a8104a40fc7e", "value": "vulcan_mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6332605-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778414455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414455, "uuid": "9d5a35ed-d3a2-41c1-a24c-4e2374ae40dd", "comment": "Malware payload", "value": "8899ad219cb59dd490d268749306b555", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414455, "uuid": "267d34ee-7b64-4efa-b848-3ee83c1af870", "comment": "Malware payload", "value": "49394eaab890538d2cbcbf839456b4de421cf338898837f2267e0336e8ad861d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414455, "uuid": "57dcdfef-e23d-41f5-8c44-f2122e4f0876", "comment": "Malware payload", "value": "473f20fd7776f3666e6b8dc32e1a4c346d39007c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414455, "uuid": "65065a8e-fb86-4361-8376-3a8b2ca76be2", "comment": "Malware payload", "value": "72cba168543e0e43b6336c8bcc4cabd25d585d1212b6942f972907fc51dedc54cd42238bcd63656f11688c4f6bbf0286", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414455, "uuid": "4c084eac-61ed-4b30-9851-b414d11e50e9", "value": "T18B137D6956857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C19B9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414455, "uuid": "252a5bb4-4a34-438c-9377-9f70da56b90f", "value": "768:b5+c9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b5+Rcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414455, "uuid": "d0d58761-af0c-486d-a03f-5a4ee8a7e483", "value": 45441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414455, "uuid": "7b16ea98-cb44-4006-91c7-c6e15eaf3c68", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414455, "uuid": "e74aabd0-8744-47d6-9ab2-0ae9ede696da", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ea2a21-4ca6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778441130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778441130, "uuid": "a92c6f4e-f29d-4c6a-b54a-267c678d5164", "comment": "Malware payload (Mirai)", "value": "b07f60d2d8228fdb16ffcb31a08cc235", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778441130, "uuid": "9d389808-43f4-4458-ace7-efb2d4038429", "comment": "Malware payload (Mirai)", "value": "49988f9d356d4c21eb61cce538d0a9b70db4bbf0599384346ab140d7dbbb2271", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778441130, "uuid": "58201832-e98a-4631-b59f-51293b76dd5b", "comment": "Malware payload (Mirai)", "value": "e106699166f67e6e92593a11cb704f6d16cfa404", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778441130, "uuid": "604d6d3c-93f0-4970-94e4-c0ea375486b2", "comment": "Malware payload (Mirai)", "value": "befd158ebf96a9cceda7b2c88f6e70ab198f6766650110d1d6e6773f746c4a9b1676ea655b368e02046ee2017a941d72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778441130, "uuid": "8ef87006-3a24-4bc9-8f93-0dc00903a2e0", "value": "T125F31885FC918B13CAD221BBFB5E428877271768D3EF32029D255F64378B96B0E3A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778441130, "uuid": "3187a6b5-47bd-4a61-8157-466a7eef9b5b", "value": "3072:TokvcGfR08RYq7Tl+guFPNtDwN40bCf+l0RZOQiQZ:E2cGfR08iq7Tl+F9DA40WffDOXQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778441130, "uuid": "2987eea5-b85e-496e-a708-05958a6e72f8", "value": 170524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778441130, "uuid": "acf34e65-1ac3-4f41-96b0-fc47781b01b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778441130, "uuid": "a25c36d9-1e92-42e5-a340-fefc221d42f4", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0daa92e2-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413662, "uuid": "86053503-3904-424a-9a02-98763d1701d7", "comment": "Malware payload", "value": "1922e2f52882bd624039ade0f93d7a66", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413662, "uuid": "55b70d50-b3f3-4bbd-ac58-b6af0b62c15f", "comment": "Malware payload", "value": "49c3684459c07b044d350c187aaa43dce6751bf99c5a02445e0141d307c4b7c0", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413662, "uuid": "4bbba69c-058b-4d98-8af3-4e01d15e842a", "comment": "Malware payload", "value": "c8e73e87b852ba367e8900903f03897854bf1258", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413662, "uuid": "fd5a9bd3-0ede-4ecf-a7e1-ac373e337c4c", "comment": "Malware payload", "value": "c48c317a3458f908313b6bb2dedd27b79a58981992af8291cd7f91c45359af533d3aef8f5c2ec83fb24014501ef44bf8", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413662, "uuid": "cf285393-ccaf-4f95-8c58-743e1e356a49", "value": "T1938533841EAF318C1260CAE2795FF44EA6850C22B75D344B2FB1766CFA6DB94F271D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413662, "uuid": "a53a0761-c011-4ed6-8a68-b5d362f4411a", "value": "24576:lJGH8U886Drx1kfK9cOBj+1i8Mv5fz5+vYUPvQLY5KStgBJQH0zQLD1Xnt1/39:vGcU88+x1KKjHpfzUn5BR00L5Xj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413662, "uuid": "08a72efc-632a-473e-b2f5-045616c07a9d", "value": 1731908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413662, "uuid": "a69bad8d-07f1-48aa-a84e-5160bc7e5d52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413662, "uuid": "15a15011-5fdf-49fb-9cd5-9234c66eb952", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f6e9bb-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448460, "uuid": "53204be9-d11b-4e5e-952a-a14b82bc07b6", "comment": "Malware payload (Mirai)", "value": "bc385b8789ec8796d5e14475840497c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448460, "uuid": "acdb6e0a-2b2b-4cf1-ba90-90f4f8ddf85e", "comment": "Malware payload (Mirai)", "value": "4a816c942d1e9033f5e3f6aef62c501dfa1d6c53eaeb4d8ca3d6da66ba25e1c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448460, "uuid": "ffe11dba-c3e5-4e50-927c-e3e90b530417", "comment": "Malware payload (Mirai)", "value": "891f7525d118cf83d23ad8ed0a71efe4bbedd4f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448460, "uuid": "de8d3dbc-6008-44d7-bb2a-fe0bf9240424", "comment": "Malware payload (Mirai)", "value": "647fd0fbdcb3fa2257979bb87b7ed4afe5edfde1bb49df9daf43ccc25d3f13748a85979c981d9de2121aec1be2eb18e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448460, "uuid": "a7047eff-a318-4606-a23a-9d4922e08b8b", "value": "T1D4E2F26A51ECB12CE44E903BC32FA98E31E65D11BE1BC69424C476DADF611F910B6833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448460, "uuid": "915dc90b-490c-4012-9133-a6c8bd869100", "value": "768:g32bRAqg2JQzSPMjFY8AFOEPB6ZSq7xnwNQBUO:DbRAp2J4ECF+FvB6ZSonwN2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448460, "uuid": "032a45e3-bdfd-4a3a-a422-a9269de910bc", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448460, "uuid": "ae8693b6-d958-4663-af16-c3cfb00a9f7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448460, "uuid": "91a903e9-df98-4f5f-897e-20ecdb223b1b", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f05e87-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413870, "uuid": "d3b56f00-81d4-43d3-8958-8d4414ada61e", "comment": "Malware payload", "value": "2bfddb70e7a9dcc1f551c2d2e835f8e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413870, "uuid": "305a2098-9563-42c4-87eb-2e5056c7fc69", "comment": "Malware payload", "value": "4a865d861818ead9fce06c876236a5bd6389e6ff8ac07b66a069531d37d6efec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413870, "uuid": "cf3b454b-6e18-45fe-bcd7-c5485f135cb9", "comment": "Malware payload", "value": "ce38a8df482670bba39ffcc2276e9eb84326190f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413870, "uuid": "4206c5cd-aa0f-4ee3-8c9b-79f736dd3d0b", "comment": "Malware payload", "value": "b463dd454e4385a4f94db2aa890eca49d66b39a0dfa6db1537e6dd353dc9b8cd99347ea6a4e29a950590837cf37f59eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413870, "uuid": "2be8bd30-7a6c-4930-ba0d-7d78b6f1a225", "value": "T1C0560857B8924943C4E83677B8BE81C433671EBA9B8752566D04FE3C3ABE5D90E38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413870, "uuid": "12165ebf-8b3c-4aed-96bb-c796880340aa", "value": "49152:V4d1pJdN/w1VpEn0Y7OSCQvpTM7UWmNCqDlPdxDg5E54:id1qpCRv3vlPdoEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413870, "uuid": "5956b03d-6f3c-49fa-bdea-80b93054c5f4", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413870, "uuid": "6780a5cd-a0be-48f1-9efd-d6a44fa5b437", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413870, "uuid": "1b64b539-41cb-46e0-afb7-dacf916d14ca", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606d39bd-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371281, "uuid": "8beeccd8-2b39-4412-8545-200fb43910b0", "comment": "Malware payload", "value": "9d510b91ef43d506103722fe5b52cf7b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371281, "uuid": "bc6dab23-e622-4d2c-a2c9-34ade90d2f0d", "comment": "Malware payload", "value": "4aa1d79f881341884540e77236f3a1814ebfa8f5e298598857f02c5c78cabc74", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371281, "uuid": "177d935d-3eed-4b87-838a-1684861eb5f5", "comment": "Malware payload", "value": "084422fe457fa6cabb6f7c7236e19c53ae473e10", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371281, "uuid": "cd31a6c0-ee45-4f30-be7a-e1ff37c05df5", "comment": "Malware payload", "value": "021155d094ef193201965b356a490a500ac8269e048d63102cacf3554f4d7e715cfe7129f5c9aa603752557ea0f13d2a", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371281, "uuid": "fee5b947-3ca9-46f7-afd1-eed0028c24ef", "value": "T12B258D1477F8671BE17E8731C2624C2517F2A09357A1C74F4E86E94E2F67382EE066A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371281, "uuid": "d74e3db2-44d6-4280-b9dd-3653c6d37255", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371281, "uuid": "d4411fbf-53f4-4edf-bed7-3c68161f7d4e", "value": "24576:xYMzBBBSIQF+rHfnnBSIQF+rHfMsUiKXzB:RzBVQIrH/QIrH/UlzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371281, "uuid": "7ab85add-e1c0-4c5c-b7d5-3dbd0f754192", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371281, "uuid": "288eec30-3d9d-4123-adca-184671184ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371281, "uuid": "df4d826d-135e-4227-a967-650045780983", "value": "4aa1d79f881341884540e77236f3a1814ebfa8f5e298598857f02c5c78cabc74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df6317b-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371357, "uuid": "2d253ac1-2259-4ac7-858a-5070b771f0a0", "comment": "Malware payload", "value": "eb5389486e18d3850742ea52518180c3", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371357, "uuid": "f255f2a9-aa64-4179-b408-f89e8f9c4f43", "comment": "Malware payload", "value": "4b78fa1c8a20f993df572e92516697bbe963b21c981e37944e42c4a5be81233c", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371357, "uuid": "4b4a3247-3d79-4b65-bd13-24dadcb208dd", "comment": "Malware payload", "value": "4cc38e8319444aac68ad8051f2d433ab0ea85147", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371357, "uuid": "fb0b5a42-c530-4759-9f21-66a8e8499d81", "comment": "Malware payload", "value": "3bdcf000bc442b361b4b800834a8629cd98ed7c6e75039f0850cfdcef3ffd4c8b6d6803e0c7512a8329e3a0ceae7ca7a", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371357, "uuid": "d8a204cf-151a-4038-83ef-6cd2532a9fbd", "value": "T11D258C1477FCA70BD23E4731C6B38C1953F260939A61C74B4E96E84E1F66781AE126E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371357, "uuid": "491cd00d-d188-495f-b6ef-35e629343066", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371357, "uuid": "1c8cbcff-1c2a-46ca-b9bf-5f2ee0d46cbc", "value": "12288:EKpJXVN5FKG1C1TeQhw1VPzC1TeQhwPbZHS5MqdwDFKG:EIFfC1CQhw7zC1CQhwPbZHS5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371357, "uuid": "c9739849-7dfc-4cf7-bd9c-2aeca435a9ae", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371357, "uuid": "e5e91676-2fde-4dcd-b28a-0bf6512bc528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371357, "uuid": "621a4a16-a98f-4508-98ed-7670eaf7364e", "value": "4b78fa1c8a20f993df572e92516697bbe963b21c981e37944e42c4a5be81233c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4013f8ca-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412458, "uuid": "136ace03-177d-48de-aea2-e12ed79ee01c", "comment": "Malware payload (Mirai)", "value": "e0f6002a0100b00af8deedd74888ac54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412458, "uuid": "c02eb868-db9a-41e3-ab18-b77efa87bccc", "comment": "Malware payload (Mirai)", "value": "4b9b2e991d9f591aa7be6e65a21d5a9910f7673fae8895823f79981da14b92e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412458, "uuid": "b658dc4e-0912-4b76-856b-ad0ee2bed0ff", "comment": "Malware payload (Mirai)", "value": "7b10f41e331c1f9e2baa7fc6ea6a798727a4d3f7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412458, "uuid": "fd67d565-2f89-4280-82b6-94394b9cfcf4", "comment": "Malware payload (Mirai)", "value": "21083392eb8de52ae0b9e9dca4b3b55b9a0ad848efefba4037d8d60b2ec667bdae929abaaca67aa6c4cd344f2b1182da", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412458, "uuid": "6c93254e-c9d1-4c7f-ac55-5adad2e74e53", "value": "T15C83084BA72C0B47C4AB5AF03E3B27E4875EBE6111E941C85516EFC503769B13112FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412458, "uuid": "efcfcb03-4b30-41c5-91d9-140c68edcf93", "value": "1536:7nNox0CMwBNpugJzvq+teV4jkbFbzI98D7i:ux0CMwnpppuVakZ8KD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412458, "uuid": "305f176d-f29d-4c5b-b3fd-0cac083be1ca", "value": 82672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412458, "uuid": "835bdb36-df2f-4446-8de8-0df98e2e4fa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412458, "uuid": "92f9d106-3b5f-484d-ad0f-7e165401d9d4", "value": "xtc.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89c41d1-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413949, "uuid": "cc33bc64-364e-4490-b49d-0007de52da29", "comment": "Malware payload", "value": "97b815f8c5d665006225b0eeb1fdd56b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413949, "uuid": "3f77354c-9cfd-46f9-ab64-e5d53003aa9a", "comment": "Malware payload", "value": "4c7a061ae24e3927274c9c75b5a31c95bc1d4a804796f21c90db50395e78e9d5", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413949, "uuid": "5fede8e3-4d75-4e01-a4a0-459992cd2150", "comment": "Malware payload", "value": "51c674219b0a08b69dfea9d92903898287cf2b9d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413949, "uuid": "fd2b85a7-55ff-4cf1-842d-708e7e3ed88d", "comment": "Malware payload", "value": "72c6d6585dbc547ca991594ad33e01954e16030547435e742b3baa1eae1bf200cec1b8ed9c38d7d321ec984828f02d63", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413949, "uuid": "944d89eb-ed12-4e32-abe2-8e1bb34a486e", "value": "T128B533EE4EF355D6E96BD12E0875C669193404B2720077209F949259F0EEA8E8F13CEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413949, "uuid": "b286b3f8-0f87-470c-9c94-f80a8a81103c", "value": "49152:GWd54DhCcvDVy0mbaFzjkdld3HzP/e/MTqN91ALJnpiOKfXU4a:T4Dh3s7GhjkdlNPW8UKfK/Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413949, "uuid": "fbb3ec2f-03ef-41d5-8af5-aabd0ddd3940", "value": 2357080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413949, "uuid": "665d83e8-23fa-4b68-a507-b1ac1ff47d0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413949, "uuid": "0cf7c7ba-5d60-4736-a519-2fa58272cacf", "value": "vulcan_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0296859a-4c69-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778414932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414932, "uuid": "dd8d1adf-39ef-4f95-9f90-26ea221dd3bf", "comment": "Malware payload (Mirai)", "value": "2ed75cd73f6f36e96fd65b1fe7a58440", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414932, "uuid": "c792315d-8fd6-497d-beb3-5bd582b0abdc", "comment": "Malware payload (Mirai)", "value": "4ce19e2ffc070552e730e8583b3142eb8da51841b76d2d901edd12afd4383587", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414932, "uuid": "f89ac971-6b07-4093-b4db-e4736b03bf0b", "comment": "Malware payload (Mirai)", "value": "c1002f175f12b32bcb3c93e32bd56840b932520e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414932, "uuid": "72a7c950-176f-4560-991c-15cf5144002d", "comment": "Malware payload (Mirai)", "value": "f1f9a08755427c43401187405e66473b31b96bcce0120087c1386a9479634bbcb82e0d533f31633d57907881eaa4ff6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414932, "uuid": "9d0dad11-a6df-4d8c-bec4-e44591dfe4da", "value": "T168261B87B8924983C4E43676B87E80C433A35EBA9B9753576D04FE3C3ABE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414932, "uuid": "8759dca1-f432-47c1-9507-f7f32d10b2ca", "value": "24576:KZL0elvVA+6FzudFg3qehmCNGtxKr7wrauZD8p+nXsHulklqgytXxnsxOy+YOAEm:K10vIcu1FUfd4ChonyeFkOVFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414932, "uuid": "4e94c913-0997-4210-911d-6ef8ac132267", "value": 4849664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414932, "uuid": "fa1475b3-caca-45d3-8dae-1669daa59de4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414932, "uuid": "f6c7f947-306d-4db7-9d8b-e53eb2481994", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda95bb7-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778389530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389530, "uuid": "58c465dd-1c86-4216-94ea-b7133ed28353", "comment": "Malware payload (Mirai)", "value": "6400de2816b71785309f68f3f5e7bf00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389530, "uuid": "d021cd0d-84df-40fa-b16e-5bbfdc52a55d", "comment": "Malware payload (Mirai)", "value": "4d10e894f61f4145fcb923f4f465058e2f8b0ec03b06be9dce9678f35d94a134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389530, "uuid": "12e04e10-c501-481e-8718-03e0e047b4e2", "comment": "Malware payload (Mirai)", "value": "6175c34b4e4f01f07f15259a537868832bf9f197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389530, "uuid": "7d1a7181-9c03-476d-9cec-b4b85720c4fb", "comment": "Malware payload (Mirai)", "value": "02b760abce8f8726384abc8102f8439d19eae92047800bfa3a8e7174b5894d5a5a63b79b8de4f969ecc1bb1a33efc956", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389530, "uuid": "406c589e-21ea-4fb8-95a1-7a5300220a5e", "value": "T195B3AE9BB74B2490CC2186F447CB4BED2E2332015F5B99F72D1D363A19791DB4A0A7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389530, "uuid": "46dba09b-3995-438d-ae49-a8fd6b7868e6", "value": "1536:JFoyDS+1CgaaqQQsQzHL6KwfElUP7BDEE67x1tso/LWW:jNDS3gaaqQ3iHmKEEg7BDE7hqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389530, "uuid": "0b33f2f7-428c-4edf-b3a3-3c6a26f3a19a", "value": 116336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389530, "uuid": "41853c8b-b317-4d21-983a-9ca3a52fe179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389530, "uuid": "eeb1bd11-22e0-4388-a741-3ff45766c032", "value": "manji.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ceda28-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371479, "uuid": "de68014e-c1e0-448d-9b8a-d0d34a00c9d4", "comment": "Malware payload", "value": "88f9f5c355b212cf2aca638607d8aa68", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371479, "uuid": "a184e276-9450-48de-8663-7c86fda09dae", "comment": "Malware payload", "value": "4d8593a01b62278a2c2c1c7fa33be3c791ddee2ccb227b83820a217d9bbe10c9", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371479, "uuid": "875d8e69-9851-442b-9b05-7a07476d8ba2", "comment": "Malware payload", "value": "745f96f057368d3d051b57c77ad81228113b95e4", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371479, "uuid": "75dab60f-9a9f-4f44-8a94-dc27fd7ef7eb", "comment": "Malware payload", "value": "edbbfeca6199137408803df597abdefafafe4a63ade186dc4c5ce221e9eba634caab2a99c9ed74a51c44ad2de6e861cf", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371479, "uuid": "fc6cfcb9-0136-4f9a-ae33-40e87fc40217", "value": "T1BA245A0CBFDEE95BE93C527546A3086B13F0906312F94B0DAE8A0D9A9F193C2FD17561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371479, "uuid": "95015771-7f8e-4aa4-b34b-5b2a32d5b145", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371479, "uuid": "1da4a495-b01f-4976-8b5e-5ede1868fc7f", "value": "3072:wej6hJYGhSQ9HF5xyKm+fJnvmU4vHusbvsSQ9HF5xyKm+W:wPYG19HFLPm+Bnvmusbvw9HFLPm+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371479, "uuid": "4155340e-5d0a-4acb-b9a8-15c43f699d61", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371479, "uuid": "eb285429-ce67-493a-897c-aa4d35240f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371479, "uuid": "58ee61ca-6c7f-494e-8cda-f951804c8a40", "value": "4d8593a01b62278a2c2c1c7fa33be3c791ddee2ccb227b83820a217d9bbe10c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c82385f-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413848, "uuid": "03ad1de7-9cc1-4560-88b6-9deb5cdc7d5c", "comment": "Malware payload", "value": "772aec4585be0600acb8da83ad8ff7d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413848, "uuid": "69df5f6d-be6e-4af7-82d0-b7ec4c119e45", "comment": "Malware payload", "value": "4da44325b516846448abadda1f8db209f98c66d767f122ef04d356a6b2feed67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413848, "uuid": "d2f9c9b1-3eaf-4f9b-a2bf-ffcd8e22082c", "comment": "Malware payload", "value": "9f6c41982ea6ee5e21b343772694e60dc9cfa8a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413848, "uuid": "4d3b6a33-79a1-4465-97d9-a8acbc5ed560", "comment": "Malware payload", "value": "a1f2c801f5ca32d28fd06d5bf04cc14f8031cf4616c86b95f7440528b9d1ace86be38b8d70a93f76bb83997e64351992", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413848, "uuid": "003470c0-b93f-4fcf-a895-224ebd4da6dd", "value": "T159560857B9D24983C4E83677B8BE81C432635EBA9B8652566D04FE3C3EBE1D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413848, "uuid": "a3db1a75-5192-4a88-83fa-f2e81baf8870", "value": "49152:Fgh+fvtxLCD4ut5DSxg+Gn5Gp3GjE53D+pd1nLUg6y+0Lg5EeG:Fg+TCPMH/3D+p3IE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413848, "uuid": "347c1c50-56f9-42cf-bf22-7020040c6184", "value": 6160532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413848, "uuid": "5ee4e94a-adfc-4922-b2ce-364f1fb95576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413848, "uuid": "ca55ca22-2d0b-4444-aaa8-8b6c97b241f8", "value": "jbd2_sda1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56ed3c4-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371396, "uuid": "6df9f4d9-5aca-4314-8336-67879ed54576", "comment": "Malware payload", "value": "4a4f2ba3041ba743168b05c98946a1fd", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371396, "uuid": "2e3226bc-8ecd-4c58-9b5b-fadf6f48449b", "comment": "Malware payload", "value": "4eea97aef1a889563b308b0f55439003a55e192731bf40b44b893caf4a6e422f", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371396, "uuid": "ba7f3cb2-8940-456f-8b09-a3442f07ca5d", "comment": "Malware payload", "value": "937e101fc0f96d76d5ade479b7cbd75d7d20ed20", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371396, "uuid": "e68dac60-cb0c-45a1-bdc8-02bb08e812f4", "comment": "Malware payload", "value": "1ab89cc116fb472ab3d754aa54db55bbe1a91d5d3ae8430be297e84be0acd4ed0434e160ba052aa7840a21cca961c847", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371396, "uuid": "481ccfea-45ee-431c-91c9-5d59b0cd75f0", "value": "T1FF346B08BFDDF55BDA3C56714BA3086703F090A312F54B0DAA860D9EAF1E3C1F956261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371396, "uuid": "ea18b0d9-c423-4915-ae18-5d1e9d4d380f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371396, "uuid": "bcbb0a3d-8cba-4810-af71-ba2c845039fa", "value": "6144:QRbO9HF8ASm+UkS6f7Tvxvg9HF8ASm+I:WSF8AGNfX5EF8AGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371396, "uuid": "bba965d9-ef99-417d-aa32-dd818d4624d3", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371396, "uuid": "e27a9cc2-947e-40ca-8f4d-5d1b37729f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371396, "uuid": "84b4d44f-12dc-46c1-9965-3ca9c3903826", "value": "4eea97aef1a889563b308b0f55439003a55e192731bf40b44b893caf4a6e422f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814d85d0-4c64-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412997, "uuid": "7db225b7-50bc-4279-a609-ff4fc70b5faf", "comment": "Malware payload (Mirai)", "value": "57b29a97b7359e1aaa241fbb206aad58", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412997, "uuid": "b58853f3-d48b-4fc4-b907-525a13969f6d", "comment": "Malware payload (Mirai)", "value": "4f13c57112ee35a05d4d4a84d4faffd03298a746a7b0c425d1db148f48629946", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412997, "uuid": "f20ae303-d353-427d-87c1-8b139e9da341", "comment": "Malware payload (Mirai)", "value": "cda3338663f214b74d461d58ed0192b6dfd61db5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412997, "uuid": "c789aad8-d2c5-4fd9-824b-b03f9214d132", "comment": "Malware payload (Mirai)", "value": "0d737e820113800b73162804ddfbeec57969c00dd6d9b012653b0dbedef9e4188e8c17eb5f33d8b7936b92c60e80ae24", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412997, "uuid": "7ac129bd-ed8d-4837-a461-0196dd8f4815", "value": "T107762711FD8B50F2E9030D3105ABB26F63315D064F29EBE3EA407F29F97B691193A199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412997, "uuid": "741a6477-5082-45cd-98db-4393b2612b9e", "value": "49152:IR17YvvPDli6R760CSilQu/RAeOsL2U/+u42CCWV5rUct04UZOE6mCLpL25Ei:a+vzBRO0CSGHOOf/s2CppgVDEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412997, "uuid": "456a6f38-c5e9-4952-8501-91d0c36489e7", "value": 7270584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412997, "uuid": "b7666b04-d31a-4558-a577-d2b54b138503", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412997, "uuid": "c8e38260-134f-4cbc-a5c3-261e53b6136c", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f93cf2e-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412457, "uuid": "788b1c54-a793-4b10-9d1f-1ef43b48c63f", "comment": "Malware payload (Mirai)", "value": "3a6de07849a3875ae50489ad90da07d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412457, "uuid": "bc513ac2-9dca-4cc9-a64b-489f5da7758e", "comment": "Malware payload (Mirai)", "value": "4fdb4cb819eabf2c283b99a0bb4f0dfd647a460b081844f03957fc3c444d783c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412457, "uuid": "045695fc-ac65-4ee0-9faf-63f267c3aa8d", "comment": "Malware payload (Mirai)", "value": "c316fc9f7566c572f0942c564ee43d74ac09be12", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412457, "uuid": "8e27906b-914f-45e9-b091-a5801747db50", "comment": "Malware payload (Mirai)", "value": "78f4c411d09bee57cb6c295580d7a79350c266fd804b0b8129967e1110373de70bcd6d92c1ed1fc79270a48ae9842187", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412457, "uuid": "4012ba87-a75a-45d6-a93a-ba61972d4a31", "value": "T15EC3742ABB61AFBBDC1FCD7305A94501108CA45A52D92B6FF2B4D628E34BD4F48E3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412457, "uuid": "989d8122-391e-4084-8eef-119041cc8941", "value": "1536:EAZOcFrV4ZcUEoLYhE5XMQMLJIkhgXHlYwOkGfdRw:JlQMxhaHGkGfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412457, "uuid": "b3e19d10-aaf7-4a7a-8014-5ebabd5413ae", "value": 122204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412457, "uuid": "55434d66-f615-4e97-9812-24c5c5eefee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412457, "uuid": "c8af96fc-471e-4d2a-8836-becb259bb4c9", "value": "xtc.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9879e0-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413664, "uuid": "b85a72b1-d62c-416c-820a-67ebe02fd120", "comment": "Malware payload", "value": "d0a2d176d0f9f833872615af9f15faa9", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413664, "uuid": "db3ae190-9aa1-48af-96a3-5fac8ae0d3ad", "comment": "Malware payload", "value": "5046986c22c0ed0513ac80f8a58ec695a630e8f93ee62ae5ecebcc79e41a54a6", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413664, "uuid": "535e36f6-d634-40e3-929f-19c49b4efff9", "comment": "Malware payload", "value": "9bbf1f5f9a9cd8bf1d295d1fb854fbfe22a5a32f", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413664, "uuid": "6d757b64-8a58-42e7-951c-029bba57f78a", "comment": "Malware payload", "value": "d26d565778e62788329e7b628dfb0cd76260ab006250c909342e1c215862f615f1063cfea250e5908ec1c945dd716eae", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413664, "uuid": "24ba8c23-5c33-44c5-9cf6-d422e4cf2120", "value": "T1998533D5F2E2B3A7303F851C0971E48F883DBA90717EB62F56066086255F46DB39B271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413664, "uuid": "fac65db9-f003-4681-9914-7a635dd4fa6c", "value": "24576:cEykEhzXnEwUwnuR3JJ7WvfaTGxZRi5jeNufH+EDthmyrno059z8tcK4rYtTN1Hc:c5kE5w3JJ7WvQGDYjcufvnn59zIcq1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413664, "uuid": "15cbb412-d306-4ac6-add9-ebd2aa7612ea", "value": 1736584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413664, "uuid": "8039041b-14ec-4720-a39e-7f62f7b29718", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413664, "uuid": "7076ae46-9d70-471d-bd68-675b8c2d5da7", "value": "kblockd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41225d3-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413968, "uuid": "0697984d-289c-4c93-9612-875aabec358b", "comment": "Malware payload", "value": "f3d80659682e5665a6ddbe0fcb799973", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413968, "uuid": "0ed8114d-38a2-4457-89a9-455faa38fada", "comment": "Malware payload", "value": "515ad9a7d95efd47c1ed9deb7936fad93958b0c9fb09104e731a7bd5d391d011", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413968, "uuid": "885d9c62-280d-4913-ba49-fabb9fa3a877", "comment": "Malware payload", "value": "1c05eba1e04465f1669981c977c6271893560b65", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413968, "uuid": "dae6a3b8-5f3f-45e3-9a41-abcca123d18a", "comment": "Malware payload", "value": "12e3bad68042906d1c7daac3114ce4783e0e2b6a4a45ba6f88d013fbfa22bde95f4342b426113f47a2090818c50f89a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413968, "uuid": "664014e4-75a0-4d3d-8a41-a563bd3d26ca", "value": "T1B8765B0EFD248B61C264037689B815985371AD036FCB5B17A239F33CBCB7AD4ED46692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413968, "uuid": "b4064b43-7913-49cd-b2a4-cf9011668ca8", "value": "98304:Zfx/R6Pk38pCmMdhUGtpdW7iTZHKkOsY45bZ5YgWzAeJyRS2Ev:x6PY8pCmGhUuWY2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413968, "uuid": "469158fc-6d67-44aa-94e2-57a3d8b94fd5", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413968, "uuid": "cb5fae60-1b66-4267-bf11-c32fe6d9d074", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413968, "uuid": "1b7128a9-2d8b-481e-a8e7-a06de6ca10b9", "value": "vulcan_riscv64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb00a88-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413957, "uuid": "28dd10bc-7ed8-4a9e-b0c3-849265fccd0e", "comment": "Malware payload", "value": "f1bc6f6c9d9af00825d2527dfc115e6b", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413957, "uuid": "8f5892a4-42ef-4a94-9399-05e6b3bb42a8", "comment": "Malware payload", "value": "51948d3de0e709d3d3d6348faaa0a5138733063c8b4edb0e9e5b23ca7303615c", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413957, "uuid": "10c729da-7d40-483a-802f-0adbf3a3f25a", "comment": "Malware payload", "value": "1ee722cd8cea61e62e5cc051f5b76d689ec08b1d", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413957, "uuid": "5298bc0d-5e0d-4052-95be-c64207bfcff9", "comment": "Malware payload", "value": "c6c9aacff6c20edfbeea83bf5ce2ca8b1b8f53f727af4e72c90caa771da3be53f1f7d66031c8bd30c46a99f184f0060e", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413957, "uuid": "656064ea-64ce-481f-86d5-17b5f2885d61", "value": "T16195334D254A7218B77A6C5DEA0C6404A57E47C5835305EE6CA653CBCBCEB1338FA2F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413957, "uuid": "280ee4cc-6262-42fa-bfe2-5e0beee769ec", "value": "49152:GVWlGIlXZPnD0x/25ZSmwwCakw83+WmvgdhgPO3LQw4D:UWlXlXZPk/y9tC+83+WmvgdACLb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413957, "uuid": "97b45a1e-5b17-4545-b988-b6ff22450672", "value": 1992664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413957, "uuid": "6c630d50-99f4-4173-a848-550aaec40ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413957, "uuid": "0e1e50ed-c6f1-43d4-ac80-7fe83dfc5704", "value": "vulcan_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8389735a-4c64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413001, "uuid": "f3d7fb91-6733-4af9-aa19-32d33c09ce60", "comment": "Malware payload", "value": "ab6d358065bb8188c910f1e21083e985", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413001, "uuid": "64c11011-3e3d-4339-a704-c4959a78a482", "comment": "Malware payload", "value": "52847530a18919526b66936a2480e0a9bbe0ac6586b18368fe9c098c35072773", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413001, "uuid": "f1bb99f9-a372-4236-893b-d980a22e7b85", "comment": "Malware payload", "value": "bd56dd854a96e9d0cfc555665dcaf81768d01ae9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413001, "uuid": "2047084c-22e8-4fba-b738-997a688d3aa7", "comment": "Malware payload", "value": "86b9764fdcbc1b80b9940a5eb733f0c17e644b3e8ce52e57b292f2b27a5f7a301d0d302d8ed10f425ffeddcfe95ceaa9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413001, "uuid": "1c6efba1-353b-4c96-9e17-44fad1dc6c5a", "value": "T184762A97B8924952C4E43A37BCBE81C432630EB99BC7165B6D05EE383EBE1D90E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413001, "uuid": "6a0d081a-0e61-4cf6-a0a1-8b2b46f69c3e", "value": "49152:XmQSvcUYqZPawtV6wl1VGuvxt3ymxyOjewUs5cO78g0UBb5EG:/S9YIrf6wl1VGuvxDcO78xUvEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413001, "uuid": "fd030585-67df-4893-86bc-4c02fcd8b26b", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413001, "uuid": "2c806cd6-68c7-499c-ab76-9f02e7bac01e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413001, "uuid": "68925404-a0d0-4ca9-8deb-eb1663b7a5f9", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a32f330-4c69-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778415052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415052, "uuid": "c595f8bd-919e-4c6c-a75f-d91627234ef8", "comment": "Malware payload (Mirai)", "value": "d3fbca8aba14a731896f00505a1c14b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415052, "uuid": "eeaad461-8043-4e9a-ad13-6bcaa4b93459", "comment": "Malware payload (Mirai)", "value": "52c0b0fd0a7d2f608330fc0e60364636efcdde47716c5e2027b5d07bf6c20cc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415052, "uuid": "92c005b0-ab55-4319-ab10-626af6c220ee", "comment": "Malware payload (Mirai)", "value": "167ada387c0a2535de166f975a644ea754d9fd00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415052, "uuid": "464f6cd9-8b73-416b-bc76-dbf49af6821c", "comment": "Malware payload (Mirai)", "value": "8a86e9f1ea6990d2000e003df28526637b704138a69af9bed9ac108b517729b52849fa611de672aabb73b3745def7367", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415052, "uuid": "58cbac28-2a4a-46e3-a541-0039936cad77", "value": "T146C34B86FD928A12C6C616B7B66F428D372513B8D3DF3203DD151F25738A81B0E3BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415052, "uuid": "e635e624-7021-42a6-91e4-a21059872024", "value": "1536:SJ1wDoXn6fpiHgQSK44jjAPnid5L2kTogNI9MYNLwtthsdEiDT8OZbvVmAvrXDwZ:SJ1wInOpiHgLsUKnoAI9/NLVNJTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778415052, "uuid": "283e0c27-56cc-4433-939e-3a25bcec1877", "value": 124856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778415052, "uuid": "752889b1-a881-4b91-99ce-5ff892eff85d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415052, "uuid": "f42f33ce-504b-441d-83ad-ca4978eba511", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ce21dc-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413963, "uuid": "92d6c5b3-7bbc-46f8-9bff-b11cfd3dbeec", "comment": "Malware payload", "value": "43bc68a00e2b7d2b25bd943312c00ff2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413963, "uuid": "43eadfdb-09f0-44ee-a529-c878cb15da59", "comment": "Malware payload", "value": "54398bd1f5fa4dfbeb4764f8439e1bb84128981293ba280454cd566d65fa58aa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413963, "uuid": "4af1c1fb-2065-48ce-b463-ab62a2ab2d5f", "comment": "Malware payload", "value": "f6c619cb13ea49416c3fbc74b6fa3f13b08a242c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413963, "uuid": "e87c884e-4539-4061-9b3d-626a5fe85641", "comment": "Malware payload", "value": "9d52c665b579a2264588964ade99b9c1e78e335a9907734b5d225a9f7df564c13071b0afce3e589e1a09c2e479c98339", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413963, "uuid": "5a689ebb-038b-4dce-bf24-2349c6cd50d6", "value": "T1D4860965AEC26F66C1DC037444EDA26662503E455BA2072323F4EBE83E7773CDF5A848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413963, "uuid": "0eddf683-85b0-4d49-b17f-c7ec52665a01", "value": "49152:38TXSUA5oH5gGn40PXQbOCO96V8KguYXO0fe7KTYt8gSIg5Ev:38j9coHqGn4CQIKFt8geEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413963, "uuid": "2fe82a42-e725-43b5-8f05-5dbe84714dbb", "value": 8388792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413963, "uuid": "da8c7e85-b094-4366-a614-f188fa3f0492", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413963, "uuid": "d704ee5c-8177-41a7-bef5-44232a242e21", "value": "vulcan_mips64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac66108e-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436262, "uuid": "81f4bbba-cfa9-4bf9-b86d-2e17fa8765b9", "comment": "Malware payload (Mirai)", "value": "5a8ff7f523256729f99e3173b9533a0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436262, "uuid": "9289bcbf-ec51-47eb-a4f6-f6fb964b3786", "comment": "Malware payload (Mirai)", "value": "54f0b569c2ce51fe30451b590ea878df9e6c5435b195d59379134b786777aa24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436262, "uuid": "897847e1-ae0f-4423-bca2-023113c601b3", "comment": "Malware payload (Mirai)", "value": "f22f0493bb200e051fb55d2e9f3b401d024b3e89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436262, "uuid": "ea3cfa07-674d-4a90-9e8a-9cc9589e3f42", "comment": "Malware payload (Mirai)", "value": "8d14bfadba66802ecc8a755b12e3c659723c498551419b1d446c23954a31bd066900ed8123fee406ae329011e91a393d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436262, "uuid": "18a8ed10-2a5a-4441-90b3-aab2f02e1a03", "value": "T1A913F180AC670BB2DC7B55B518BFB9C4B825321EA34849D6ED8C7CBEC55353826392D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436262, "uuid": "a9743f37-8723-4934-b3e6-89b8dcfac52c", "value": "768:bi0Ga0taRyEEUpUO3YpKy3o3283hzF3E2eWz48GuhMTnbcuyD7UHQRjHN:bTGeETO3YL3ophhlzdGuyTnouy8Hyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436262, "uuid": "8399e919-4e6a-45ca-8a16-9ae4a7cdeb1c", "value": 41840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436262, "uuid": "0f3d36f3-7f2c-40ee-8052-8a61c6cfc809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436262, "uuid": "6b50f654-0f04-4e98-9c73-307312441d32", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0caf1c3b-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413660, "uuid": "6016f9f7-5190-4381-a9ea-6ddb2e0c68d3", "comment": "Malware payload", "value": "e06bea6e4f5871b7c34c292ee27b1ab5", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413660, "uuid": "4ac5effd-50be-47c2-9085-b22a6a1e1a18", "comment": "Malware payload", "value": "54f3222bdbc1fe84c7aafd517350f5cb908de452e898f61b899a0fd7149f6467", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413660, "uuid": "09d039fa-e345-47ca-a05f-70e5b12d215d", "comment": "Malware payload", "value": "fe513473538147a3365fc7d442c60e55ea1dd7e3", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413660, "uuid": "d1eb2b5b-bba1-4cfd-a8e4-b43e8502e07a", "comment": "Malware payload", "value": "daf24bd8f018240c40c9f9baa325e213bf08f71a42e7b0ac56cd8f91f4eec88affb72af9c141b7e75cf7036f5c625291", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413660, "uuid": "5979fe69-b6a6-4784-ad1d-38a06fd0ef91", "value": "T1F98533F21CF19007E80F7F8159CEFD6999AC64D11EFF9A8E46334919A7C88A0F5650B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413660, "uuid": "a2b4cc02-d841-428e-9912-ea00e6110dfa", "value": "24576:0hzUC+zQjCnHeQixjtMMHHmrKFXzqDALCaoOuIbrl+iIQfQkzfizQfz8JjWiQ2kT:Fr+r2FPaHjl+EfQ6fUkaWV/d5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413660, "uuid": "6726054c-3fa2-42d0-beb4-e157f1c12eb8", "value": 1716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413660, "uuid": "8e065fe0-f707-4e2f-9a9e-8484786cdbcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413660, "uuid": "2c389552-dbc7-440f-98c4-b64054f4d51f", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fa1b42-4c8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778430057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430057, "uuid": "faef21c6-fa27-4bfa-a665-9b28ce06d423", "comment": "Malware payload", "value": "9b92ff12d996f34f715abc2da1878994", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430057, "uuid": "6dd4ab9a-15e3-409d-b1e8-6c6c8183dd65", "comment": "Malware payload", "value": "5639dd46a65243cab1ccf62d42df1322f1d5df13c4f6142ba43902f6760343cd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430057, "uuid": "6c51a7ed-1b53-4348-bbc5-12fcc5d65e9d", "comment": "Malware payload", "value": "1c550d0b25e3c7bf97174a655c84fb3f1d6de33d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430057, "uuid": "f0b4dc0f-0c35-4d74-b0a2-2681bd508f74", "comment": "Malware payload", "value": "dcf8700033d8456ca213961196dc0a6381d447df9dfa66a4b65037692934088f23d5c8cd8f83c29562622029a61099a2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430057, "uuid": "ee56602e-e47d-4429-8847-efae78c8a1b6", "value": "T1D143086BBE91C474C096C2701EDB82E0B5B6B0B02B32665F3B453B7776612C61E5E732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430057, "uuid": "3fef0c83-61f9-47a2-8f31-14d6f844d5bb", "value": "1536:aTlL/A/l7WlU4tylGHwaelvrxGaW3nUST5:aTlzAUlU4tylGHmlv1GaW3n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778430057, "uuid": "45b59d70-8d0a-4059-8559-587475a657e4", "value": 55208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778430057, "uuid": "ed0b3305-06cb-4bdf-a250-474e7c24956d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430057, "uuid": "9c95d505-bbfa-45fe-97dd-f09369780f9e", "value": "exp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c711f6-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412459, "uuid": "8cfd3bb3-265e-4838-a320-71efa4683e5b", "comment": "Malware payload (Mirai)", "value": "4280f7338f94ead21487b1f3b65cc5bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412459, "uuid": "d80b9bb4-92e6-472c-afcb-2c0df4ff5741", "comment": "Malware payload (Mirai)", "value": "572b8ea63cb65507fc86050c6649cb5f965541f35e4797b351bddf703c22c232", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412459, "uuid": "74d4980b-f5aa-468f-abed-169f86ddedc9", "comment": "Malware payload (Mirai)", "value": "d78843d525e219f1add18db31c47106b5bafc8ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412459, "uuid": "dfe2f829-375f-4b94-bac8-03e64e7616dc", "comment": "Malware payload (Mirai)", "value": "8d74d0218af285f7898f5dc2677c79054a605855de8371c74d903f056c7d1b55b7e20d1c4697a83e168a6894bf4c6263", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412459, "uuid": "97ad9f7c-867c-41c5-af18-1d5b4972e2fe", "value": "T19F632A336691CA7EC087A1F027EBD926FD32BC3A1775204563E0BEA36F498D05D9D261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412459, "uuid": "8172e1a2-a800-42d1-8c12-1efedabcbfbe", "value": "1536:GiDT4iXvYQVIPw8404N/mT+/4hIc65axT3R0WX:GET7/5V988/T/4hIf5at9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412459, "uuid": "ab04ffd0-49e5-400b-b07e-ca0123656505", "value": 72072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412459, "uuid": "238f3ca2-f857-45ea-937f-3d3f057c5729", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412459, "uuid": "4db48c7d-5936-4207-a2be-79b87d0d2bb7", "value": "xtc.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee196b2-4c4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778403222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403222, "uuid": "692e3025-a822-45fb-b34b-16c721410d02", "comment": "Malware payload", "value": "54c64884711f62f239a0b042cd4c5647", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403222, "uuid": "58988137-e8b6-430b-9482-dfa5b2a07131", "comment": "Malware payload", "value": "574d146f94167c2f3113ebc3917b6b439ac77e70f7ad1622229d9b1d0950d464", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403222, "uuid": "3840d049-da34-49ec-995f-e78fc76cc9fc", "comment": "Malware payload", "value": "8a80c56a5f86d7564904b168b7ab5ef7d53dc31a", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403222, "uuid": "97766225-c665-44c9-bb47-9d490dcd7cf6", "comment": "Malware payload", "value": "6a057d1c0e5097f9bb46b8b3f001ecf9cd45cffc74c907175455fdf7a485bd35ba64ac148f64788d2928b080dd27dfcb", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403222, "uuid": "b22c6b8d-a56d-4382-9510-f1cbd94f7477", "value": "T1DE663336F57C29C9C467D47DB0A12E9083A1130EE643943BB9B2B9C872F678654CE367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403222, "uuid": "c3cec58c-7e77-4617-a6c5-668e6ae9f0aa", "value": "196608:40uU+HB/OGUElH6XU8YYlbHXUBZftejQYT:4rU+h/PUEl0U8YYlbEBBaQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778403222, "uuid": "8fb00fd0-1e64-4794-8603-5db517ac8b22", "value": 6602893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778403222, "uuid": "7f583f4f-31cd-4be5-a87a-53718a9f294b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403222, "uuid": "3276291c-8e86-4e49-9622-2e0e1a0251af", "value": "gotextileltd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f80be8a-4c64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778412994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412994, "uuid": "ee524bc7-a2a4-47ce-9763-08a743341c41", "comment": "Malware payload", "value": "f4656848c079257a6daf09aa6ea13d23", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412994, "uuid": "0d3895e0-1a38-4c19-8fbc-b8b268916212", "comment": "Malware payload", "value": "593ab8831b082e33eed305120bf0b337695e8718f3f8b06526b145b685712ebc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412994, "uuid": "a22a6b45-614c-432e-90b5-de861280ba19", "comment": "Malware payload", "value": "8eb2de3ac59fbf7cdb28cb75672ef57c4109933f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412994, "uuid": "b855f53d-52f9-441e-9d63-db84749c0ba3", "comment": "Malware payload", "value": "26c1082caa8a86a34a7a26f92119efbe5c29ec506dda6ea5dfb9f7fa7561af0dd8ba84445cc80fa8d282cea9751c3003", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412994, "uuid": "9e909ee8-9aaf-4a8e-aaba-8c7267da1f1d", "value": "T102761957B8924942C4E43A37B8BE81C433634EBA8BD712576D05FE383EBE59A0E35744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412994, "uuid": "cf50f650-ef0d-4ee8-9543-4eb6eb804c74", "value": "49152:d8dRbN1kedV/bZwGERssxsniMPuR7XZBJtTp2ehST5EH:debIedV/bZwGERsQtjJtd2e0EH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412994, "uuid": "fb2d852d-2ac2-4eae-ba58-b0d9f74a8031", "value": 7274680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412994, "uuid": "25854f04-1f4f-473f-97d8-b427d19c54e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412994, "uuid": "e52d08e8-9eed-4ec3-a375-0cc9a20b8f0a", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8c6932-4c97-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1778434838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778434838, "uuid": "0445892f-7751-419c-b3eb-98ceb239b38b", "comment": "Malware payload (njrat)", "value": "1364ecaeb526fc4674ef7d05e6a99070", "object_relation": "md5", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778434838, "uuid": "efd5e11f-02c2-4b2d-8373-a64b4b536d6e", "comment": "Malware payload (njrat)", "value": "59820d5a86c9589ce374d8089c96bc651c41feb57769d22983601c6231b9f055", "object_relation": "sha256", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778434838, "uuid": "7bd0b9a4-e865-4b1c-bfe0-8a9a1972bd14", "comment": "Malware payload (njrat)", "value": "aa30f93038944605fdcb30f3ca19a789337ded6c", "object_relation": "sha1", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778434838, "uuid": "04a34cfe-7f78-4307-9f9c-068440931a01", "comment": "Malware payload (njrat)", "value": "52aa84358310a21c18e6b073f6cb6d73ad49cdc31dc8ee7e52750d56feb9be327758a43328b3f2df120b6151be27c02b", "object_relation": "sha3-384", "Tag": [ { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778434838, "uuid": "321d2c2a-06fa-41c8-90e4-dc02e18ee3b9", "value": "T1EAB3BF007BD98136D5BE4ABC9DF2610146BAF6673612C25B7CC842D60B23BC6CE527F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778434838, "uuid": "d3f4295c-0a3c-49b4-8c37-a16c86ddede5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778434838, "uuid": "30bb675f-f594-41fc-8f74-7fb1fab00235", "value": "3072:Ro10ub4JWoINRKIqT0MTGDANBistQNOM8Y:Rs0ubpidXCDsBS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778434838, "uuid": "e5bee2b8-5c60-496e-80fc-e68549ab7ede", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778434838, "uuid": "37e9a1f6-4fe8-411f-bb9a-f0a7514896f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778434838, "uuid": "9ef7048f-6ebf-48cb-b66f-edeab29d790a", "value": "CodeBLOCK-V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8388dc91-4c64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413001, "uuid": "e4e66ec6-5904-4613-ae5e-d18fafe228c3", "comment": "Malware payload", "value": "2fec78d2922100bb84bdbe164ff5615b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413001, "uuid": "b61b3a25-a5e7-4104-8aed-42a8b103646a", "comment": "Malware payload", "value": "59c3adfb0894750afe34fe8819a5c65b9dc416c16dad18c2424109991bd13d4c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413001, "uuid": "07142e0a-c093-4257-98f7-869c9d8a72c0", "comment": "Malware payload", "value": "b72adc8a79ce4ad97323b8625e387fbff1a51a87", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413001, "uuid": "de3f7d01-b98f-4043-b96b-9010357536b7", "comment": "Malware payload", "value": "8ced02483b642d92937ddc5eba763c4dd0e66dc770c8714d5901cbabd2284d23914094e60aafc01087ead3a0659050b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413001, "uuid": "93346948-37b7-443f-8ee7-c180dbcd7636", "value": "T198864B137A29EB0FC62821305CB2CA942B691C9642D7911BB745F309F9F21BD5DAECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413001, "uuid": "9ee61b10-82c7-489e-8e45-624b9039436e", "value": "49152:wqj6vvWBHYQ6SsHjBxM5whtF755YQRhjl87gfmfchjkTgH49CrQJh4zmr8ia5ppL:lStxB09siQ0fblOtT6adcnUjEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413001, "uuid": "f0eb4a2c-64e2-40af-b36c-6084f677127d", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413001, "uuid": "0eace4b5-613d-44ca-a8ff-83ab20bf3bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413001, "uuid": "5b733d15-403c-4522-9965-e8697d6b684e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9c3b5a-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778414142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414142, "uuid": "72b26bdc-99a7-43ad-85d6-1ef595207dea", "comment": "Malware payload", "value": "96ef853021128f401b75b5a86c4be7d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414142, "uuid": "d2755462-6ecc-4300-a4b3-e0ecb911a59c", "comment": "Malware payload", "value": "5a2a37f158f13cc8392c1792e7d7dd42bf771dac70985ca755092e4945826a36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414142, "uuid": "a3aeef11-a9bf-4c7a-9904-db1b9c86c0e4", "comment": "Malware payload", "value": "7a96368ca3d4048468c488d5c20f164bbc36e51b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414142, "uuid": "1571145c-608a-4def-afba-1435b1c515f2", "comment": "Malware payload", "value": "f019c1d227f609fb3ede8ff0e60a7c503b6e596444dbb5bfbd71952d643f269d927908c02975319686a29bf18064ec77", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414142, "uuid": "8b9c2b3f-603b-4444-b399-5d740a7bfbcd", "value": "T1D6762A5BB9924943C4E83677B8BE80C833670EB99B87561A5D04FE387EBE1D90E35344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414142, "uuid": "ffe2319c-93c1-46a8-8c49-499dc7bda89f", "value": "49152:ZXb72uNQMEhpe2xOwM4/UkuWfQjc495DWOSU+Tvk3tGYMhvwkOnaXNJeNi8x4EtQ:ZXucCeUOwsaIAEtmJzDIEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414142, "uuid": "8cb45262-2251-4c77-934f-ad8a1c6112bc", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414142, "uuid": "f18e03b5-6ad7-49d9-90ba-23ce9c0f53bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414142, "uuid": "348b1b8f-58ff-427c-b9e5-51d914a4b983", "value": "vulcan_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d624eb4e-4c4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778403261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403261, "uuid": "3424ce10-2d10-421e-a95b-818a37bf57cc", "comment": "Malware payload", "value": "1c3d3a7a36bb694e65c6d3319b783067", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403261, "uuid": "1b4ff247-4d38-4336-8b20-68d831f0ba8b", "comment": "Malware payload", "value": "5a2b957a011901a7e88b8f96028ff004cad590455a36c4816d0f40007323cd01", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403261, "uuid": "a92aad87-bac3-4b03-af4b-48233ba3e88c", "comment": "Malware payload", "value": "b139ed2fd70c059fbdb009d14c6f6317040f2af1", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403261, "uuid": "e0030f37-cebc-498a-a207-f9d74bcdc3b2", "comment": "Malware payload", "value": "841c46b92b9e11dcf4e457b3e36992f5167c0c3999c9182dc21c3ba1eaa3c4bca056e80d26e49c383f267fc967ad50be", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403261, "uuid": "09bb7e5a-4f8b-4cfe-8993-91cd52a51487", "value": "T1A7B6AE35A3C8D6B9D412DA38CA14E232C2B1B91E4B76908B0F96D7061EF79514F3A7CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403261, "uuid": "7e9064ee-1e2a-4fc2-a10c-4e98a915f036", "value": "f418e835c2fb79101e806fd56041f826", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403261, "uuid": "04de9d7f-66e8-441b-a5ad-7bc21fd55f10", "value": "98304:/bnEGXGY1IZ1a2KCYHp+VP1RuGEDtAOMGq:DEGB1+a2Qpg+MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778403261, "uuid": "6dd938b2-56c4-433b-a9ca-6a1f167175cf", "value": 10462208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778403261, "uuid": "d2c67cc1-0368-421c-9b7a-21046ab1c953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403261, "uuid": "74e46819-39b4-4c7a-bb13-dc98d652d0f8", "value": "2libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a473f1-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448540, "uuid": "a0bd66bc-6529-451d-93d0-19750b99cfc7", "comment": "Malware payload (Mirai)", "value": "5fa85dc0628d549b7d9821cd60e849a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448540, "uuid": "ebcd34f4-1f14-4533-ac79-30391150b59e", "comment": "Malware payload (Mirai)", "value": "5a84177ba3ee7d98ad138f0d3573ad6093df5f015c9d175da6abc0d7a0443ff9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448540, "uuid": "04217851-b706-4d73-81cd-51fc6f258c9e", "comment": "Malware payload (Mirai)", "value": "bc5cb9538fed912817d5378852dc10032c632fe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448540, "uuid": "fa43c8d5-7adf-411d-b4a4-d927c3eea2a9", "comment": "Malware payload (Mirai)", "value": "d2b42a9b79160aee7e20b32784eeb19907e73822584bb730730e675aa7cf87439446e230debaebf69b7871e3022867e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448540, "uuid": "db27b87f-4870-4197-9e74-2470d536af80", "value": "T1D6A3C91E6E218FBDF369C33047B78E21A79837D626E1D685E26CD6011E6034E641FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448540, "uuid": "23c1e3d1-422f-4404-a88e-253d54a7f8af", "value": "1536:yk8NZJjWAaXPccve4meOeuCyTPHvwIp/read7Q1Qs/Rd/uP:WZJjBaXEzhHvlp/o1F/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448540, "uuid": "940e0232-e99d-40fe-bccb-e55070fb1a63", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448540, "uuid": "e78a5999-77b5-402a-bc5b-619560fb3903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448540, "uuid": "18006fe4-bcbf-4688-a7fe-d345e0f88865", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad309e2-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389525, "uuid": "d59c0b2b-3646-4019-9678-84be4182b4b8", "comment": "Malware payload", "value": "da6d0a09065357101888f7ae782d4fcb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389525, "uuid": "48217805-505a-4feb-a199-eeacaaff4ffe", "comment": "Malware payload", "value": "5af2c0100b98f4b8d728b32b61c78e046cd2e74890120d1bae8bf8d08ff86a3e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389525, "uuid": "6b05ffcb-d7f5-4d77-aa80-7c635bed34a0", "comment": "Malware payload", "value": "bdb0a967664fec91baabf2aa7272d2753817da3b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389525, "uuid": "d8c63867-6982-43d9-b805-c17a9590fa61", "comment": "Malware payload", "value": "5f522308c835cd3c09b8cd02388a00c1f6e294c182b300632342128faf4f6013f27ee14d7ca6527b1d9dbbe9255f6764", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389525, "uuid": "94191099-21c9-4331-83c9-2b6a20e6cdc3", "value": "T13141504E4F46D0E1528024FC674F3986B84715FF91158104F79E7B8B9FB4711E2989D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389525, "uuid": "d42fb6dc-a057-485d-a2de-ef8183f40fc3", "value": "48:afVBvN2ufHMzQKFGXx3wSTEYLHvHpO8OSI4QiY2Xx30XW8:avN2ufM+EXZW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389525, "uuid": "d9746e70-272a-4e86-be58-8d008fcd6601", "value": 1971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389525, "uuid": "9875ee41-d38a-42f8-bdb4-09f04609fac2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389525, "uuid": "5280496c-5a5e-454a-a6ff-a83f631e9295", "value": "linux_ak.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71d0a7b-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371453, "uuid": "723de111-6e5c-4318-9523-0c3eab97b36d", "comment": "Malware payload", "value": "c8291440786d5704618cb755df7d7728", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371453, "uuid": "e1ededac-d1b5-4435-89a6-f2f7b5a3150e", "comment": "Malware payload", "value": "5b42d7c5fa91d57be905408753fdf7d95324d9e1fa2cea2d31af8cfd25499638", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371453, "uuid": "9e7f4c8f-f58c-4e63-8b9a-75fb35a88935", "comment": "Malware payload", "value": "e7dc06886cfbe16e2f66f89afac67ddefb7d97b5", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371453, "uuid": "5b75cc68-9995-473f-88ce-eaa5cee304c2", "comment": "Malware payload", "value": "e33257fb5eadedce1cfbeac99b580c6286b856dd8120c3ca575d535a6515e966ed5683cde045de7d38e63765120ff3c2", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371453, "uuid": "23fd2567-73db-4005-8d62-914f959bc919", "value": "T1A7346B0CBFDDE55BEA3C177146A308AB13F0906342F54B0AAE861D9E9F193C2FD56221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371453, "uuid": "dd46493f-149e-4257-b164-03c0fd5f6bfc", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371453, "uuid": "0180183c-f297-4168-b4e1-93adbb6f73b8", "value": "6144:vIY7YoYGx+M9HFWnZNm+U5xfk7bWc8NK30Bq9HFWnZNm+kz:AY7YoY8FWnZPycuBmFWnZPkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371453, "uuid": "d36811fa-90f0-46f8-94ee-f3e6cbbf73f2", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371453, "uuid": "310da30c-8348-49f1-be19-bc01e9492721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371453, "uuid": "1cfcf411-cf9b-4bf2-9af9-aa3b996ff389", "value": "5b42d7c5fa91d57be905408753fdf7d95324d9e1fa2cea2d31af8cfd25499638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030addba-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413644, "uuid": "362247a6-a09f-45ab-98b0-3175d13b81b6", "comment": "Malware payload", "value": "778f44734315ebc3679047609eed4cad", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413644, "uuid": "799400a7-fdaf-4f2e-85be-0f3619da5599", "comment": "Malware payload", "value": "5d3e4481fac2fdbe765033b471309942148776b733c190faa36a6636820eba05", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413644, "uuid": "c420b907-3b78-4c7e-86cd-e8c561cfad4d", "comment": "Malware payload", "value": "f7993ce02319a8fd4bc2b0af780a55162f5c7524", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413644, "uuid": "9ca84dac-ae58-4032-980b-399ca0fb4041", "comment": "Malware payload", "value": "9a79615662fdfe1881823c3fbbaad010257ebd1a9558bab02c3bc30147d802633881de13296177a8b5dbe43146d2c720", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413644, "uuid": "bb7f9363-a6b6-4cdf-9671-ace97998f57d", "value": "T1B9853308DC40E510CAD3AD49BC49B90BBEBFE49512DD4C87A8D641F58C9972B2EFE44E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413644, "uuid": "86260534-91ba-4cd8-a8d3-1fc844b6394c", "value": "24576:XBstAQgJ6gTKxLLBUZiYPjwhrBM3kAbNkykg+5B5FQ/dbYhxl5cUFDq+r5pxossy:6t+wwisyBMdb+xWlbkf598IpWLo9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413644, "uuid": "2b284e47-e53d-4688-a53e-765b73ea82d7", "value": 1743084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413644, "uuid": "8a9b8b4f-1843-4531-8c8e-3b4d21d5da99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413644, "uuid": "4fbcf68d-537a-411b-9592-4ffc61f190df", "value": "bioset0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de144a0-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371330, "uuid": "2b01bc16-83c9-457c-a499-e83c3b335d22", "comment": "Malware payload", "value": "239e7c1ad52afe2b08f43218996b20dd", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371330, "uuid": "2431c028-f48e-40a6-bb41-ade72eac1377", "comment": "Malware payload", "value": "5d7ece49999b9bea84c999d4369a18e8cd6dbb17f47ddd9d14294670559f9377", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371330, "uuid": "31ddbbc5-0b20-4f83-b370-a3ea6bab92da", "comment": "Malware payload", "value": "bc88777e8dda13788e85465e3ca2445441b71de0", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371330, "uuid": "74a39084-0476-49d7-9dcc-64122e4ba9d2", "comment": "Malware payload", "value": "95d1a3ce5bc39798b9a2eca6b3175add342c479785de0dd36b2c5aaa1c1f9dde93ce924acfccf49e2e46ad3817f9bab8", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371330, "uuid": "a0abeb5e-4b3e-4e76-b58b-5d7b7fce0551", "value": "T1C0243908BFDEE55FE93C527147A3086713F080A312F64B09AA8A1DDE9F1A3D2FD56161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371330, "uuid": "eda1fafa-412b-4804-8767-3560500606cd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371330, "uuid": "a9031ccb-6c7a-4a39-846a-545cd6f6d3fb", "value": "6144:27PDN9HFUFStm+KMOc52+Fhy9HFUFStm+:23FwWV1MFwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371330, "uuid": "b38dcbc1-b7da-4639-a35e-9a2dda1ad20b", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371330, "uuid": "14937b61-87b9-44a7-943f-1f61b823345e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371330, "uuid": "1dbd4562-92a8-4cd4-9160-d7285ade948a", "value": "5d7ece49999b9bea84c999d4369a18e8cd6dbb17f47ddd9d14294670559f9377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb15d00d-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413953, "uuid": "ae7031c5-91e2-4f58-998d-84002ebf1e23", "comment": "Malware payload", "value": "13516d82bbf9157db0d597404d987a02", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413953, "uuid": "134c5e54-c3e7-4012-8b75-426621ae7d53", "comment": "Malware payload", "value": "5d82c963fd1696aeed7a6ee7b8c5b75da8728e494c7b4cf07dc74f1f042edab0", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413953, "uuid": "34296f0b-1a9d-4013-a9c5-f0296b6f6a45", "comment": "Malware payload", "value": "fb2677813bade2f106227fc63be73a98b514c310", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413953, "uuid": "9bf96a7d-c0df-4bb6-b1e0-b0622059a38a", "comment": "Malware payload", "value": "4ab993bd7dc449aa53f3bc00481e19611316a9b5cee2df16670a00d14436446e51328fb193d89ae0f191d501a8d809ac", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413953, "uuid": "d61e04c6-322a-4fa3-afe2-cfabe786900b", "value": "T1DA9533C6DCA5FB3652A1FB8233F1D56025BF8A1A54490ED0D0FCE9E076A1BE75C142B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413953, "uuid": "90f27b40-2fb1-4b01-9d35-a17559e63d89", "value": "49152:q9kpesDz9h3mGwpAXMIYIWneJy9EUhonR0O+:6o5XiATy9/IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413953, "uuid": "0a73d581-3395-4887-9e52-ddca328c03d0", "value": 2053200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413953, "uuid": "5b6f6d6d-aa95-4cd7-9d51-b110d18eaba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413953, "uuid": "a7cb36bb-92de-4a81-b2ad-15f6674d94a2", "value": "vulcan_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d7524f-4c9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778437077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437077, "uuid": "ad4c0089-23b4-43e6-8327-10a2233f65b6", "comment": "Malware payload (Mirai)", "value": "92bcf4cac790e71d812239b0a6dc59d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437077, "uuid": "51afdb38-d612-4139-a358-b42a32de4224", "comment": "Malware payload (Mirai)", "value": "5dc91549ecef42e0710736e058ba5c55ddf33bedd999d78cb541430785ffc343", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437077, "uuid": "cbfd2ef4-614f-40c4-beb7-1c5adc597c68", "comment": "Malware payload (Mirai)", "value": "ea2f640efc055f38b779b52538d5a45099e5f90b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437077, "uuid": "c9d1602e-76e2-46ea-bf83-fe6b90b4eb0a", "comment": "Malware payload (Mirai)", "value": "9b08257f70c9ad454e6c22279d1371bfa9519ffd053f2042e10741bd66dfee980af5fceab5c317f6ae284935b85b6ed6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437077, "uuid": "50fb6256-11ee-44ab-8914-30287ac9ff34", "value": "T17C261A57B8918A43C4E4267ABCBDC1C433672EB99B9722576D00FE3D3ABE1990E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437077, "uuid": "253c2be6-cfdf-410d-a253-6234b4773c3d", "value": "49152:0DPmrqixkgJutCxp3bWHfy70Mw6mx2HU1F1:YPmPxkyutc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778437077, "uuid": "88aa2eb1-2115-4002-8274-04cf87ae010c", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778437077, "uuid": "5944ab7f-319d-4eff-96e0-2ac9a21354d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437077, "uuid": "0be30ffb-bd59-4d90-8967-28c5f434ca5d", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ae4435-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371316, "uuid": "ee03712b-42f6-4056-8c50-f33ebb59d6e3", "comment": "Malware payload", "value": "16193de5cc106d73ce9435b448ccca9a", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371316, "uuid": "5ad9c11b-0bfd-47a3-991f-5455b1efb109", "comment": "Malware payload", "value": "60b4919b3995f6c1cb0fdf5986d51cd4607ca9cf5f1523768a1a214496f72768", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371316, "uuid": "50b70424-294d-4d0b-9e69-c459022ac4f3", "comment": "Malware payload", "value": "110e3cd56447d673299de9f59a832b90cc222d99", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371316, "uuid": "b56f051f-6497-4948-95e5-695b22b60d94", "comment": "Malware payload", "value": "46f1f24d39de3ff4b6510deb66153b2be2e16ec0fdd3e8117d4c5840915f408fab19511a5004377811d13d5b9a97d36b", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371316, "uuid": "d161dfab-0c60-406f-b773-047ff2883806", "value": "T18785DF5873F84625F1FF4735B972551886B3B88AAA20C74F0D52544E0EB1BC0DDAABB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371316, "uuid": "c3624ec8-a2ba-4b43-b61f-4a5b032b8ad9", "value": "49152:lOTQdiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:4KloSWVTR5Nhsm8A6xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371316, "uuid": "6af1568b-bbae-4203-a8cb-56ee330de0c7", "value": 1869312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371316, "uuid": "dcee7e32-adc8-4b4c-9d83-e7892846874b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371316, "uuid": "cb26adb1-5bde-4d2b-a482-f44722874464", "value": "60b4919b3995f6c1cb0fdf5986d51cd4607ca9cf5f1523768a1a214496f72768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3201ad2-4ca3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778440139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440139, "uuid": "42e2320f-adc3-43c2-8d0d-b6a21db020c0", "comment": "Malware payload (Mirai)", "value": "827ca52487fe5c654fbed6d6a9ebce74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440139, "uuid": "dc646786-97e1-47e8-abfc-8d3ae622e344", "comment": "Malware payload (Mirai)", "value": "62cce0d6daeadc4d259db3498b72d070205701797a2937e18140f42f0cfc3ce1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440139, "uuid": "70220347-38b5-471d-b07a-488ba23eaefb", "comment": "Malware payload (Mirai)", "value": "9ee4a7b231f4703f22035adcd8e89bf774791bad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440139, "uuid": "e6154b59-bf64-4691-8e86-c9498ce7d1c7", "comment": "Malware payload (Mirai)", "value": "f5a810d90b8b1e0be78c24fbb28ff7e5b72b9b8b3a5c0e3450959ffee13f5528440ba7b7a99291eb8433c48c36a4147e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440139, "uuid": "ca5ebca7-b965-453c-9915-28c294949757", "value": "T14273025FC0B5B4E1CD5C19F6118D17E7AA22B965E58B2E2323D06F2DBB3C88B3207095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440139, "uuid": "4eb53dad-c41a-42c7-a82e-1a50c3e26f37", "value": "1536:+Sm8mNpDO50cvWNIx4AY28Ny06LcWFoUHnfNC:+JNlHcvtq3mtJnVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778440139, "uuid": "1b62a713-a32a-401f-8344-4157de8b88d0", "value": 77940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778440139, "uuid": "f21562e9-f8f9-4e63-9bc0-9216815f6d8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440139, "uuid": "8f3d0df3-c099-4ee4-97f4-a030cbea8f11", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79533f0d-4c2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778388502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778388502, "uuid": "1d59bec8-bb9a-4337-a5b7-a279003aa0b6", "comment": "Malware payload", "value": "ea53e52f5cc1da3412cd742fcf02271e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778388502, "uuid": "16b2a000-c794-4a9f-9f55-7dc67c0b1e1d", "comment": "Malware payload", "value": "66794df620d5726d52dc5597ba40c552c7d260e18744bfd70653192d76da4b40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778388502, "uuid": "d9d063dd-88a4-43e9-9f17-1869a4e02173", "comment": "Malware payload", "value": "cd3ac58e325d5dc4ac504a762439507bd8650c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778388502, "uuid": "8f9a0b6f-ad65-47df-8d24-521fa1b18d39", "comment": "Malware payload", "value": "74ff9b2fa879c71031c67b9cbe165da40ba3faec66bc6f8446372cd00f0236aecb02d4330c7d79f986d1738e86e692b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778388502, "uuid": "6c2cec21-a16e-430a-a0c0-a8802ddd38b6", "value": "T1ACA633E9935E46D1FACD49367BBCB6005388ECAD35A44D07A42CF4630D30E67889BDAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778388502, "uuid": "3373a444-6c90-42f8-8e27-bc0bb011ef54", "value": "097a53de9532d3605d91ff5bc1276e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778388502, "uuid": "483d72b6-2f63-4326-b8d4-a8f669888156", "value": "196608:m393dtrguId3uisPQzYloakeMC1//HisDJqucq6S/R:qZPrrfiCQcloakeMo/PiuquLVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778388502, "uuid": "034ac8d5-08ae-4fac-a90c-f98f6cfd590f", "value": 10406160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778388502, "uuid": "052448b7-6250-46f0-93b1-bb44a29b5126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778388502, "uuid": "12f198fd-69a4-4d8b-9a67-78fac889e270", "value": "psiphon3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589b1735-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436122, "uuid": "fbd15122-606e-4acf-9a00-255a038139d8", "comment": "Malware payload (Mirai)", "value": "6ff202c6f8a908d49245483bd0b133fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436122, "uuid": "2face947-b7c9-44e0-bedc-ae9cc4398422", "comment": "Malware payload (Mirai)", "value": "6690a267a8bda1b735fed705d6cea1ab0c30578d99432aa58edac002034f4342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436122, "uuid": "0c9ddbf6-829f-4c51-a126-d09a973b3db1", "comment": "Malware payload (Mirai)", "value": "4f8bd8529d05955d7b388486f62b0243963f2e94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436122, "uuid": "db9881c6-61b5-49f4-afd8-47e98707107f", "comment": "Malware payload (Mirai)", "value": "94e6d5b3e5a86961ef99afe83af59943c28ab691f144da67e3384ce5cc1636b42bfa443bee9584cd0e480bb207f8f8c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436122, "uuid": "83eed640-ba1a-49c2-bfa6-4b40c5706539", "value": "T1DB6302200665C9B1C931C1377DF40996A11A5EFEF66EE65B11BCE01760F0E63F0BB902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436122, "uuid": "beaf0b18-3f9b-44bd-a54f-3c328e1eed81", "value": "1536:Zwa/7W2gZdt+WBa1u3IXl+OmzIHtjdbLaB9GMpC:ZwE7nIdIWBR3awOxjtLYgMpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436122, "uuid": "cd37763c-a475-4c92-8c77-4d32e79c8f6a", "value": 67392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436122, "uuid": "98f624ba-6317-40d7-a18f-20f9e16b8a59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436122, "uuid": "9adbad3d-05a6-423d-b07b-5d5b71c2a0bf", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e049a78-4c78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778421474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421474, "uuid": "eaccc08b-fa90-48bf-8602-704e2411e1ca", "comment": "Malware payload", "value": "aaa66cb05266fe430a288ab500982c07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421474, "uuid": "768c3b52-a815-4c4b-bbb9-85b846d17a4c", "comment": "Malware payload", "value": "672751ab69dfc7b07e83d2defac8df06b0d31e5fc995b514a77bbbdf9bdcbce7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421474, "uuid": "86ba79ad-e190-4027-9114-48410befb85d", "comment": "Malware payload", "value": "28fcd2f07348e263a540a4490a31f4a237568ef9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421474, "uuid": "2990090f-9b8c-4f78-bcd0-d1e4ecf4e3e0", "comment": "Malware payload", "value": "797f86f9deaa20b72517352cea49c37de9168ceb2bb01ecac5fe335091c3ad937398b26c5dde14a099696706db0053bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421474, "uuid": "d7fad962-2fdc-4b9d-8d8f-569a0de29914", "value": "T1DB763A97B8924952C4E43637BCBE81C432630EB99BC7565B6D04EE383EBE1D90E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421474, "uuid": "d22c929a-776f-4c21-9f7b-d13ac6f6508c", "value": "49152:b9dlRWyt+pjAyVcwlPV+Hva5xjm8G2y/UF5cO78gyqP5EG:jlztUPGwlPV+Hva/cO78zqBEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778421474, "uuid": "05ece62a-0579-4b8c-800c-63382f9c63dd", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778421474, "uuid": "3e6e6f80-d0e4-47b0-afce-defd27f8e379", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421474, "uuid": "45a2e6fd-4964-4a9f-bff2-987847393862", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10713544-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413667, "uuid": "f10ef898-1759-4808-bc50-65666a4857c4", "comment": "Malware payload", "value": "852ef9d57d54f2a2977d54d39c5b779a", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413667, "uuid": "03f2fb5a-7785-4f92-bc70-3591a7b611db", "comment": "Malware payload", "value": "68242d55c311c2e28da0ebc2907f9146779118972446e6586acaab9ccf58aabe", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413667, "uuid": "5ff8171d-a4af-4c77-8863-8329bd7d2871", "comment": "Malware payload", "value": "08a02e53f79d935ad6f999335d607b79181df3ee", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413667, "uuid": "6d39bea3-09c5-4654-812f-2648c07c6580", "comment": "Malware payload", "value": "1edf5f4b06a53e855bb0da4c456d4323519aa0fb4770e57c22457effccea0e2df61e8d9612dd8dba31cdbe499ba71732", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413667, "uuid": "db95055b-68a1-47c0-908c-3fbc7344f24c", "value": "T1A575334F9A5EEAFFC623646896CFD914097F18539022FA3A7C13564D63023B17094FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413667, "uuid": "504ed63a-f2f3-4522-8dba-6f31061bb7ae", "value": "49152:82J2mQPHZ1t0d92YFz6cntMutj64/Ry3be0aiP9A9ihLI6h:54meHXt0LLjnu+jfqC0ai1A0hFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413667, "uuid": "28e96cac-5d78-4bee-be49-2a45609a4a8d", "value": 1688592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413667, "uuid": "adfa98bb-22f3-4e54-9a95-9b8795881c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413667, "uuid": "16001b31-d55c-43dc-a9f0-96d97eba6b1e", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78bf11d-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371400, "uuid": "d1b5efdf-5ace-4f9c-a181-aeb47448b22f", "comment": "Malware payload", "value": "996194ae1cfa9bb8105574ffdb23b164", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371400, "uuid": "07171ea7-933b-4805-b0cc-8c05c9abd638", "comment": "Malware payload", "value": "68ea3855e0137920794b7a73a259d2025e3c26939a373c63470e1c354dbf7cc5", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371400, "uuid": "36121d65-aa2f-4a37-a3a0-10f88c1aaaf9", "comment": "Malware payload", "value": "bf659a7050452576ae3b0d06844d7bd6fffbb95f", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371400, "uuid": "a32e7d7e-3d56-4438-83ae-06e93b995cc5", "comment": "Malware payload", "value": "b716a3cedc775a9f5a513c6cd2125faa2ad5bf025ec9028776f49a468627356bd20911f95373c850bfcb5e3842b7b0ca", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371400, "uuid": "e2e6c225-4002-48b7-8ac8-40c91d4bac3e", "value": "T104258D1477FC671BE17E8735C1724C2513F2A09356A1C34F8E86E94E2F67782AE066A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371400, "uuid": "f37a145b-2807-495f-b890-95fe09acbc20", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371400, "uuid": "04709cf8-918a-4e2c-a67a-9b815ceaf301", "value": "12288:cwv28GLGCF45NBIJH1i4bfX79lgwZ01JH1i4bfX79l34k8zLLF4iQaNB:wgNBs1v/79lML1v/79l36fNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371400, "uuid": "521e55fb-4337-4dc2-9085-69b1da648d54", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371400, "uuid": "b5d54c41-7e11-412a-95c7-d1eedbb88758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371400, "uuid": "30d64ce4-a92f-4527-af53-fdb4a1de6e33", "value": "68ea3855e0137920794b7a73a259d2025e3c26939a373c63470e1c354dbf7cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9f2add-4ca1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778439058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439058, "uuid": "af709739-0f8f-4616-a3e1-3d03de688ad4", "comment": "Malware payload (Mirai)", "value": "0d65ddd9cd64898a941c47d749db1708", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439058, "uuid": "88ecacc7-9e16-4d05-a5bd-8da3d542dc4e", "comment": "Malware payload (Mirai)", "value": "6a010f8d8ce941fbe6f9c0b3bc5c7a4445d4ab7377550d809b6a6cc58e58922e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439058, "uuid": "c943f0c2-9787-4f50-b253-78898db2fc2c", "comment": "Malware payload (Mirai)", "value": "7c0faa218184bc749d19b7c61fbd56f1cbcf3052", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439058, "uuid": "6fd612a9-02fd-47fa-8fc0-945d8260043b", "comment": "Malware payload (Mirai)", "value": "5eae6deb24e42dfd970ed6af1d7727181f50a9f4df1b20bd157be505bd1180d883dae63a63a9a8e38be74d011eb05bee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439058, "uuid": "f259dac9-6063-4404-a8ba-b500bd15b534", "value": "T10D041856F8819B11D5D111BAFE1E528E33231B78E3EF72129D246F707B8A87B0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439058, "uuid": "24a1107a-d8f7-439b-8736-6d3ff904c8e1", "value": "3072:C/1yfitsbgn7e4mVgr7QYU8QSayjyPaPi/cT7hVDNKjY0ZNa5UcEwOO:QIfitsbg73mVg/bSHyjAaq/e7vNCY0Z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778439058, "uuid": "a00e987e-fa81-4b57-80e1-27a5919f16c9", "value": 183536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778439058, "uuid": "5ad9c8c3-c72f-4847-8a88-8c1b1c3b084e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439058, "uuid": "cdba2508-1567-4f53-96c6-13b6690fe947", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd209284-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371463, "uuid": "362d0052-c13f-4c94-8cd3-daafea705409", "comment": "Malware payload", "value": "99e4196cca604b1dccd4df7b83a80d15", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371463, "uuid": "5486febc-6ec3-4d38-b537-c132090fe15d", "comment": "Malware payload", "value": "6ab979a90d92682166d3243a90db9af3622bb036de09b3445c8f89652547763e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371463, "uuid": "e2af3eeb-a620-4f2b-8930-9959ed8d1179", "comment": "Malware payload", "value": "ee453028a68f7cb517481d7d2c45db50177f5225", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371463, "uuid": "2a69fcd7-94a8-4be1-bc56-44c8b0a8e283", "comment": "Malware payload", "value": "29aa7823d343ceed02587705feb780afee597f5fb233296b648886b3c1a5fd1b67a4d5ac762104d12f7de3d25bce26cd", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371463, "uuid": "67d9e833-15c8-4851-8f19-d464dc735271", "value": "T19E45AC4973F84614F1BF4B74DA7220088A73795AAA31CB8E1D56A44E0F72F809E95F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371463, "uuid": "b75bad82-f46e-488e-99e0-09c6815dc2fb", "value": "24576:YyOPuPCK5SasKVVmpngU0/SZilOBonsVSlEI6:YYDX+Fz0/S2OBonsglEI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371463, "uuid": "24763ede-3d26-4369-b15e-742146c60f01", "value": 1267200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371463, "uuid": "2503a362-2797-434c-a685-e7dff245d111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371463, "uuid": "b7fee4b8-fea7-4f56-9ca9-80de6379e793", "value": "6ab979a90d92682166d3243a90db9af3622bb036de09b3445c8f89652547763e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de1188e-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371384, "uuid": "dcd0fd3d-ad04-459a-b50e-dc821fe72667", "comment": "Malware payload", "value": "0ee1c56c2952cd97d79e04d4dcb18bd0", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371384, "uuid": "c79599ac-8892-4d6b-a838-0b6b1f27652a", "comment": "Malware payload", "value": "6bb8389533ec7145396ea5b43423be8d1739bd1710a73f341654a7725a10e0a7", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371384, "uuid": "4ea14ac9-bf10-484b-ad21-eaa6c3984997", "comment": "Malware payload", "value": "265755a1b6d58d3f84fd04f45c0764bd1cd29ab4", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371384, "uuid": "b149f712-4d6c-498d-83e9-6b92574d51b7", "comment": "Malware payload", "value": "c7944af9d37d7ccb16c0a9454acf1041644619db85b4e3dcd25b15b046910eb786e787685b19e8c8a7c9e5f79a7ee421", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371384, "uuid": "31e24a68-3677-47a0-8468-8f0f1a916ec3", "value": "T1F585DF5873F84625F1FF4B35B972551886B3B84BAA20C74E0D52544E0EB1BC0DDAABB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371384, "uuid": "abdc6a0e-86f7-4d43-8dea-c4acd041e881", "value": "49152:qvTQdiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:KKloSWVTR5Nhsm8A6xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371384, "uuid": "2ce09ed2-9309-4817-b88e-86916ae8ecd5", "value": 1869312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371384, "uuid": "8a9c370b-b994-4638-876d-b94ee6266cb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371384, "uuid": "f4b03a61-6fc6-4956-bb47-b8093479f53d", "value": "6bb8389533ec7145396ea5b43423be8d1739bd1710a73f341654a7725a10e0a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24a66c5-4c55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778406637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778406637, "uuid": "73848f28-263f-4482-a466-f0ada32ebe55", "comment": "Malware payload (Mirai)", "value": "a6575f9223906586db336d10c19e0754", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778406637, "uuid": "69f8bddb-9eb9-4a72-991a-d346cdb0ed27", "comment": "Malware payload (Mirai)", "value": "6be73941906615e7dffbed47fcf14449583b8d770d3b88d38f5272fa655fa4f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778406637, "uuid": "ec1ed307-e360-4e32-a392-1d0d688d9ea8", "comment": "Malware payload (Mirai)", "value": "68536967fb97ebfa9020ee3896d5513a7496f7a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778406637, "uuid": "a4cd7cdf-b3a2-4976-8188-79c8d82c737a", "comment": "Malware payload (Mirai)", "value": "592aac5933a13787288da00dc4aa7865cae7194a6ad600544d232d702e5bb1d93d0e379bc3e3e67be44bc3dc2b6fc522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778406637, "uuid": "d1f11c00-b651-4da2-8f2b-6e82fe30dcd4", "value": "T13AD35AD2F8019DBEFC0AD7B6845B090AB47077116FD31A6AA7C73E67AD360D09D26E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778406637, "uuid": "ba84922e-ce71-4e9f-9d96-0516ae52063e", "value": "3072:A8azWnEN7jaZdE3FAq3k1uXgUnzC1xH6spydUnP:A3zWEUdE+8bn2bHJydOP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778406637, "uuid": "bd3d2ba0-e10e-4dec-a12c-930550c985a1", "value": 134208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778406637, "uuid": "872b66d8-8b78-4f9e-89c1-cd9ae7c6c527", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778406637, "uuid": "000934ea-296f-4fd6-b149-ec481a766169", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e79a23-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389535, "uuid": "fcc18f5d-21db-4b2a-9d06-3b3594e59dfa", "comment": "Malware payload", "value": "b67b5d2fe103a9928bba13a84c3745cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389535, "uuid": "b824dbbf-c443-4212-966c-cf6d972d6dfd", "comment": "Malware payload", "value": "6c8dec95aeab9ac14fc6feb38e271e4144cd8b03f62da6fe50ae500049f03d5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389535, "uuid": "8fa13920-9b62-46f3-a705-7d0e4a1d930c", "comment": "Malware payload", "value": "699f51e315e955f137076d756c4f5ab9956296b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389535, "uuid": "ba9d11f3-775a-49fb-9b90-7d699c0b0fe7", "comment": "Malware payload", "value": "dce0a3364aeb69b996d588665850bc91341bc5a64d32829841876d8a57b611198175d99e91786e97bbe9a321e8b430f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389535, "uuid": "9ea4550c-aab6-4588-8dfb-df6570295bca", "value": "T19B063A02FB051E99C8694D3785A74EA137726E992F315347A708F2BF6DB23060F16F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389535, "uuid": "dd85f2dd-b992-46c8-96b6-bbf8047e2319", "value": "24576:17EEzVzHJKi8ZNz9S1ruAPZVjQg1dOktO0pXHwb3mSjUfp+nygUU7yEIyk59yjY3:17EEzuNz9KuUFO8WiSXn985EsJWMj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389535, "uuid": "ec21d972-825d-4a3a-9185-b03800a4c7b2", "value": 3997696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389535, "uuid": "5ee3ae87-f899-4451-97b4-2a8278a0ddfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389535, "uuid": "223cdb51-3b68-4efe-a517-b40d184d803e", "value": "linux_ppc64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed202b1-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412456, "uuid": "53f18145-beae-4125-88ce-92de8344f544", "comment": "Malware payload (Mirai)", "value": "fa2f55000d6240683b40b99d2dcf87ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412456, "uuid": "ad50dbfd-65f2-4ced-9817-9b08bd58c369", "comment": "Malware payload (Mirai)", "value": "6d1dc1b4c1d9b9714fad4cddfcd5e9811e6a17176dfbd7dc310d3d9eba673518", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412456, "uuid": "e75cd33b-c7c2-471a-82d2-c5c34f3b239f", "comment": "Malware payload (Mirai)", "value": "a7339ebe2958da0f9bee2ccf61e7b6635e9cae70", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412456, "uuid": "83522926-b6d2-4587-ac80-5c9ce079b524", "comment": "Malware payload (Mirai)", "value": "e67316a994b9e07c3ebc8b5526392ffa52415b926f5e448aa65f8ec9911135069683a75156555208c431939561782d60", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412456, "uuid": "0c821536-88f5-4966-83d9-f2bc499f0625", "value": "T14C93F948F925A72AC3E232FFFB9D528F72131FB8A3EA31258D305B6133C1A951539525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412456, "uuid": "84528502-d165-4b45-aa88-ccdde4ea85ab", "value": "1536:jLnT05Dm2foXRYj5LPdu/Y3rac62aFkIRiP6BD2jj+iS65w5nfsgO:T05FcSTd4ma7A6BD2jj+iBmnkgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412456, "uuid": "3709abfe-2269-48e8-afff-f2c1baf7717e", "value": 94116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412456, "uuid": "4a503f74-06bc-4c85-90db-e6069b7ca3ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412456, "uuid": "6b838513-d2fb-405e-b365-a6cb61d178d9", "value": "xtc.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf568f1-4c6e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778417337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417337, "uuid": "4673f74d-fb8a-49dd-8abe-e2566cb55612", "comment": "Malware payload (Mirai)", "value": "1215a15fee313199415f4749dc237d58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417337, "uuid": "10b5b257-fbb9-458a-93e8-d664c18d981c", "comment": "Malware payload (Mirai)", "value": "6de5ca9bbaa2a7fc73483912743d07a4a6b27bcb42d7923b3778537f5fd971cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417337, "uuid": "8eed1fa3-d9aa-4f12-b7a0-4b6f05d48372", "comment": "Malware payload (Mirai)", "value": "e79ebde9f84b04ea74e8299649f8d753b7a97e75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417337, "uuid": "c9362033-2d63-48bd-9b88-87f69282561f", "comment": "Malware payload (Mirai)", "value": "fe225f583fffa4d19d9b1925d8461401c08a13ab8ee8620861e1a7c26896f99ccde9cf5c558e426bf7b8123d92e14135", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417337, "uuid": "e0517b22-8ba1-443f-b839-0f4ac09752ae", "value": "T192B39EA2F5221DA8C21545B421F1CAB45373AA1292535CFA65AEC63D5083EDEF33D3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417337, "uuid": "afed4a74-ce55-4599-8780-43b4991bc8c2", "value": "3072:gk1KxjCiDg16OIeHaVZFD7TecsILrgeWm+KsD7U+PRcD4zp:gk8CiUwOIeHaVZFD7TecsILrgeJ+tDgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778417337, "uuid": "d015becb-5f09-4891-9820-c09aeed7d8c9", "value": 116720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778417337, "uuid": "9d4f1275-5c67-44c8-8e00-30349870f793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417337, "uuid": "19f739cd-acbb-4fb1-b13b-f8325c4742eb", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9548f5-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436212, "uuid": "1fdf5c55-cf39-4ca7-b9e4-5795221a2cda", "comment": "Malware payload (Mirai)", "value": "82f91b9cf5ef8b50aecd9a7d00bf3b0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436212, "uuid": "d266624a-6f53-43d3-a691-a01794f35fec", "comment": "Malware payload (Mirai)", "value": "6f23573aba8b92713166a2911d2e3663eab13429943b0c0bb3a9393b4aba9c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436212, "uuid": "20f0b29c-f496-43b0-a941-52990802eada", "comment": "Malware payload (Mirai)", "value": "b7ad07bb7db09abdc1eadc4975337983e078d15a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436212, "uuid": "49dc0e6e-9af3-4de3-b413-2f3a39cf0da7", "comment": "Malware payload (Mirai)", "value": "69fde586bcd255981d310b1cd29d5438cb32de31c7ce0fbaf6cf2ae1103a68f2606fa46ff76427eb87adf9e0e5d37366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436212, "uuid": "9c526f68-e7fb-4562-bac1-9eaaed0c6bfe", "value": "T1D0B3E84E6F318F7DFBA8C23447B39A21975923D227E2C685D19CDA011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436212, "uuid": "ec75bcb5-5d8c-4d77-b19d-eb6f37d3502d", "value": "1536:GEkWi8LiZECcpHOWWJDmmn5Pd1Oe4MPrs9j4ZWn+E7+TeVedVPneQBZN0xl0C:U4i50poFtP49j4+7+Te0dVPZ0xl0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436212, "uuid": "d11d4663-c8be-4944-a74e-687a8ced4e5f", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436212, "uuid": "20c21596-39c1-4a2a-b450-ee3602d91990", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436212, "uuid": "fe2cab3a-a8f3-49d5-950e-b88a80941b38", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc61be7a-4c35-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778392963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778392963, "uuid": "aa692b77-c4a3-4631-95f4-c69a5c883952", "comment": "Malware payload", "value": "d3154a6c76708e6e9ee6d4552031946f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778392963, "uuid": "d85719c2-2d93-4345-a4fc-6d0972558af9", "comment": "Malware payload", "value": "6fdb0b9873413bc854604a32ae9b2595791d3da513cad6ed3562e606f1146b37", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778392963, "uuid": "7dd9e9a7-336a-480c-8c93-5d0c94f2ad41", "comment": "Malware payload", "value": "40f1e6909a5579d809955b9b3c0405e7abd41ecf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778392963, "uuid": "28443112-fc92-41da-a3c0-d9eb5b7e6184", "comment": "Malware payload", "value": "41511af3c53bd3dc9523f823c8d7c6b7c3ab7c52a22f44e6e4b55e4655a3a480a47b8b1ceb868aa9750c279b36f1a22e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778392963, "uuid": "746a6f73-6746-4090-8dc5-97c549130d68", "value": "T1D3138D6956857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C4969CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778392963, "uuid": "9c4fbfe6-5e01-434b-b6ed-439412d3d1d7", "value": "768:b8+49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b8+lcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778392963, "uuid": "bd394a81-ea57-496b-9503-d8a5f4fa52b4", "value": 45421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778392963, "uuid": "57f7222d-32e9-4bd4-a421-6ea9aa126a81", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778392963, "uuid": "9f4f2f11-a2c2-49c1-b753-8f8e5033d223", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a977f309-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371403, "uuid": "b541fa91-5d42-440d-8645-1ae151ef086b", "comment": "Malware payload", "value": "1ffcb92f65403e68c47cce012b1c3387", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371403, "uuid": "e84621ff-a201-43dd-8566-e5dd8c788035", "comment": "Malware payload", "value": "7140795a1ca0f0909c6222155534d4f71f8bc3cf43d651a5bce0df6270a0f9a9", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371403, "uuid": "151a5189-02de-40b6-b154-b3987aaa7270", "comment": "Malware payload", "value": "5103140d54f4e97abab29742be5e996b42688af5", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371403, "uuid": "e279c28c-ef76-43f8-8181-79d4c0e248f7", "comment": "Malware payload", "value": "bbd73b13eda94f2a5684f5f6fcbb8918f1238348b88af5f41c867c5e4c0a071753a618d3cbe844dae3de166acf3bb180", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371403, "uuid": "2370ac5b-7642-4d40-a073-c14b0b9186b3", "value": "T1BD744A2873FD6617E17F4735F172882813B3A4836691C74F4D45B86E1FA3B81AA067A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371403, "uuid": "99bf0280-b759-4a94-9afb-78ad2f7ede41", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371403, "uuid": "7cf2cf89-0fcd-4e8f-8244-bbc84373932c", "value": "6144:fCh459Tyav+OQnSshylTM9AFhAiL0zmk72ucQq2oc:qIdj9BFqiL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371403, "uuid": "167dd726-4d28-41f6-bbc6-caf6821c8df5", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371403, "uuid": "a9c09a9d-8754-4d86-bcad-85392eea45be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371403, "uuid": "b8df2fbf-612f-4361-8749-fefd2821833d", "value": "7140795a1ca0f0909c6222155534d4f71f8bc3cf43d651a5bce0df6270a0f9a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bed2ed-4c73-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778419314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419314, "uuid": "edd63211-9ece-4b08-a2d3-f9d9cd804e70", "comment": "Malware payload (Mirai)", "value": "a1038d20dde773515f5afac406253097", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419314, "uuid": "9b967699-26dc-4843-96cc-a179dc7c62c2", "comment": "Malware payload (Mirai)", "value": "7167e8d84c8d9e71a716ad3d24c5574097d5c3e6fb4edf73700ab53bca84105c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419314, "uuid": "939639d3-6670-47ab-ada2-1d0819e3317e", "comment": "Malware payload (Mirai)", "value": "86e1d957a4e940103ede167a3a1c4ba3b76cfb43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419314, "uuid": "dd242385-99cc-4a7c-a3f9-6f385e79bfd9", "comment": "Malware payload (Mirai)", "value": "119a8d841a03983a4839baeca4750aa96ce10e2351d0c6263792fa115678fa7048ab215b13e49db737aff928d5dda382", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419314, "uuid": "eb3d7718-fe24-4edb-a62a-d9389b7c9ef7", "value": "T153F3D80AAF210DFBE8AFCD3753ED070125CC955A22A83BB9B574D858F18A14B46D3DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419314, "uuid": "f18a3a44-585f-4f2a-bbff-1357bbb148a4", "value": "3072:WufkoDTITG33J7572bjsC+rPaVLSIuUk:WufkoDcTa3l57ItYPaVOIuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778419314, "uuid": "18426619-ff9d-4bc6-9137-ea44327affc9", "value": 165652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778419314, "uuid": "8d074f65-7311-4d79-b4c7-9163f065600a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419314, "uuid": "4a4cdf93-2965-46c4-bb55-40f66e5413d4", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb5c6ad-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448455, "uuid": "e41e6166-37d8-4398-99f6-3add2c5ff61f", "comment": "Malware payload (Mirai)", "value": "d1ded02c9a8dde9b0efa3ea0e27af92b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448455, "uuid": "8d6167ef-44c3-4e52-93a3-a368855bd0f3", "comment": "Malware payload (Mirai)", "value": "737eeb3333fdc193210bc1da724e85805c9ac0cbae2f991ff32980de465302c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448455, "uuid": "b37c9624-beda-4ab0-8bc4-564cf028b4c8", "comment": "Malware payload (Mirai)", "value": "f0299566182e3334a5a1ac348719dc3b7e62ade4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448455, "uuid": "3cbe7246-1724-4e35-93e3-c813e30c2405", "comment": "Malware payload (Mirai)", "value": "92d3f10d91d0d4cfd56c8f7d52f1e5461c4c9b428264c85c3a6e1295100793e28e71bc67fbc2593534848dd7260157f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448455, "uuid": "7a4e876c-96c2-4f5e-8be7-121e7899d72b", "value": "T1AC539C73C8296E54D19582B4B871CB781B63B48482471FFA5BD9C2BA9083DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448455, "uuid": "268f66b7-436e-410b-94a4-be92a64f1d51", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYP6gpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYygQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448455, "uuid": "25fdcd42-0b35-4440-a961-505f391fba82", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448455, "uuid": "202ec922-e5eb-4519-87a1-8639ce0d67a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448455, "uuid": "91d76e75-b37d-44e4-be08-c2c7b4db784c", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb48ff3c-4ca2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778439804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439804, "uuid": "82eff3a1-da7c-43a0-86f0-588ba79008c1", "comment": "Malware payload (Mirai)", "value": "2991b7ded4da4d5499cecd0d21e17cd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439804, "uuid": "075e8835-46c0-4a6b-a9da-9d8bb200930d", "comment": "Malware payload (Mirai)", "value": "740b04d5595894fb5e9532e3604f42c0a7801c39a1f99d8893c0c258d2a75973", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439804, "uuid": "b2e31fa6-27f4-4209-a495-f62b9eaa6052", "comment": "Malware payload (Mirai)", "value": "13f7a684f66c2ed6e52655a124a2fd16a240385c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439804, "uuid": "c5250247-5cd6-4ba8-93db-b1ef9fbe4f24", "comment": "Malware payload (Mirai)", "value": "567db40d463a0c74104f7ea8ba91cabfca7421306d86bcd34e73b6c1bf7f5ae2494c749eb2a13d0142990a84ce8e500d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439804, "uuid": "83a4fdd0-adc9-4cde-bed7-17ad06a8f324", "value": "T16C444C46EA414B53C4D22BB9FB9F424133339764D3EB73059A28AFB43B8679A4F27501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439804, "uuid": "742ba962-6c0a-47d5-bb6d-6d80308eaff1", "value": "6144:mbXOcOhE6ywONGMra8nMUfkwEe7sfhqagi+KCZ4WM/RZAm0+VgwWc:KXOc83yvNGMra8nfkwxUqagTb4P/jAmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778439804, "uuid": "a4f3b01f-3b55-4216-997f-213dc6f60cfd", "value": 254844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778439804, "uuid": "00d601a2-0502-49f3-82d8-f8e14d5c551c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439804, "uuid": "c122c22a-5e52-4130-a26c-1307cf62ca30", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f5e0d8-4c0c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778375135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375135, "uuid": "3ee79caf-3a8d-4a60-a30b-01a53457bfd7", "comment": "Malware payload (Mirai)", "value": "6b390eb5e9dab7e1f5b49692f3449435", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375135, "uuid": "b89235d8-2970-480a-9047-cc7113dff5f5", "comment": "Malware payload (Mirai)", "value": "742802ec096b21b214403c59685216f585a48def35769d8a75ff805a8d5e690a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375135, "uuid": "9ff1b6a1-bfb9-4d0e-b390-6e63ddf501aa", "comment": "Malware payload (Mirai)", "value": "4ad8989ad0fcf95e6fe2a3a109f7274ba058e926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375135, "uuid": "600ec3d2-b1f0-4b50-8040-eaff738dbb13", "comment": "Malware payload (Mirai)", "value": "dcffa9667af0a01d8f51a4dc7e7ecab5c864ba94a9e68387b5de76406e3894fe3dadeae0ac91fe86e135a5ebc1ba3ee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375135, "uuid": "8cd39269-a3d7-4151-90ef-10d6990e39f3", "value": "T10783185BAB2C0B87C4EB5AF43E3B27F5875DBA6011E841C85116EEC503769B13112FEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375135, "uuid": "2e19dd81-9144-4a49-850a-5d53d5dc70fb", "value": "1536:7ytw+Q9hqxpr+eB+z4x2mVVwLkWNE6Sz5DI:6w+ihGAezbV6kkulI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778375135, "uuid": "2cf7f759-e669-4866-9569-8b506c6cdc75", "value": 82552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778375135, "uuid": "6da4d657-aa9a-4e1f-8a05-7fc3f56ec4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375135, "uuid": "2adeceb6-3b2b-4043-928c-f76eb45516be", "value": "8USDaF.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d954f148-4c4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778403266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403266, "uuid": "184f408e-604a-4db3-af52-d19ddbcfda60", "comment": "Malware payload", "value": "9e8db662a719c2b600c0670f8d43117b", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403266, "uuid": "6d3c404d-cb65-4a61-93b1-4e997e55b467", "comment": "Malware payload", "value": "77e6fbbdaaef4f6615341b9ab86519decc2c6d8646d6d3164380de8f008e9f99", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403266, "uuid": "93538a19-1a5f-4ce2-af8f-c7386baf60af", "comment": "Malware payload", "value": "c28e6ffc9d7e4f05b6d4ac10cd04166b1edc29f3", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403266, "uuid": "84702a6c-4c39-4fed-b747-4755cba09b0f", "comment": "Malware payload", "value": "0a7e5477a1e078f2f6e5e6005d7a8d169b448af55e47100af44a16b17da811ebd224ea0a25a96f7b8752d6a57d5a1ec4", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403266, "uuid": "ef17f73e-3d08-454f-82d3-a1ddc0ae0d82", "value": "T1B9E5BF15A3C866E9D427DA38CB14A332C2B2BD224B76D18F0A9AD7061F77D914F3E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403266, "uuid": "07a3df6d-c996-4296-af5b-03c9de3373b7", "value": "f418e835c2fb79101e806fd56041f826", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403266, "uuid": "13b3d3c3-1c50-439c-9e60-57fb9a977faf", "value": "49152:BJGjLhOLl7Mz0UDPF0EcIyJoSFSVxWfcpA961rbMD+aDohiPDHIfKWb2FUunU:9xtlfcpA961rbMD+aDohiPDHIfKWb2Fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778403266, "uuid": "fd826abc-82c2-47a8-899c-fcc2530edd0f", "value": 3126784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778403266, "uuid": "ccc153be-f19f-46f6-b5c6-5c14b25b0696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403266, "uuid": "74c03b46-a6a5-4451-a2b0-23c17735e799", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce0fa90-4cba-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1778449846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778449846, "uuid": "b52b7233-26fd-4447-b7eb-7b0e3aaf0944", "comment": "Malware payload (RemusStealer)", "value": "cea58531be72fc7695fe135e91d75687", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778449846, "uuid": "d28728ae-bf78-4ab6-a81b-935e5645ce4b", "comment": "Malware payload (RemusStealer)", "value": "79adb4750d81e041d3b8e2bb22442087aba9049bad429f484c15110f9a540528", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778449846, "uuid": "a9b57eb7-9ee0-4f86-b547-aff1b3762e88", "comment": "Malware payload (RemusStealer)", "value": "d02c58c72a0515216afcd9fee7025b80272c2a32", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778449846, "uuid": "177104cb-bc54-42a5-8853-b6fb94239f55", "comment": "Malware payload (RemusStealer)", "value": "8f0f5cd68c83ffe058e3b1e44e83151018ed97812d91b9661d54098948451a89e8bccfbfad4f5ac20e42d6377083fc8c", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778449846, "uuid": "56ff7239-66ca-433e-b3e9-8531af73316a", "value": "T1A1163A07696601F9C1E1E231C467A662EF65B849873827D32AD18EF12F363C12F39B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778449846, "uuid": "f387836f-e513-4398-b5f6-a395b17c4056", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778449846, "uuid": "c5c389d6-ee7e-4121-83ca-559922f7e9dc", "value": "49152:PZxg45xSl5aRTw37+Zp+/Bv9aEpsSfIQA5qKZbOc6c0:PfrqMRTYBvXFfIQAwWbO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778449846, "uuid": "8013bcef-38d8-4efd-9c57-1cd2dcf6f20d", "value": 4392576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778449846, "uuid": "bb704a5b-1854-469b-b9a6-f55f2bf60f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778449846, "uuid": "6422bf84-ca86-47ea-8e25-cebf8450d325", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9636517f-4c99-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778435795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778435795, "uuid": "fb532fb2-9cb3-48fa-bbf3-38ca4ffe9ce2", "comment": "Malware payload (AsyncRAT)", "value": "615b0b32356b4e6cd7a0077114499303", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778435795, "uuid": "9792fc5c-9a1a-4761-b49b-63ab77b449eb", "comment": "Malware payload (AsyncRAT)", "value": "7aec4effc2510ab05eb930205f91c33d46a6272d1c305660cc593467c5e6f208", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778435795, "uuid": "85689666-5e23-466f-be37-ca7370b47070", "comment": "Malware payload (AsyncRAT)", "value": "1ec5192e077055d68013f057b17f54c89207974a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778435795, "uuid": "fa4124e4-2c30-4897-a64f-67424370e391", "comment": "Malware payload (AsyncRAT)", "value": "d015d95f6685449ebaba07fb46ee1fb260ee889fcbc4a4e19206986ac9628cc1dd41fd2a87e5e00a298f68741676959f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778435795, "uuid": "88761e63-fdcb-4210-8b35-b19c115c84d7", "value": "T1E7C35B073ADCC1D1E1795A38BB66D6A0C7BDBC672482D10E39C07F5B1A36B91EA016F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778435795, "uuid": "fac7649d-1cce-4942-bd40-9927662f24d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778435795, "uuid": "3d7b0149-176c-4e35-b3d9-d7092c1e3b24", "value": "1536:GXBWE9IU6BXvZH0ub4FrQwOKhDfW36OzM4zKWPhA0XhrdBX5XbdIRM/JxPaaNmVY:G010ub4SKlmNGW+0Xhrj/IRMDPaaN8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778435795, "uuid": "fa5e9bcf-b003-44f8-85f5-10240eabf254", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778435795, "uuid": "88665de4-f3b8-427f-9068-ce38fd4182b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778435795, "uuid": "59e1df23-2d73-499d-b0db-766e44eee09d", "value": "PYTHON.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d8705c-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778414159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414159, "uuid": "7a9a20d7-0863-4a12-98e2-2650675d455d", "comment": "Malware payload", "value": "58b335de1d2941e5f4064a33d51f3cf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414159, "uuid": "81103b80-b4e0-410e-93ca-17786cdb00a7", "comment": "Malware payload", "value": "7ca557f06b5c9462d5a063524ea2289f39f7593ee2d0765f0afc7355f7930c1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414159, "uuid": "c40cd902-9a82-4f35-9df8-96812ee9092a", "comment": "Malware payload", "value": "4dfa1901607721372ef25bdd2394e0acff65001d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414159, "uuid": "68c152eb-0dd4-4849-85fe-7e4151b50b2a", "comment": "Malware payload", "value": "efc67e9ad7dae99a3eb8425bd3e30889d0664e96bffbaebb26f72926174772722e1e21cb6fb99e894f67a1e076019564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414159, "uuid": "71f4daa4-f6ab-4e31-b145-e6d9b8de0e60", "value": "T1AB8618237B68E70EC61922340DF1CAD4276A1C9A06D79517B385F319E9F20BC5A6ECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414159, "uuid": "3043f28c-d8d7-4b14-85fe-1eabf618e575", "value": "49152:BIBrvnuPnvxfMEkY6GL76gLvv1tlhGG0r4kjy9dskx2yaozWZlM8wFihsdfWR/0T:ikb6GJj5Woie/bCnEjEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414159, "uuid": "3405377c-d357-4b99-8f1a-01832317e2e2", "value": 8257751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414159, "uuid": "cc692d78-84b9-4941-8c43-4b6636d2e1e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414159, "uuid": "50d497cd-9d2f-42b2-a249-6d2b792a04ed", "value": "vulcan_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed663a70-4ca5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778441096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778441096, "uuid": "5505dedb-1cc7-4e2c-aa72-87f02033321c", "comment": "Malware payload (Mirai)", "value": "745189d338c8b15c9936bb7af5decc62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778441096, "uuid": "ef0e82ec-cf3c-4e1d-a9d8-46d99650cddb", "comment": "Malware payload (Mirai)", "value": "7cff5ff359133795e4adce5e99d813868e0b0e6fdd2e74e7c7e81dc19d58e733", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778441096, "uuid": "048e8fea-55df-4092-b8f9-d1e41884d06e", "comment": "Malware payload (Mirai)", "value": "76824070603d19df2100487e96f29c40da05b44e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778441096, "uuid": "fb95662a-6c38-4ea0-b0b7-d024ddf5804d", "comment": "Malware payload (Mirai)", "value": "8a76e1579aadc5b20a13f79053e7e99e293f97d0d2788a2db3549192cd0c5b19d239adb9656aef71a66b87b7acf0d178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778441096, "uuid": "fad55c03-3811-43d4-9ac9-b677d95aec2b", "value": "T12D6302765990273DCE214636CCED46022AE96C2CB1EF6CB2B27309B4546678ED42E9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778441096, "uuid": "9150499f-f18a-4cbb-a63f-7210a9c656ec", "value": "1536:g6PJxFu8Xa7Zk7q7TsPAGicDQVpQSoj9Ysnu:giJxtK727fVijfoJYuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778441096, "uuid": "1cdafc91-ca52-40d1-95cc-821cd5ead6ca", "value": 68428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778441096, "uuid": "59fa6391-3241-4fdf-bbb2-9986c69fd56e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778441096, "uuid": "62241c83-b43f-4c1f-9a8f-210199b10585", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf39ab2-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389528, "uuid": "c00c2fa1-0db4-49cf-b848-a85fd5e359bc", "comment": "Malware payload", "value": "7d5d26e8c8099b195ff5a2fc9f74c995", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389528, "uuid": "88b28157-ff97-46d4-91d1-f226a46b45c8", "comment": "Malware payload", "value": "7dc229801efb3b32ee26017347cb071e88d005497f12d052c77776953680b697", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389528, "uuid": "6ea48406-bcdd-4950-a4bb-6e58786ac6b1", "comment": "Malware payload", "value": "7fab5202c09156e2208608fb440a14bb6f7dac91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389528, "uuid": "d333e326-229a-49c5-bbeb-9c2241825469", "comment": "Malware payload", "value": "18ef7832503478eb451ffb1b1b3e27752ea32d0812a7c64bc97c3e9c929b26b6f8fb2e344e4ccfef11d303a7439c63d3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389528, "uuid": "88529f95-7ac8-4f98-ba8c-c369a29f51ae", "value": "T19C2167CCDDA6E0C691BCAD04F08DD147DC94B3C7F4A62A46EBE52661C0E1601A374FD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389528, "uuid": "80d0367b-4672-4983-ba6e-369c451df277", "value": "24:3J3DedeKNIkeJKOeD8MeSIemeIckMesFefIefIe4IeyE2MeosIeYcxn:VyHmdTM+h1Mv77mJE2Mhax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389528, "uuid": "774260cd-d100-437b-88c2-3e97e412ea7a", "value": 1395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389528, "uuid": "0d46f9e1-d46e-43c2-9c9f-3a4da2fc520a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389528, "uuid": "a967b925-3064-48aa-b282-d221fda72875", "value": "ccc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d096a6f2-4ca4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778440618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440618, "uuid": "9f194625-b0d2-46fd-915d-5ee1d7518a6b", "comment": "Malware payload (Mirai)", "value": "f4863b80c962c2afd9eda1842f08f89a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440618, "uuid": "d455d102-5dbe-49df-9560-e16fbb9f4ddd", "comment": "Malware payload (Mirai)", "value": "7dfa1f14a32b63a056ec51fbafeb3920407a4136e4e9b7a9d48992bafa2e7f7b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440618, "uuid": "168df4e0-67a2-4bf1-8089-1a91b887ca41", "comment": "Malware payload (Mirai)", "value": "40105d6521bad396baea355a7b5322948735a480", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440618, "uuid": "1d521b13-9708-43d7-aa4e-b66b7faf17c4", "comment": "Malware payload (Mirai)", "value": "1c224f398d4f8bda6d4c599b6b4eda298191cda2d763a32c55624a2d969ab71c4c1c9cc57da754924fb862994e31f829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440618, "uuid": "7de71b38-3d04-4098-bde0-4ebd69b390f8", "value": "T1C9262957B8928683C4E4367AA8BDC1C433631EB99B9723576D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440618, "uuid": "2a16242e-4dcf-4707-8f90-a3e7ab989933", "value": "49152:hk/x9iMG54PamkCK65OUVrFLhw1ofFrI5lPU1F1:m/xUMGKXkCK6PLrI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778440618, "uuid": "51c25893-f531-4860-b864-e7bbff00859c", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778440618, "uuid": "f6c45475-783a-4a98-a5d9-3c2d8f8258e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440618, "uuid": "674d4a61-04ec-44d0-9555-4f78e63c35cc", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40eee307-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448537, "uuid": "4604b877-91ac-4790-b39e-8d313a744a2b", "comment": "Malware payload (Mirai)", "value": "4f2311b210f02f3b3d718a1edd5067b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448537, "uuid": "ddae531a-d4da-4cab-a847-0a3130e287b5", "comment": "Malware payload (Mirai)", "value": "7e84f34a82cd335772da128974162c022d09fe197da66b4151ce11438187b795", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448537, "uuid": "7b81175d-5ba0-43d8-ace2-3c5215687968", "comment": "Malware payload (Mirai)", "value": "09bf84336d9cce793eb510b1ce44ae5a3361631b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448537, "uuid": "bc0c03a8-4dd0-45b7-8c23-2bb6bfeafe37", "comment": "Malware payload (Mirai)", "value": "1b2f5d93c0c075c971fc16268f6055846521607136cb30ff14166c7840807c885d4ac3775b7d3ccefcdbc07676695692", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448537, "uuid": "29a5c1f6-56e5-466f-8fa0-3b4106eafb77", "value": "T1E5732A91BD815713C6D012BBFB5E028E372A53A8D2EE72179D226F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448537, "uuid": "f8e255ee-d203-4837-a285-467e94940eda", "value": "1536:86dz9MTC0XU66Eeppw5brAMjztPz+Sbjt+UvAs/hY:86dS6EYsrAMNb+AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448537, "uuid": "ad719884-5486-44c2-9a51-a2b8a9af0960", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448537, "uuid": "aae389ed-aa95-413c-bded-347577592681", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448537, "uuid": "db97634d-3985-4124-81b1-21234abc370a", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff84584-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389534, "uuid": "889b56c2-6dc8-4479-9552-c6937b4f8070", "comment": "Malware payload", "value": "cd81344955e4dab6be470611b6f9e776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389534, "uuid": "b258706f-a991-4923-8a77-42be880b9a05", "comment": "Malware payload", "value": "7f5a35b7bdd1a1cdc9939bb1af4dda7e4d42a2a67b83b793d07b93cc0c719bb0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389534, "uuid": "e9770389-3ab7-4d57-8740-73f3e1f8e7b5", "comment": "Malware payload", "value": "18970e05d31c5b7fc2ad1e48517f04d88702244f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389534, "uuid": "37419ac7-12cd-495a-8247-33d0c1aa0fb6", "comment": "Malware payload", "value": "2e952a29726ec15ca5d5a3168bc065dced8aa1a137b5860b92f2ea9fcaf2387504238dd97610127b8a2902b3f1ba0959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389534, "uuid": "8291ad58-7a94-4c0e-84f4-9ed9b99ef0d0", "value": "T117162A5BB8924682C4E4367BBC7E41C432A31FBD9B9A52676D05FE383BBE1990D35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389534, "uuid": "87d02d1f-e6e9-4caf-8e6a-d0dd9a9813fa", "value": "24576:dwwBEWmA1QmDjrx0Nt69YjCSdcuKRgIdSWqTlKmpElbO+8CBTa/c1wCKu3igJ1+G:t+JnDErORj2irr42+XuNaCdwHz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389534, "uuid": "5cc57aa8-16fb-496c-81ab-8816c43af93d", "value": 4063232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389534, "uuid": "0b85e750-6841-4eb4-a08d-aa7f628ce0f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389534, "uuid": "d70907dc-4720-4bc1-8838-f1bda4b6a95e", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221195a2-4c8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778430017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430017, "uuid": "1cd4fd67-98fe-4b2c-ac43-04b97a60fabe", "comment": "Malware payload", "value": "304436b2fbafedc0956f9017d0d5e6bc", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430017, "uuid": "b0d9c23c-d6aa-4b41-80ce-723a144b8205", "comment": "Malware payload", "value": "8047ce0c7566090d522b034ada16cee1febbb08cdaf9a95363e46c6e11f29139", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430017, "uuid": "af91fea5-a08b-4c91-9683-745bcb365474", "comment": "Malware payload", "value": "e558344df718c0dd3abb9a6ee73ad47f01cbca3b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430017, "uuid": "5d40a8b0-0c05-4264-acf4-8dc193dc0ae5", "comment": "Malware payload", "value": "f1e11afd40525e89728e5d3e0cd3cbd8277dd8ebc8b11bd93fe5e5539ed1b5f0a5446323027ff9e941e963dac85666d4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430017, "uuid": "4d82355d-dc3e-4d17-a5a3-d32854e3702c", "value": "T15243E86BBA61D1B4C496C2709BDF01B0A170B4706B76212F3B4137B63F626D58E5AB33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430017, "uuid": "280c1707-9221-4077-8c07-e3cea6237106", "value": "768:Xh9nQcgquuKOCVQ9pvzgcpjinBNubkZeyfOZzNRAwt0h+:znjgqucqQ9pvzgcpjiBueeyfiNOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778430017, "uuid": "9c02c43d-f636-4728-a26d-08a5283449c3", "value": 58760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778430017, "uuid": "a5623e63-b557-441f-bc95-d86bb18461b6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430017, "uuid": "e78c98e3-5cb4-4ed1-becd-296fb236f231", "value": "exp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4444e97-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413968, "uuid": "841098bc-abf0-42df-b31d-e3cfccb2fc81", "comment": "Malware payload", "value": "833a53514a9dd767b5eb9c677a8fbb63", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413968, "uuid": "0378f45f-a214-410c-b1c4-97e583c24321", "comment": "Malware payload", "value": "80bf5b3cc4b372c94c2d185ac4ab076c31de71da846ef2375ac9e41efb0f2c2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413968, "uuid": "ea84c0ac-af95-4e26-95e0-c9035d1abff0", "comment": "Malware payload", "value": "79f8402f450acc35b05ce015f43ca4815c2ac0ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413968, "uuid": "c67629a8-4044-4e8e-8e9a-48fda50a751b", "comment": "Malware payload", "value": "d462f29cba7c4d25951435755560f4953f18f879f5f9d1e5f3c88f66e07eb5b2e2fa040ae5f3d67c3497bcac08334254", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413968, "uuid": "94399771-bce5-49aa-aa58-6647b8ffcbd4", "value": "T15B86F8C1E8A1D28AC63D6D31EFDAEFDCE2272E315DC8594AC9C4F73E18B214484B5961", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413968, "uuid": "ba1d1673-5e30-4998-9515-aba3ee8932ba", "value": "98304:qm4uNcmPAUw3ehzJsAoMQMYqufW6iKEfTn7Vt0UN4eOTxnDjEZ:ul9n8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413968, "uuid": "aabb111e-8e01-4f5a-bef3-83c396f6390f", "value": 8061112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413968, "uuid": "9e6d84fe-272c-4290-b00a-a55af1bf2352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413968, "uuid": "cf22768c-ae1f-4927-9979-b339eb0cdbfc", "value": "vulcan_s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3339698b-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413725, "uuid": "8f4f91c0-86ea-4294-977a-5b6b439e4e7e", "comment": "Malware payload", "value": "ed2cd8c355dea5851f55440af9df3c2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413725, "uuid": "8359479c-d87b-4d70-b9f6-068cb3d012ab", "comment": "Malware payload", "value": "80c0fc4ef2f860086c2d53eea1c24f7f766cfd932a04b8423b01bd6f6c044561", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413725, "uuid": "9f7d817c-096c-43a3-af55-ea1b7fb588da", "comment": "Malware payload", "value": "efe0c388d8e5991a49f11e6da57b322aededdf22", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413725, "uuid": "183f19fe-dc6b-4ab2-a575-21469cb1a67e", "comment": "Malware payload", "value": "9ac046eba25ab22600c81be08e520df9e9c4a92ba46496f9a8dde33d177c89cc88700c92de7ba207e03f5288967081b3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413725, "uuid": "c0d4683a-6959-416d-b1e4-0cfbd863247b", "value": "T100661712BF88DE5BD2A821358EB7C23833D53D04C1B060369656F71D1EBE2A49D6BDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413725, "uuid": "749bcf41-9ad1-4ba9-afef-155479992e77", "value": "49152:PZWP6YjWlY9Co+5XgQNOYyL+6bIK+fDDHHEt5Eb:bljItcK+fDDnEjEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413725, "uuid": "e1521863-f448-48ce-8698-6fd19963d445", "value": 6815892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413725, "uuid": "4e0d8957-09f0-4676-9a5d-6ecfbbd9f3f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413725, "uuid": "e535dbc4-8b80-4249-96ff-0a00d4df4a04", "value": "xfsaild_sda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d30792-4c2e-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778389830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389830, "uuid": "431bbefe-79f8-40f6-9ac7-f1c392f9a960", "comment": "Malware payload (AsyncRAT)", "value": "fb7b5e705d46539f5918b164ad906945", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389830, "uuid": "7cf13568-da50-4420-9fd2-6d531675a5f4", "comment": "Malware payload (AsyncRAT)", "value": "81217e658ac13b1a180f23b6da3b01c072956d509e4a5b77f9b73db50e34cae7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389830, "uuid": "11b10b89-5d5a-49ea-a565-00f546b14724", "comment": "Malware payload (AsyncRAT)", "value": "900d6df851f77142f5a42d6a9ba4864dcd7c31ec", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389830, "uuid": "ac8b477a-d0ba-49b4-a31a-11af386a9019", "comment": "Malware payload (AsyncRAT)", "value": "7cb568a89166972412ac0826cc33bf37b0973eb2e5ccaf57bb3083e350a5597129612a70b3e6f9e4eaa3c8f3dda41c0b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389830, "uuid": "b58cda4c-2dac-4355-94b1-d15df37ef447", "value": "T101635B002788C959E1AD4BB4BCF6D10106BDD977A801CA5EBCC414DB6B9EFC685227FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389830, "uuid": "44cedd70-3e6b-4ac5-a4c9-c3f49669cf90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389830, "uuid": "ec298c66-6bf4-42e3-b42e-5a16c21907ba", "value": "1536:UZONjfU/cNRPZNg/hTytMtp2wD/YOGbbHFxEGGmbVclN:UZONjfU/clChTytMtYW/3GbbH3KmRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389830, "uuid": "da84ea48-3f6b-4637-9267-c0de6723d080", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389830, "uuid": "6e871844-7c40-43a6-918e-e35eb89332bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389830, "uuid": "ec839278-8b4f-43dd-916d-6f2fde9e35ce", "value": "jogoathen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dbae735-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436157, "uuid": "b6ac0112-195f-48b6-b0bb-f877f51447ea", "comment": "Malware payload (Mirai)", "value": "679b17af6020c70585c4007706627814", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436157, "uuid": "ff5544cc-8299-4253-91c7-cc54d2c51563", "comment": "Malware payload (Mirai)", "value": "815aa9d7d7984386c13f9e1f6a2004faf7f1c1e8dc4edb8271fca6974fa655f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436157, "uuid": "7e9ee639-374d-4d67-ba3b-254ec0c068b7", "comment": "Malware payload (Mirai)", "value": "d82cc30ce0ac58e6cf1ddd41be18e8c623767251", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436157, "uuid": "f4efe134-c101-40b6-924f-70867e25a15a", "comment": "Malware payload (Mirai)", "value": "290d94a10b6522c324ad86ae4ccaf2109f1664472da28024935a2166226bef4df248e816b76a180e1af0ae129d24f165", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436157, "uuid": "5bf26d68-5038-44f7-b99d-d199b9a67130", "value": "T117833947B981D0FEC499D03887BF7537C923B47E1239B29A67D4AE262D09EE01F19742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436157, "uuid": "57993f07-91a3-475c-bd04-d94e2d833d75", "value": "1536:0THF5amJjfczdAyI+1ZUjtEVkCkj6Rv3U8GbdGrAyvTKol:0THJFczdAy7ZUWVkCdRvAbdGrXTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436157, "uuid": "cee33e2d-e303-4e7e-b663-64e233d2d7f3", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436157, "uuid": "a3daef53-9695-4244-b4e8-625ea011484e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436157, "uuid": "92a6a9ba-13e6-424b-b4f4-28633c7987f0", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f3bbb1-4c20-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778383927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778383927, "uuid": "2c6b40d1-57c2-46f0-b0e0-123ef6cc200c", "comment": "Malware payload (AsyncRAT)", "value": "711ae03bc4d97cebb362265fc4ba7708", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778383927, "uuid": "e49ae80e-f51e-42f6-8e2e-6618b102b430", "comment": "Malware payload (AsyncRAT)", "value": "846a2e3a606c07e5497cda85364879b8ff31009a4526d75a7d1ab0d06c71b948", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778383927, "uuid": "391af8dd-016d-4f0c-b0ad-c31e6fa507dd", "comment": "Malware payload (AsyncRAT)", "value": "062e4b3e14018bdf06a2ec1e259dff012e645e4e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778383927, "uuid": "1a948de2-3824-4fa3-b310-6492d8f3ad18", "comment": "Malware payload (AsyncRAT)", "value": "c5f23102bb93954d3c4771b59ebee610db86089f3230453c8ac005d1ecf5ae4786a30bcaae1f3d98f556fcfa2f3c8753", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778383927, "uuid": "545d54be-f260-4149-b19c-efa4b7e0a02c", "value": "T141332A003BD9812EF2BE5F74B9F9A14582BEB513AD03D54A3CC841D64B137C6C962AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778383927, "uuid": "40e59483-50b2-4b68-a1a7-1118f3ecde99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778383927, "uuid": "5da6c1aa-b979-4de5-b4cc-297f968cdfc6", "value": "768:fqajaMbXpmlUivz9rBCZjxuO60b4ktr6aF/ko5rYI6OCt50MtYcFmVc6K:frcUivz6Zkyb4ktmaFJ5l6Og0QmVcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778383927, "uuid": "7e14ed5e-0cb7-4037-a746-67411b1ec604", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778383927, "uuid": "35ad78ad-3add-4dfb-8311-0ec2fd4494fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778383927, "uuid": "bdaf5fa4-db2f-44a3-8ba6-a169cb33d32b", "value": "hm888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ed5daf-4c6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778416139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416139, "uuid": "7851b477-14bb-45a9-9396-8cba9b494a8d", "comment": "Malware payload (Mirai)", "value": "3456738d2166a39c092a0a7dd30590c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416139, "uuid": "dac5ed4a-d12a-4758-a35a-ad03a79a1e78", "comment": "Malware payload (Mirai)", "value": "86429d2836f29232eac2755e97553d6270b6ef2f22fc606ab14b09c27534020d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416139, "uuid": "4e9937fc-4868-45c4-bcc3-4d83ce4e52a7", "comment": "Malware payload (Mirai)", "value": "ba696d6b648ac3f9df22c0b52e12f91acab446cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416139, "uuid": "98f96c9b-14c0-4234-b060-683013f48dbf", "comment": "Malware payload (Mirai)", "value": "9f73375d65f66f983295fbf35a0fea4d2bb7096feeda8352991c2b04d1a55ecf0d90e000b57d2120217ec2714b2c031d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416139, "uuid": "2cf7bc82-b66f-4f2b-83f8-6b7069371876", "value": "T116B33AC69313D5B5DC060975607FE731C67EE6391019EA81E3A9EE3DFC12A02C527A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416139, "uuid": "e22868c0-be32-4339-a027-4498f0b69dbd", "value": "1536:QhQVmOLRW3gb98MoZ9W9pV/F5Yal4cAcIgD2C6mLwaLo6Ysl0Nw1LTz+AvrXDw3Y:QGFA3Y8MoZo/F5Y8ieLno65ualkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778416139, "uuid": "d5fcc303-afd8-4409-99f8-22e3e8603294", "value": 112428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778416139, "uuid": "08828e2d-c612-49d3-ab09-2df9f03ffdfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416139, "uuid": "6215463e-a77e-47e7-b6bf-5df9b57880f0", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a420c1-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389540, "uuid": "38704a9c-03ca-4cba-b5e0-386d72dcf30d", "comment": "Malware payload", "value": "2da21d7c03bcee4944aa3607b4e5527c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389540, "uuid": "4528b73d-efc7-4d68-a242-a7e8ef391470", "comment": "Malware payload", "value": "8665f261b509e6730954603a2b018afa315e7c9108633d407c6a0ddcd9a17ab6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389540, "uuid": "14962663-f3b1-40b3-8015-91de0ffa045f", "comment": "Malware payload", "value": "21389606da35d9fd42a9f906e2e64c51c014c379", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389540, "uuid": "3c3d1b04-7e19-4794-af39-1e5ac3ea9bfe", "comment": "Malware payload", "value": "8e748f4bf12f1467094ce4a508c78e4d2d10fbe2b37231c4717c708bcd3eb621acc1c60c4f2bc7272bc98f713c4f9059", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389540, "uuid": "95bc8547-660e-4f45-89bd-d46cc3d315f2", "value": "T159162907F89551E9C0AEE134CA269253BA717C885B3023D33B51F7B82B37BD46AB9354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389540, "uuid": "f795678d-864b-4376-abfb-72eb955555c1", "value": "49152:+97JzAHYirb/TgvO90d7HjmAFd4A64nsfJ+gd1LBevF9eLNV4IR6ArC7rCUW5EE7:Z4SYvFg+4/E41i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389540, "uuid": "d15a0e56-8fc5-4e40-b1a0-5a9c0b8feb09", "value": 4177920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389540, "uuid": "f9ead6d9-e95e-49e3-b60a-aa861537e343", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389540, "uuid": "19a56a2f-5fdd-46d9-a07a-a967cfe9a6e0", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc9ac20-4c6f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778417930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417930, "uuid": "85465556-00f5-499f-bac6-eaf6d811e4b2", "comment": "Malware payload (Mirai)", "value": "b96b44be148ce4b85de58c61dd77022f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417930, "uuid": "d284d1e3-e5b7-4386-8be1-cc06906f29f4", "comment": "Malware payload (Mirai)", "value": "86ff4d725914bed8f617dd6026f49b41cdc5d54ff20d999d492050193ec7a7af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417930, "uuid": "343bc98e-ab1d-4882-84b6-d1e5a0a1a082", "comment": "Malware payload (Mirai)", "value": "76ac95afd1d3a89e15918bcbdb45e26d3865fbeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417930, "uuid": "b1cbc0bf-d6e1-45aa-b37f-81a9496374c0", "comment": "Malware payload (Mirai)", "value": "d802b33113abc761d527457d0de7d90a5e9e527160a4f62a5c93d7ee25930c02420c4f5b85c6a0cdae09b428a99afa70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417930, "uuid": "ba51c32e-deee-40fb-8908-70598c7b29c8", "value": "T124B34B0BAA91D97FC097A6F827DB81A18423F83F0736B24733D47DA56F299C85D25306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417930, "uuid": "f6b99377-a9a8-4cf7-8367-77fdb89b1c9a", "value": "3072:AbMtMlbejsUT7jHIgSwWDmeq0+y0e6nDp:ECT7jojwWDmeq0+y0e6nDp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778417930, "uuid": "8236e964-11b1-498d-9af0-a2ca15182472", "value": 111655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778417930, "uuid": "fa5d0029-1d02-452d-a271-ea05d174dc86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417930, "uuid": "c9d6e9b9-5f34-4cf1-8487-ed88b2d86c2e", "value": "zyre.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae3cac8-4c69-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778415053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415053, "uuid": "6b727cf1-6c43-452d-9e97-92893a0883c5", "comment": "Malware payload (Mirai)", "value": "61e5a3e30968db412f7d78615666eac6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415053, "uuid": "57db903c-775a-40c6-9e64-d684ab004420", "comment": "Malware payload (Mirai)", "value": "87b02ada2b13d666bb809e039e28e453b0cf68e69f3389144b3376effdab9168", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415053, "uuid": "3bc7a1c2-9fb4-4340-9ea7-5c99f1600f28", "comment": "Malware payload (Mirai)", "value": "2e52eba503385149f6d62273d3c021b4256c3dfe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415053, "uuid": "f2e9ba9c-25f0-4b29-9d14-f6971d1b0920", "comment": "Malware payload (Mirai)", "value": "1f4eb5d1b2f0299157e8ba8cf10d6b59d3aef280eeddfd354328fffa7ab11f4d98f05fc2205b7704bdd8ec3753b08503", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415053, "uuid": "be16fa78-30df-4a51-b125-9a405359df00", "value": "T1D8837C2375746A17C0C0E6B701A38322E2F72B5D5198D35EBE724D9E9B5938007BB6F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415053, "uuid": "d2446206-ea19-4acc-b15f-ca19ebd69932", "value": "1536:jOlL/VJ0BgMBSvGRrLAL74B2afVbs04S2vFUyeTQujy6ZoUAAPrnDAwO:qZb1OLtI0l/F9ZHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778415053, "uuid": "41e0c5ff-1574-43aa-a097-337083c25daf", "value": 81772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778415053, "uuid": "17f158be-fb0c-440c-8f0d-1bb1f1b239a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415053, "uuid": "dc4b2c6f-ee41-43d2-9397-d80a1d143043", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d59ad0-4c9c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778437078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437078, "uuid": "c7abdb6a-e107-4149-94e0-c5aa47aa3cfe", "comment": "Malware payload (Mirai)", "value": "b001e0b646289df8ff8d4d4bd04b9b73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437078, "uuid": "c3f45090-f9ce-4bbd-a468-a3d4707753d3", "comment": "Malware payload (Mirai)", "value": "88d9a02ec689f23dd0aad36ecfa5c55b790a401c45677e18df9e6e2209c08527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437078, "uuid": "2ba19f72-5005-4ac7-83ee-09f6932170a4", "comment": "Malware payload (Mirai)", "value": "a9459fd38e2571e421a6355aaf8feaa212db8ee1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437078, "uuid": "b8a3b158-f8fb-4202-b8a6-50ea82323312", "comment": "Malware payload (Mirai)", "value": "cf00f7994107c2eff40c167e6fa18e6423df61b83e358387e009dc169e322c56359817513b8556b3a739a74e0d016d65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437078, "uuid": "6e3da5cb-aa49-4eec-a305-6b45f8947f63", "value": "T1F6261957B8918683C4E4267AACBEC1C433631EB99B9723576D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437078, "uuid": "f8e3ff2a-6059-480c-ba1b-68907a42342c", "value": "49152:p21nWdSgfEvwAOaMlXhf4KxkiAAQlU1F1:pwnWgg6OaMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778437078, "uuid": "f0b2c7c9-61de-435f-85d5-d0cce7e78c51", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778437078, "uuid": "ad0f8b26-fb42-4b2a-9bdf-2581bae58c59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437078, "uuid": "6a7c4066-9547-4196-a5f8-5ec9185cb35f", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a84963-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371367, "uuid": "a5dfa162-fe09-4b32-80c3-0a803123020f", "comment": "Malware payload", "value": "cadfee63050bf5d9e20ceb8fe85751ca", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371367, "uuid": "5887f0df-5738-4bee-af4f-ff5dc96e58af", "comment": "Malware payload", "value": "8b38aea3c2a2caaf5b0bb257cae8bd4b040e7850bc8a0c473d236e8e6efe6afb", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371367, "uuid": "ff8b6813-a135-47e3-8669-7b57adc3ce6e", "comment": "Malware payload", "value": "630aa70a9e13f2bf84b8003984866a4f9f7f0db9", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371367, "uuid": "5c30e891-1737-48ee-8f95-746dad337ce5", "comment": "Malware payload", "value": "c465d80e8935295071a558d88e8543cd4c192068b2accc3960362aedbe80dc01726e3b4a349ac08003be6915bba3075b", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371367, "uuid": "cfc0170f-7f97-47c5-b44e-4c9dc6f919d4", "value": "T125258C1577FC6B0BE23E4735C6734C2953F2A0575A61C74B4E82E84E2E63781AE066E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371367, "uuid": "59925274-5383-4a3a-aaad-8774c52fd797", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371367, "uuid": "c4c0f0cf-985f-459f-81da-a432e7b3efad", "value": "12288:sr91TzRGY7VVcXFav5NvFD+DYcVMBxB1TzIGg0ZvFD+DYcVMBWEioU0W6wnFav5:EJTfvJD46csD46yFIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371367, "uuid": "34b160ca-a0d5-45b9-a331-0e05dc6fca87", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371367, "uuid": "6a25f33f-4153-4dc2-aa39-5fdb7ca6d7db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371367, "uuid": "e265439f-18db-472c-9812-2dd34cdf1a3e", "value": "8b38aea3c2a2caaf5b0bb257cae8bd4b040e7850bc8a0c473d236e8e6efe6afb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eeb651c-4c74-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778419677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419677, "uuid": "5f617fdd-277c-47ca-864e-a33c699e7cfc", "comment": "Malware payload (Mirai)", "value": "987b9a0595128eee78f6c411bda796e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419677, "uuid": "03286cce-fa81-4aa3-9896-e9010a69961a", "comment": "Malware payload (Mirai)", "value": "8b4bc7d7a504e2a2ad293c07175c3fe2de6f23ea109eb259f7c8c8c470ca82c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419677, "uuid": "5d62aa69-545e-406e-8472-8e5abcb40310", "comment": "Malware payload (Mirai)", "value": "0b060b5bcb6e7eec7627c432d3fa06cfaa8c1483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419677, "uuid": "859daae2-4bc1-4385-afe9-410c5a1456d7", "comment": "Malware payload (Mirai)", "value": "5d785f993b36d2f6a217ea37c29cc1ea81da65b38e7ed9e8a91e0ffb691909942a61901141830a453dae1a968821989e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419677, "uuid": "b66e035b-5959-44bd-b37f-351827775427", "value": "T154B32A575A2D0B47C4AB9AF13DAB23F0C7ADF56112E122C5E209BEC04776AB06432F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419677, "uuid": "5bb603e9-e119-4beb-bf1c-d69c6ff22ab0", "value": "3072:MIJN7jgfB9mlHZth0k3pg3dCxHjmg31+CBtWZDY:fN7k3mNzh0k3pgtCxDmg31+CBtWZDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778419677, "uuid": "93c410ae-2a98-4130-8df3-fa7adcf0f96c", "value": 116689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778419677, "uuid": "833dcdfe-34c0-4490-b4d3-3aa74f98dfd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419677, "uuid": "fff74367-5787-4b8b-8780-f399707b7f5d", "value": "zyre.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7910c5a3-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371322, "uuid": "9f01ca4a-af61-4134-a384-53ac3e357963", "comment": "Malware payload", "value": "10b06d30c772de89bcfd41b535bfbb1f", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371322, "uuid": "809bcfc3-1a95-4548-8432-6ec38a10b770", "comment": "Malware payload", "value": "8c148cc562ade2b72dcfd80c53ba126162bf1f7c97ca8a8dc8dfcb5b37e67c78", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371322, "uuid": "2e082719-cf4e-4a10-a130-43b68f30fd47", "comment": "Malware payload", "value": "16b741a3705d4f8da2d3d5e5ec5d63f6f2636880", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371322, "uuid": "cef17dc1-5e40-408c-9c5a-e4e4fd04e751", "comment": "Malware payload", "value": "4ac5d47387b7a7c87df7870ecbe2232d66c7407f37a561b6686f8faa4a4214d5bc889309c4e8f1cdd5721a4203f0fe83", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371322, "uuid": "54c96072-599d-4ea8-8625-7d11bedc4355", "value": "T10D05492473FA670FE17F5776E1624C2A53B2A493B621D34B4E42745E1F63781EA032A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371322, "uuid": "2bb74e0b-18bf-4ae8-aa0e-1fdefa59bf07", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371322, "uuid": "fb1f86ed-edb2-4484-b85a-95de841dce80", "value": "6144:A04/AxAvUGWkWA4RM4/p395Fgw6mk75ucQqVoQ7wdSJNwv/W66y2zbH6CIkCempn:A4wp7O7Fghvg/F6yzaKFgJkMSLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371322, "uuid": "7c580a1d-ec48-4464-8393-5e1addf08b9b", "value": 856576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371322, "uuid": "94ddce92-06b9-45b5-b964-5917a95e138e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371322, "uuid": "38e7b528-cb79-4a77-8e8d-115abae81d88", "value": "8c148cc562ade2b72dcfd80c53ba126162bf1f7c97ca8a8dc8dfcb5b37e67c78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c7299f-4cb4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778447416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778447416, "uuid": "c3ea45c3-b922-4035-90d2-396a5ccd2fc3", "comment": "Malware payload", "value": "395ecc8fbf6612c311bfe16b4ff45b0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778447416, "uuid": "d83e2f7f-9781-4d8f-988a-d6c7574c8085", "comment": "Malware payload", "value": "8c2db899d61623d09bcaa6d4861b6998a918a5003035fe1c6bf44f6c4265c2b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778447416, "uuid": "53facd90-04e0-4816-ac08-bd29dfa1c073", "comment": "Malware payload", "value": "e487187e524836104c648043bd85a7af1de69248", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778447416, "uuid": "847f0ac6-6d38-4663-bd9f-045b23716cb2", "comment": "Malware payload", "value": "c57a37eb4db786678427f5de4cf911874d7bbd5485611cfb0a31df78b06948819da0cfbbc0e6987dba9b35a58f119f8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778447416, "uuid": "a45e427a-2777-4b02-a74e-4d13244f7fd1", "value": "T15FC3D0446DD2C8A6D442003312291D7FC235FAE110EE8F0DF794B9DA6A69FA7127DACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778447416, "uuid": "ba2849f4-0ee6-418b-ac31-30938677b670", "value": "3072:1U/suahz+uM6Kww7RE8p0pUSzsOb+DQbzqu0VgKb:1dLSuM67PFpUEDbsQbOqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778447416, "uuid": "10949be6-d936-445f-9f55-fa2b46780ffa", "value": 123605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778447416, "uuid": "9ca2faec-fd49-4a8b-af80-3107e0005e37", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778447416, "uuid": "98cd9acf-2176-4b98-a8cb-f401e8d92d71", "value": "bot.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b091a600-4c6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778415653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415653, "uuid": "2a0c6799-18de-4893-af92-871452a5612c", "comment": "Malware payload (Mirai)", "value": "310d7b4d4a1d36e792ae05170538c14e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415653, "uuid": "8fe920a9-fe6a-4fa5-b058-a434bb3aeb2c", "comment": "Malware payload (Mirai)", "value": "8c5491244a10f51d325047243cab023ffdf4b95aff23dd72dbfd779e93d17611", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415653, "uuid": "41f6dca8-4c16-4641-9448-d24eeb2db43f", "comment": "Malware payload (Mirai)", "value": "95123276cc398056ba8899c2aa663145de01a4dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415653, "uuid": "dd827ebf-5383-4edb-9be4-fcb6237fc253", "comment": "Malware payload (Mirai)", "value": "b16bd89383bab3923cb896d858153052d73a79f969caebe850bde887db0ab736d0f9717b2cbc40810e2ed54202dae389", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415653, "uuid": "9789fd92-38b2-49d2-8396-bfc4d8839a83", "value": "T19AC34B86FD928B02C5C61AB7BA6E428D372513B8D3DF3203DD151F25738A85B0E3BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415653, "uuid": "a5f08f69-1f82-4153-9e9a-51cb1d572e49", "value": "1536:g9NZCHRPfNp5QoEpa7JbpJcMYjZUFMM7L2dg4r/xEBTrJu8X+GGwBv6OOgCk7Avf:g9NZARPn/73yeM1Fr/2BTsGjSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778415653, "uuid": "443d04e3-e31e-4414-8cb4-181c00f7e9d8", "value": 120760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778415653, "uuid": "b52e6858-67e3-4b37-b95a-dd7448b7b07f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415653, "uuid": "97a5b0a7-3bd7-4b4f-a2c2-03f3e9b556dc", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fdba28-4c70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778418263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418263, "uuid": "b956b403-0f9f-4966-8dac-edd645eb2967", "comment": "Malware payload", "value": "3a40daaafddb36d0faa6b022b14d68f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418263, "uuid": "d91b6324-0bb1-46c2-8c36-f4a08c5a40e0", "comment": "Malware payload", "value": "8e05d4a936f991d33971390205a67f1d5038fbb745765369fdd53c753f55eccd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418263, "uuid": "e678ce93-e042-4ef6-ad7c-300d3166da0a", "comment": "Malware payload", "value": "42fcb440fb2fe811aff3038cf047cb3a48799dcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418263, "uuid": "3fc583ea-e1a8-4fab-8d4a-ffc9d06ef34f", "comment": "Malware payload", "value": "1f5be4852b68038b6de96577c3407c9306ee480a57cf6d8ac895bdf9a2f8ae296427f2b4fd04a578ce51aa196782be59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418263, "uuid": "588dae8b-ad43-4140-ac29-0c894190def2", "value": "T17FD3BF9365F9AE4BC3D60E7EACF94A4DEE085E027D861061C4914B46B5E21F2EE3448F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418263, "uuid": "8a777d87-9ab8-4994-bbf2-5bcc045a1f21", "value": "1536:H8fhtmWIbbFpkAQrN6eWR/dRpc5vF++ntcaySm/2rJHH0zuHE185z9Tn7oG3nBaJ:H8fgRphoIlzpcvDtcFaJHU72D3E3mmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778418263, "uuid": "e40ae6bc-89c0-4277-9420-bced64028403", "value": 133410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778418263, "uuid": "cd1345e4-a27c-4d34-ad2c-5251324be63a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418263, "uuid": "3bf9ec8a-e6a7-4c50-a2d0-e4eca2dae01c", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec7659e-4c9b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778436776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436776, "uuid": "03cb1d52-8668-4d52-998c-ef414cce86ee", "comment": "Malware payload (AsyncRAT)", "value": "fcf5c0b9e4a6cb5b034f32a75a4396aa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436776, "uuid": "500c6287-4b32-4703-b076-14e2b0eedf72", "comment": "Malware payload (AsyncRAT)", "value": "8f6502f9cc4e6916a6481bf77b2e52473143f39a6fb258186edbb146e577fa65", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436776, "uuid": "513050a3-814f-466a-9f84-901b32272aea", "comment": "Malware payload (AsyncRAT)", "value": "e15367001747acd7677288d3ce3d123b903d6827", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436776, "uuid": "3e3077ec-3996-451f-b1ce-03f451cabda6", "comment": "Malware payload (AsyncRAT)", "value": "3d253a2271fabf3ff6784c3050c62611712b768917e21b7f743cd171f1135f447586124a82af1bc3e2ca1acf4d74332e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436776, "uuid": "5161102f-13ab-4e25-9081-c5d3b36f4e5a", "value": "T1F3D24D0433E8C5B2D2FD46BED83286008775E5974953DB6A1FC990EE2A237CD8E14BD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436776, "uuid": "35c7ccf3-5a86-4fad-98c3-bb3e6f39ea0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436776, "uuid": "877e090f-e63f-42ff-a1d8-099f9ed12444", "value": "384:bNHPiWD4iXdRz2DgtyeEHjP2S3auH9qbuUsU/QxnCJfJbndnjJ/S7uq0+:bFPJcA72styneSXIb4BibnjYuq0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436776, "uuid": "6a79be0c-9217-4635-9a2d-fac283a9204e", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436776, "uuid": "bdc1dbb4-8ccc-4b55-98ec-ec27fdef94ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436776, "uuid": "f4195a95-c7b5-48ec-af19-e293b1671ef0", "value": "I9BETAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8667ae-4ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778438760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438760, "uuid": "4e5ab2f2-fda6-41e0-b26c-f11fe37babcd", "comment": "Malware payload (Mirai)", "value": "c0d27a974ba09bc09f2370e6fcb49883", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438760, "uuid": "389f4388-b44b-4579-b49f-1b37d4214c78", "comment": "Malware payload (Mirai)", "value": "8fecd56e8d71e1807fc17a5c9cc6b9bf2268386d0b7875be61ff92b9ffb9b4f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438760, "uuid": "117a62d6-f439-4e1b-8c86-feff53afc1e9", "comment": "Malware payload (Mirai)", "value": "5a6ab470800451e9bf67b5823963ae3390a93e54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438760, "uuid": "4dbd0201-04c1-48dc-b2c3-39ad29819970", "comment": "Malware payload (Mirai)", "value": "65246d967e614fa276b5bfa7b8637cf54f33beff71676af1cae8c23031827666d8a32502ce0600576e24fff99be5fb5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438760, "uuid": "ddf2b6cf-2446-4b7e-80b3-bab8c22846e1", "value": "T1ECE3D097F5CADEB2E2F2953AFE0E428873012766D9B67101DD204D2127BA53A4F3CD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438760, "uuid": "6c11d6c9-c3b7-468c-b43e-dea868796f8f", "value": "3072:g8icHMgi9QyiqztOmnMbCc/3ueaqk+g6tXqXWyP1UxDxtcOw:lr5GQyiqcmnsCc/e5qk+ntXqXNqxttPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438760, "uuid": "1e36781c-3abf-4ea5-95bc-7588cdeae19e", "value": 143858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438760, "uuid": "8bf302b3-3318-46cb-a03a-993c7b392758", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438760, "uuid": "0d1b542e-2b3f-4ed1-8ccb-2bdd46501282", "value": "bot.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1de974-4c6f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778417929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417929, "uuid": "a2f17d6e-e3e2-4713-b7df-a485d3da60dc", "comment": "Malware payload (Mirai)", "value": "55a14825bb7dcdfc707474340a3bf364", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417929, "uuid": "5d540b43-608b-4d49-9c4e-3031d24ab724", "comment": "Malware payload (Mirai)", "value": "905220e5aa2b73fc9bbcb2391bc74c0924124af1f7b2c58b030719aebb423cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417929, "uuid": "a7cdb63f-a079-4e13-adcc-5d2b500dc4d3", "comment": "Malware payload (Mirai)", "value": "0dbc9b6c8914883a048d47dcdb2c51ae620a337a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417929, "uuid": "66e15480-8f5f-465f-a16a-05ff67ed7a78", "comment": "Malware payload (Mirai)", "value": "9b8de2fb1abc565837e04ef4a6af4815047c7e1d202df26539cfdaec9c29fa5845e141274b0a0bd4999e6b50341bee47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417929, "uuid": "368b9be4-e237-4317-8cef-9270af7cf866", "value": "T1D6934C41B742D5B3D04316F6269B8B620531F93B1B2BDA4AF3A83DF4AF242C8711676D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417929, "uuid": "d26fb26e-5ea2-42e1-b96b-2481ac3a78a8", "value": "1536:hCUlH1i7HonF3JxdRMV7xXfDgfNPcFPUXbAkXbAK6h9cdB+ciaSTtl2jQ5dvZmqa:gUCoF5xdRMV1XfDgfNPcFPUXbAkXbre4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778417929, "uuid": "c55d1af1-dc7a-4f04-832c-7979881679d7", "value": 96895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778417929, "uuid": "d79dc1ac-1e31-456b-9892-cb8b0e59f74e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417929, "uuid": "b8cfdc96-5bc3-48b4-9eb9-3dd3a7309673", "value": "zyre.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b090157-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448527, "uuid": "52db7338-7575-490a-97d6-7b2a9ea11f7c", "comment": "Malware payload (Mirai)", "value": "bf46439deab190fa2f7b96008ec8a44e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448527, "uuid": "9218f3c6-5f7e-4246-86c4-5a98b014afd4", "comment": "Malware payload (Mirai)", "value": "90be624a657820541b3db97e5a48d80147da4da55479ce562ad06623a99eea94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448527, "uuid": "2bb1fbcd-862c-400e-9f3f-dde9a14df731", "comment": "Malware payload (Mirai)", "value": "6f1102eee3e0867f7a8c3c6286aa6f3d10c67b89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448527, "uuid": "ae2bc126-6f4b-4f8a-aebc-e03a68af9e2e", "comment": "Malware payload (Mirai)", "value": "4a4be0999a750f0ab8c73d89a049b32c8ba112f0d69f2fe0eb9935aa433f01626e9b00343837a3de02259098c4b58af0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448527, "uuid": "f33367f7-8d48-4590-a0ab-d02d663dee7c", "value": "T1FF631A91BD819B13C6D0227BFB5E428E372653A8D2EE72079D226F21378785F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448527, "uuid": "997a8b4a-8d8c-4182-acc5-f11696c0be6a", "value": "1536:XGBQnw68oqNi5ILzi/GIw+D3ohyaRdWViEs/hX:XGBBa5881w+8kayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448527, "uuid": "fcf131db-7f87-47d3-bacb-74b520575daf", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448527, "uuid": "78d4797a-7d7b-4654-81a0-2fdb6b572c21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448527, "uuid": "d3a90d0c-2dcc-4d95-8992-a4b8d40f8e3f", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92b16e6-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413950, "uuid": "7fb29308-d9e2-42eb-b57e-0b702c99714e", "comment": "Malware payload", "value": "93676e423e0ecaad2134d7cae4712431", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413950, "uuid": "cc92926b-aea9-42d5-ac23-57b748a90f14", "comment": "Malware payload", "value": "91a62cbcc0bd9628da12416edf34ed9ae18008cb060093ab7543c9c461b759b1", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413950, "uuid": "c39e2477-89ab-49c1-8b92-24020ceab1dc", "comment": "Malware payload", "value": "e7fb47754e96b4f2993170028f5e7f52e6639ed7", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413950, "uuid": "11142c1f-d220-4aed-9659-6077120ad409", "comment": "Malware payload", "value": "8c83825a11dca9af78a4c88c6487f15d0659d941dc284064fcf9a8d685a40c789e4d5c09273f4e07e08dc060426ca979", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413950, "uuid": "2dd42556-5485-484c-93e3-6bf246d82085", "value": "T1B8A53305897386A7A309207E31F58FFED8DE11BBE0A743C2C5D8DA4995096F7ABC4349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413950, "uuid": "239195dd-c410-44fa-8ecb-56d0205b7cfc", "value": "49152:Re/9MlS2pwdcn+B9/P1qIGa4CBJwb/DOdYqJrKGS0hLfd9/W:M/+twqGVP1ZG+B+rkYqJrK0xTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413950, "uuid": "c2a66f20-e604-4c03-be63-ab8ee2a48d2b", "value": 2187812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413950, "uuid": "9b9ae84e-c074-405e-8d21-1f9a04c88eab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413950, "uuid": "0ee4022e-bc8c-4ba9-9501-6fd2271e8a2f", "value": "vulcan_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6419c007-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371287, "uuid": "390d8a32-0932-429b-bdb0-d312a49c9973", "comment": "Malware payload", "value": "54f7aa3ac074e9f59df5dd6bc251ec2d", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371287, "uuid": "fdb01e00-5fdf-4f5e-a93f-61def8a8d5ba", "comment": "Malware payload", "value": "91cfcf9e68f2416986a9a2a79d0b851a82ff684b1e0e55b9bf184b32733feb77", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371287, "uuid": "187df757-45cf-4d71-b130-3a006301fd11", "comment": "Malware payload", "value": "b45cbbe76a3cd2da4a1489aa55c387ee93b6f330", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371287, "uuid": "1a53178b-0604-4fce-904b-67d130216472", "comment": "Malware payload", "value": "75a478569e4af1a7586691eb91c342478e392a4cc34996b8efe09d322097a5ddd7e0429696fe80c30a072570d4f2f8b9", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371287, "uuid": "da85ca2f-c308-4276-93c3-c1d80f36975c", "value": "T141B43A0873F84626F1BF0BB5D67260194773B89BDA64C34F0D51A40E1D71B81AE9ABB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371287, "uuid": "3ac75744-f361-4b79-a476-fdebbf8599c1", "value": "6144:e0JteZKD5lv/ca59cSwCsdDPryPPJ3y6DNQ4n3NfK07w9bYUrU9rOSNdcnZ2:8K9lXcccdrern9fA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371287, "uuid": "ff2c2b3a-696f-4ef6-bec1-80b590a5a34f", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371287, "uuid": "7f8d92d8-ab5e-4e76-8328-a853f6eb0c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371287, "uuid": "129aac11-4367-4430-a42b-76ea5190f567", "value": "91cfcf9e68f2416986a9a2a79d0b851a82ff684b1e0e55b9bf184b32733feb77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc82b3c2-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413955, "uuid": "e2a2ef78-424a-4c8e-9536-cd41109d521e", "comment": "Malware payload", "value": "8f9374f22a8478371ef970124080832c", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413955, "uuid": "882aef8a-58eb-4d30-b8c2-7722c7e4956e", "comment": "Malware payload", "value": "92547b3d96c3f44bb65138ed591d9a8c091d008f6cab78532f10bd4979111c11", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413955, "uuid": "8b59bbbe-ac01-4b7d-b052-ccc15c82c4c5", "comment": "Malware payload", "value": "a4a467c020ae1b3433246750881a28eff126a119", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413955, "uuid": "4e710a95-80f4-4ff5-9288-d26910c22763", "comment": "Malware payload", "value": "d38ff961f54703049bfe2402c8cf5f6ed692c25cb4891680cdb40631189c36ec51832e11bdc585443b67f5a8205606f3", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413955, "uuid": "c57e4641-829b-4d84-9a3f-fd92e181aed4", "value": "T1B89533296E07A64CE63F5087B588C1E255FDC99505DBE8C3FD43AF54EE00AEE99F8006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413955, "uuid": "07901e11-bf24-400c-88b1-041c7d3c8a77", "value": "49152:pc9SizOW59UQi31e4pMors5pMdL9L2qHaY8lLHFUPj7xr4:py59UQ+1RJowbL27Y2LarNr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413955, "uuid": "b2ab9d87-a497-4245-9cfa-14e10165250e", "value": 2043008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413955, "uuid": "a9787017-30cf-4648-b6ec-8daabf0d1f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413955, "uuid": "027df0fb-76cd-4445-8fe5-c767cb3d30b6", "value": "vulcan_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9991c309-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371377, "uuid": "1f013f4d-0c52-4f2d-abe0-41bbd4eea9a3", "comment": "Malware payload", "value": "ef21977f80607c6db34f9984a910fc2d", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371377, "uuid": "d45479d0-9c64-421e-8fed-a8d9042924d1", "comment": "Malware payload", "value": "9346834bdb622d2e786277fe1b004e0b162a65f18db9b13a7887ba05d9d727a2", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371377, "uuid": "b4a54b64-6156-444b-a77b-77f170457810", "comment": "Malware payload", "value": "2cbbb1e16b959fe11d25c749f1fab4ba092a0ce1", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371377, "uuid": "6ef4ae01-e7a2-41e5-942c-b368bb3a8b11", "comment": "Malware payload", "value": "11f87fed62f6428bf2276359b579930418b769e4f0a564b6b1ef942d66d1a61727ae5266bc6a3e29fecf44f5edf1c4d3", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371377, "uuid": "73183b91-7b00-4cd7-87f0-ffa7ab7e91c4", "value": "T110C45C0873F89A0BE5BF0B30D53705554BF2F457AB26C78E0D92A48E1A667C0E915BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371377, "uuid": "67bf50b9-19a5-473d-9f0a-2f6e72c4cdf9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371377, "uuid": "991287fd-4bf9-47fb-90a0-a72e4dca55e3", "value": "12288:wIVRHURSi7rSUteAT8BVex0Cnj02LEdCIvJjUJsHvo2YYY+mFz//9TKRHUuSi7rz:pqN7HZFHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371377, "uuid": "231778db-52ad-4fff-b091-5706fe509b6b", "value": 545792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371377, "uuid": "c849b400-7d85-42f6-8106-9c1ef85bdd7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371377, "uuid": "737af810-8c82-4690-a7d0-49262bc4ef86", "value": "9346834bdb622d2e786277fe1b004e0b162a65f18db9b13a7887ba05d9d727a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bb7a88-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448466, "uuid": "b4017e5d-fcbe-4470-9746-7344ab1d33dc", "comment": "Malware payload (Mirai)", "value": "5c494bc855d49521eef1f664fd8a1230", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448466, "uuid": "d3b006ae-7614-4fde-94a2-d361ef2d0b90", "comment": "Malware payload (Mirai)", "value": "9353512c8df16be2d01f4ee3392dd34ede1a4819d96c4080c71c987ce867cba0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448466, "uuid": "937fc253-2f49-45fd-af9b-b23ae0f9db4c", "comment": "Malware payload (Mirai)", "value": "79e8cee0cc93f80ca33d0cae4e04d8e752754454", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448466, "uuid": "d6ec2a72-e818-4f4f-993b-1bea119db355", "comment": "Malware payload (Mirai)", "value": "152f80cc7ed5703299a0e2c6f68569d4caa0c07cdbb3d7de2fa77df42bd3e70704b24bbab246c74ea7f60c6d0af55e65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448466, "uuid": "3096cdd5-347b-4307-bf00-aa823fa83ce9", "value": "T15E735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448466, "uuid": "2ce03c9a-d6e2-4278-af01-d454fe78f887", "value": "1536:jP+SbCGR18pspTH1qDQ2tXXUN95s0xwlWptCMR8/pW:zf4yV0pENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448466, "uuid": "b0c1e841-e4ef-45a1-a80e-fc0a7e2cf165", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448466, "uuid": "754dba82-d8bc-4f7c-97ce-2c6a4c5e2110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448466, "uuid": "82130f68-73e0-4abb-a47c-82fdae2ab8ec", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9e5565-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436293, "uuid": "76058748-e847-4e87-a1d1-346e74521a85", "comment": "Malware payload (Mirai)", "value": "8fa170b954ad9c3506e07a72b0f23d3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436293, "uuid": "2f92761b-5391-448d-9a51-cc1c453144f6", "comment": "Malware payload (Mirai)", "value": "93ebce3c5641f7e4c4cbc61b15daa82ee1cc35d961b72280bb6e9463e06f1361", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436293, "uuid": "97fa7d8c-014b-4370-952e-6d012f7d752f", "comment": "Malware payload (Mirai)", "value": "39e8e13326dbd429ec0093017e388a71651c57d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436293, "uuid": "c9d26ad5-972a-4771-8827-3bab9cea1e95", "comment": "Malware payload (Mirai)", "value": "75e6be932ce96ae60c391c26902bc977e1898be1d09d47453e1ec1c407b08813f08d859bd66e59a9eedebb127088e366", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436293, "uuid": "46a053fe-9430-4cd7-aeca-205ea4c72ec5", "value": "T13E836DC5EAC3C8F5ED2209301172BB675AB3D13E2268EA83C3A6D975EC125C0F51679D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436293, "uuid": "57b71a01-b3c8-4eb9-9963-fcab17dc174b", "value": "1536:mZtH7MIlsW4aoHG3eHO23tAjw19KHVd1YQRWBP:mvHzlsWxT3oOEti+9oYQkBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436293, "uuid": "4bae0c96-5b59-4afd-b8e0-a436ebb2a23b", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436293, "uuid": "fe15b36d-9801-4671-b457-04b3ee6d21fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436293, "uuid": "cfb57207-320c-4eda-81ac-9ada3d27038b", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54f00a3-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371450, "uuid": "6f3bc119-dd89-4da6-aabd-ed9e8616f521", "comment": "Malware payload", "value": "ab09e01650430832db761399d188c1f6", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371450, "uuid": "cf60285b-ce5c-4862-ab08-8b0f87f71ef9", "comment": "Malware payload", "value": "94ed93c3d091de4cc336822e89ed33b0200eaee8b05a8dba47f05a72bab10c79", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371450, "uuid": "35b4284b-6789-4b56-847d-1abf5965243f", "comment": "Malware payload", "value": "8b1b98813adb7b82aeeb2a7a31057d11d6774149", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371450, "uuid": "85b85fe1-604e-492f-abf3-f2541a56c678", "comment": "Malware payload", "value": "33d0f54576b1c3a837fa6ff433a859a02a3e2762b65221396039ba5864c44b9703dafddb90e791c3b6b2b0f55bf07a98", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371450, "uuid": "53a8cc0a-24ae-46d8-8e06-755d05e148ef", "value": "T132F44C28B7F9661BD17F4734E5720C2823F26087B661C74B4E41A94E1F6B781AE067B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371450, "uuid": "d20e1fa0-b258-49b1-a0c3-59e61f927ca9", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371450, "uuid": "2689bef1-346a-4605-bdf0-4a615af9f80e", "value": "6144:ECPXHnC+IxZAXyXp9ah69MFDiGmk75ucQqRoKfifnlpnyZ/9X06QV5odCgP8c9M8:nvn4jAAvah/FDynvw/dQ7gP8pFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371450, "uuid": "7f71af40-5431-46e9-a2af-d16063636e42", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371450, "uuid": "2e74f732-54e0-43ad-bb12-bac419be700d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371450, "uuid": "e83274b1-c263-410b-9352-535813f69885", "value": "94ed93c3d091de4cc336822e89ed33b0200eaee8b05a8dba47f05a72bab10c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57eb8d36-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436120, "uuid": "d3807435-5d6e-4f2e-88a5-8f20be5be710", "comment": "Malware payload (Mirai)", "value": "acfdbabfe65d1fdcd874eca3fe5cd56b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436120, "uuid": "b7aee75d-b7c7-40a0-ad49-68e89e3c62a0", "comment": "Malware payload (Mirai)", "value": "95b49190d62d08c3ea903ab2ea4cf83d5a7a07a34ff85714d3cd93904538d2b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436120, "uuid": "67bad56d-75e1-4b52-bafe-1969c4dfd87e", "comment": "Malware payload (Mirai)", "value": "d85a33f953d0d21da728ce21c1c1d0b3265320a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436120, "uuid": "e0f8740e-0114-4b78-acdb-a49b4e641aff", "comment": "Malware payload (Mirai)", "value": "6d45eb96066fcdb453dda4760e74499de905085c6bd1956d9d46a2375f3e558ecc7646b2b7bf4f9a294294b89bb441e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436120, "uuid": "c99cdfe5-ae04-4deb-a320-e17391046028", "value": "T12E13F124D3136A72CAAD4A37D45CC981A4671FFC006AD471B330E7B8F2DA05A7BF8946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436120, "uuid": "b9c51e4b-1798-45ff-b584-e5a8e5f8b17b", "value": "768:n/dYr66PqjnzCogWE2+fUckufz0LAq55ekWuMYGh4M9Ak62tPTJY9q3UEL8b:n1YnP8zhgP4Kk8NRAk1BLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436120, "uuid": "a4034f4f-8514-4886-b5e9-479d07aca176", "value": 44764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436120, "uuid": "ff34cacf-a516-4392-9173-21352aa324fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436120, "uuid": "1db5666e-728e-4a90-b584-c8e0cf53a91a", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17de30eb-4c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778438160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438160, "uuid": "aa02f293-22bd-4386-bfdd-0cf93f86381c", "comment": "Malware payload (Mirai)", "value": "b4362029cd2662755b375f512848259d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438160, "uuid": "93c9ebdd-77b2-429c-8c51-e72e91cfa768", "comment": "Malware payload (Mirai)", "value": "95c63bccae3eac36504b39e649bd272d616ba02a60feed2d2f1ad726631aa05e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438160, "uuid": "e33468e5-1532-48b0-a56e-59640cc8f1d7", "comment": "Malware payload (Mirai)", "value": "158945eed1ae5917515078c8acf7e39d6dd09d88", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438160, "uuid": "ceb5bb82-4e48-4a2d-b0d7-060f9edc7751", "comment": "Malware payload (Mirai)", "value": "436ca888a2bc518eadbecf1eef2e7c0e25ebc561a99d5fe980a93021fc0056a52c79f964e3090b833ba9b3f515e59ee9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438160, "uuid": "e4bcd9c7-dad8-4a20-9a81-7a7d3663ecc2", "value": "T1F531A5DBA2E090B3846AED41F75474C4E5DC86C361FB9EBCFDA4A462489900CF1B6B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438160, "uuid": "8af81010-63e9-46ad-8def-a55f4450b34d", "value": "48:ZEcynr1qbFbWoISiopGp3836KKPp8KP8a2v942v4cXV:uTnWFlzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438160, "uuid": "24d058c7-32b8-4f37-8260-349eac228370", "value": 1640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438160, "uuid": "3839e66e-44dc-4c27-b5b5-3601046320cf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438160, "uuid": "214696b5-8e7c-4f82-9242-6d0372a5fd1b", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f2ee8b-4c64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413008, "uuid": "d94b267a-038d-42c8-9965-4cc5d0d6c6d6", "comment": "Malware payload", "value": "e1aa24294aa0ae7ee7eed77c2c655065", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413008, "uuid": "cfe84838-52d4-4be6-b96c-745dd031346e", "comment": "Malware payload", "value": "972e6e4388ab858b058fc956bc049469da4a7050e7c99242938ee096dd44241b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413008, "uuid": "e220344e-52ec-4240-bb34-7e855ad7cab8", "comment": "Malware payload", "value": "88ba95bf9a6cd8f5ceb491abcc927c2282dfed5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413008, "uuid": "af25a26e-4a71-411a-80cf-c2e1ad5be40f", "comment": "Malware payload", "value": "e5b92fb179614aa90b7d61aa04b3e273cc63ec230f5903425baca572044fc6330b0fd788187613543ea2b7aa75df13ec", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413008, "uuid": "146f2877-9d96-4616-af68-15d14df3e15c", "value": "T1F3767C91FB48A136DA560A3248670B30B3A11D82C1F4C96F970AF72F59B26F7594FED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413008, "uuid": "99229653-b160-4265-a1d6-b4823e563876", "value": "49152:QCIbXmfU4r0akNtE+773cw8rd5yybzxqRmRSiUa8Pwy9/MtJGf+HHUt5E0:rf9+NtE0sw8XnC68a8Pl/GJGf+nUjE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413008, "uuid": "9fc405a7-bfc3-4c73-983c-46db664442a5", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413008, "uuid": "f1c68eb8-bb83-4102-8ca4-5f02d38bd317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413008, "uuid": "7a36b01b-0d7c-4b50-bc7f-f2f9fcda72cd", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6379b53d-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436140, "uuid": "1a64ad4a-948b-4904-98be-6d52b38aecd4", "comment": "Malware payload (Mirai)", "value": "ae4139cc177774d42ebf4ac21065a4f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436140, "uuid": "c8d14936-2e2f-4909-9e2a-c6e86760885a", "comment": "Malware payload (Mirai)", "value": "9acc2f90d22c8cf592c2838e75095539eeb236d962426c8df18d3d7365983258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436140, "uuid": "b85ed674-bac6-45a1-8319-c8dd1789c83a", "comment": "Malware payload (Mirai)", "value": "af7089d612955013a7c95c617c09b920c35abee7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436140, "uuid": "54eaf066-f049-4911-8e48-ad539ab55b9d", "comment": "Malware payload (Mirai)", "value": "96c898f91a5374a8d1b37f2ea611fc3f24953bc6f5efa386dbce1fca2a43fb18c99d456544232292f15041a4da69fa17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436140, "uuid": "20544339-6236-4d91-b030-1f83e97e4614", "value": "T154834B0273580D43D1675EF02A3F37E5C3EBD59111E4FA89660E9A4A81B6EF3158AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436140, "uuid": "4f4764db-5d63-4959-812b-357ed55d7f37", "value": "1536:pcV1nMuVe5BNppp8O6Fy+wmC2oyntcTx5:pcHZeBReFom/ox5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436140, "uuid": "40dc6428-1058-49b5-b9b4-475c7a697cdf", "value": 87736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436140, "uuid": "aed9d572-0217-44b6-b061-274f20477a08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436140, "uuid": "17b184c7-a3bc-4fe2-a6c5-72b9ed732964", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab34fa9-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413684, "uuid": "8f0ff2a0-a9ba-4951-a6d6-50b6c63ef108", "comment": "Malware payload", "value": "ced54f17f352787f8b00d1f25f0ff11e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413684, "uuid": "6b5ab360-0337-4d7e-b469-fa341d6a15cb", "comment": "Malware payload", "value": "9af4cdbefc2e730a842d51f048af313058da49a354877100fd31bb7be0769c5b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413684, "uuid": "5fac770d-fb19-414c-ab26-3e6bd9f3f1f8", "comment": "Malware payload", "value": "a1e5042015497760b07870cde439b2f1c0480b69", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413684, "uuid": "10b8c543-160b-4f59-8fbe-653db42bea46", "comment": "Malware payload", "value": "15293172a85fb798bb0b4518d2c571054c0a0f5ea1db695b7d387d8156568f01bc3c5b3a0587caca27fe53c5e4040368", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413684, "uuid": "35c48de7-e2eb-4f5c-8409-15eb35e6a5b4", "value": "T10166F855BDC22B66C1DC03B844FE626662643E454A95072323F4F7E83E7773CAF5A888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413684, "uuid": "9a00bddc-77fc-4153-9929-15b625e4fabb", "value": "49152:C5orrxZdaLf0h861q8HrZZiucOYS4+Lbkg5E4:Ce//d0f0h8se0BE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413684, "uuid": "0385f83b-11e4-4a56-a9e9-245f1266f103", "value": 6815892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413684, "uuid": "11385739-3bc0-4bb3-aabe-c929f569530a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413684, "uuid": "254cde30-5a34-48f9-a18a-f9cd2d45ed3d", "value": "scsi_tmf_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f41e17e-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436133, "uuid": "0dbe9e29-a428-4d1e-9ead-cc383c2b02e1", "comment": "Malware payload (Mirai)", "value": "8c73ce16808410d86245175c83a2a705", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436133, "uuid": "0dc68568-3a8f-4c66-879a-8ce86421e7c4", "comment": "Malware payload (Mirai)", "value": "a08af0701a3f0cf5d6ee7a42ae14c7e1aeda148d2447e932f44a93d768420f1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436133, "uuid": "9d0b1cbd-96cd-4a7f-8728-abaf12635072", "comment": "Malware payload (Mirai)", "value": "3bc4b9eca3054dbf01059ee8af4bbb484e803fed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436133, "uuid": "33a95516-a140-47dc-afe3-26f7061899b9", "comment": "Malware payload (Mirai)", "value": "dcef41487400c66e90ed9b57c0b83fcccc7fbe2254a1a9e09a050df390020d58f294d262392b1546cb63c8797bacd330", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436133, "uuid": "c6b00c2f-9826-422d-9dd5-11d4ae3e6301", "value": "T1D0C3BE97F68B24A1CC6146F007C77B9D2E6362119E6BE9E76C0E763B097A0DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436133, "uuid": "3ded7231-43ce-4218-820d-81210fef9f2d", "value": "1536:r5LQvJrKIEcfzXBo4BB45+LaLWqEICjCotZ0eVCUxZJmGg0o/LWA:r5LQv5gqrGqq5+LetUCokeVC9Gg0oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436133, "uuid": "8f1dbfad-ea64-4a56-b8c4-87302688dd82", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436133, "uuid": "9eac1aff-cc95-46aa-bc5a-60d61b3b9d16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436133, "uuid": "df681d16-7d86-425b-96ff-6d92b061872c", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f8f66b-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371340, "uuid": "adcb37e7-5d36-44d2-999b-a92931125a50", "comment": "Malware payload", "value": "21599bb63224a8d0de6dd4fbbd589aa3", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371340, "uuid": "1439eeff-e1cc-4017-a612-3fc6a47fde06", "comment": "Malware payload", "value": "a0a6aa7164f044699131791c589712ee90155baa35d697d49565d8d31e7b2efc", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371340, "uuid": "62f6654d-5ef7-419a-8d2a-a7040e8e5715", "comment": "Malware payload", "value": "70c9b06e7b0bce1be7f2fb74d20f2bab9b9c6682", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371340, "uuid": "89ee7cd8-6988-47e1-a48f-28525a7bda58", "comment": "Malware payload", "value": "6beecca3e5e241c481ffa541dc791c41401360813bb5d317b85193ac53bc611b514e4619c3d85b52ee31c68fb999664e", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371340, "uuid": "e37e797c-e48d-49f9-9ec6-cfc24f510238", "value": "T198745C1877FC660BE23E4731E573482943B3A0535A95CB4F4E91E84E2F52784BE166E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371340, "uuid": "e9faef53-adfe-4e8e-b3d4-a92d606e488b", "value": "6144:txvMSA8Jd2uHMTUuNWKoAkOrL5EVBEoq69iFu4YQmk7qnuFQ9Dml8IeS:txvdH8Tb5EV6bFuRdy7eS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371340, "uuid": "525fd869-772c-42b7-8828-b5e0a20c137c", "value": 366832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371340, "uuid": "d0197c8c-f079-407c-93aa-ae441372d344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371340, "uuid": "44905a4d-bbe5-4745-8b37-b1a41c0eef3c", "value": "a0a6aa7164f044699131791c589712ee90155baa35d697d49565d8d31e7b2efc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afde2942-4c6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778415652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415652, "uuid": "6c094905-5791-4eaf-9d98-dcbaa3e05220", "comment": "Malware payload (Mirai)", "value": "cc1a6fca14767f22a8f76bac36ff515a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415652, "uuid": "5aa11ea3-38a3-44d0-848b-1a3f137e3110", "comment": "Malware payload (Mirai)", "value": "a0e2ee892c4d4bbacfdd203abe85941d3a40033891706afe7f4791fe76b3f935", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415652, "uuid": "a68c3490-5c7e-4717-8e62-6180bb706f18", "comment": "Malware payload (Mirai)", "value": "d11f2c311c06c603c3e420f1f8838335a4c284aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778415652, "uuid": "fcc3accd-5456-4e1f-88e5-ce4f84fa35af", "comment": "Malware payload (Mirai)", "value": "f3f5d25e8fe2acadeb674f2fb57783da7457c5ef89c8c2e3ed3e008c9bba55d97b4eef9d55dfa74be2eee76944ab647d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415652, "uuid": "30515fe8-ffd9-4e66-91c8-59637551167e", "value": "T1CFC3188AB9419F02C4D325FAFB9E414933535BB8E3FB3102CE259F64238699B0B77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415652, "uuid": "21d145d7-ba2a-4928-b60e-3ebe39c6539c", "value": "3072:7YcpTPxdXMBg/5UVaFAbOJmYmSlXuJdYDhE+fvam2CYH:ja+WVaFoOJmYmSFuJwE+fvam2CYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778415652, "uuid": "a5a7431a-367c-450d-8b51-63951945a333", "value": 126412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778415652, "uuid": "75f3f77b-5fe8-471e-870f-ec73576b2d5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778415652, "uuid": "22b8ddd3-0660-46d8-9127-0cbd281edf55", "value": "zyre.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a3db70-4c72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778419071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419071, "uuid": "5b89312e-f906-4918-8b4f-dc1bb009bc46", "comment": "Malware payload (Mirai)", "value": "69faf38b340c4b7f2445ffc1a9bbea4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419071, "uuid": "060f93cd-debc-41e9-b15d-23749430d4f4", "comment": "Malware payload (Mirai)", "value": "a3ab856d75f95742dbabbc9bda21a56fbdad93d40f3e028826033d70dad3dfac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419071, "uuid": "a5348dcd-9f3e-45cb-89c9-41c547910a3e", "comment": "Malware payload (Mirai)", "value": "baf10eeb681681132137c8a02c4dc6d7e2df7114", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778419071, "uuid": "54ccb3d2-344e-4e0c-9776-e1eb034edae6", "comment": "Malware payload (Mirai)", "value": "2c9e7c4bbe9d2b919abce880f4f0646d236ff577f116a881f4953b46328058d532e65bcabfe2224caaa6cfb88b5fd30e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419071, "uuid": "4cf5202e-b4fc-4aea-a3a8-188917561cb8", "value": "T1BDC36C43773D4E43E1A20EF03A3B67E583ABA59321E9F4453949EF1E81B4D764906EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419071, "uuid": "08c7d3ee-2578-4581-afb1-6a46e0cd0184", "value": "1536:AUfiX06zXatuU0rH9frshYGTCMhXeiudlfdrLhivNwTeEQT/8VmGQmtOrfSgsHAD:N000TfrOYGWMYpBrtmNw0j8VfOrrJM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778419071, "uuid": "4cc8c90a-ebc4-417f-9001-c9e8b2a19868", "value": 126084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778419071, "uuid": "25d58190-c708-4ebb-be7f-2e25ef6b55ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778419071, "uuid": "6781ea8c-ca54-46b3-87d6-ff9ae0a729d2", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8350e8e3-4cb5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778447790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778447790, "uuid": "e867030a-c90e-4bc4-9190-2498b3d2a62a", "comment": "Malware payload", "value": "63efb107da116cdc1e880b2b4f872177", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778447790, "uuid": "89f37198-fac2-462a-a30f-69d4bf2d929c", "comment": "Malware payload", "value": "a54fd8f605da5349ce64d44b898b915ca55f9a2d58a03a399657e8d5128b8988", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778447790, "uuid": "df19f3c9-7d70-4001-a4e0-8a6f0e995816", "comment": "Malware payload", "value": "a8599035d1b8001681d69be32b44e1dacc5e4a9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778447790, "uuid": "bbff21a6-2b75-45d8-b017-740da27077a8", "comment": "Malware payload", "value": "7f8dc1f90a221679febe4229d97c6a6ed458100bdfa6d2996f4d400d34395d3adeaead9f70059c4b145e6b2b54694c34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778447790, "uuid": "6e668cea-e768-4f29-afed-a0c20eabb31d", "value": "T153D3AE78227BFE1AC64594B659E718343DCBEBF06DA106D152BCB0A397D132F2E1B046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778447790, "uuid": "eab08914-270a-43e2-abb8-7fb0145b6331", "value": "3072:H8fgRphod9UDRygMk/8vQFw0+4zhS9yVe6MS:H8YRAdNY/OQFw0+41fpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778447790, "uuid": "432359c0-1ea9-4cf9-9014-53d4156e5863", "value": 133560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778447790, "uuid": "ca61b939-2b8b-472d-b69e-b0192a5b7fd7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778447790, "uuid": "c7416fca-3bf9-47eb-b94f-377ac19029ba", "value": "bot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1791bdf4-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448468, "uuid": "ab4002d1-5e5e-4dd3-a517-2875a8f4d93e", "comment": "Malware payload (Mirai)", "value": "fb512a23c9d1e9006018f636ad25a234", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448468, "uuid": "99ab7148-29a8-43d2-8e99-9a3479dafb85", "comment": "Malware payload (Mirai)", "value": "a6a2c64a75422ae540a2a1d8d003855283503ab079d013bd3e8ba0c1a38562b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448468, "uuid": "2e1b0002-2189-4786-8d76-5fdb8171e83e", "comment": "Malware payload (Mirai)", "value": "48ef41f8b7eb82cf910d998180d4b49a660f0ccf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448468, "uuid": "af7b187f-3bfc-4037-883b-73488e02affb", "comment": "Malware payload (Mirai)", "value": "12d0df8a8c49f8860094cb69c32970c16e96c8bc6c0f65e6bff304dad62214e9a22aff605013ff636f3dc1a723eee9f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448468, "uuid": "2dd32b73-42b2-4634-b5ba-5a327a9c4a39", "value": "T1CE03F122D99475A1DE7120334C38C6C8AF6B0AF872BF76933738CA9CA4D1C457DA9457", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448468, "uuid": "a463e103-bd8b-4eae-9f1a-ef7df6a19589", "value": "768:EbhbUpgfK/Aw3XXeIMVNtTUlJ40DuMFB5yagkwdZH0Iru8Lf9q3UEL+1:IxUpgy4jTtG40FBQ3dZH0Ir0LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448468, "uuid": "dbb9e193-7131-49e8-801e-78bd17c32c13", "value": 38000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448468, "uuid": "a1f06ce6-d8f0-48b0-9f0e-9c3cedf7ab74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448468, "uuid": "a2e24394-e506-44fa-8185-a1b7222742b1", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693e931a-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436149, "uuid": "eea6f915-59bf-4f09-abf5-9c733e1ce148", "comment": "Malware payload (Mirai)", "value": "f77d89699b64f7fda3171103b855ed97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436149, "uuid": "5b427e65-740b-4180-ade1-f196064d8989", "comment": "Malware payload (Mirai)", "value": "a6aeb14d6312a80e194f8916b9909485dd8dd36fa703e8eb2601e1a6bf4cf9fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436149, "uuid": "fe926327-2202-4b51-9f14-a5758d1af7eb", "comment": "Malware payload (Mirai)", "value": "eb9e09d10bd4b70df80d6eb90d5b282d95c5122a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436149, "uuid": "f827e128-1498-4bf1-aa05-4d5401ade86f", "comment": "Malware payload (Mirai)", "value": "27a12c51a35d8cb2cbc7ec0c78b1fa5b62d63d7bf2397ff5eb5edf81b1a41436b47afcfa0d78637376fdd2905b5a4e42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436149, "uuid": "575d0568-aae0-424b-bc9e-5395767a9d0d", "value": "T1D7B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436149, "uuid": "aacea47b-5e6a-4d3c-9934-3fda2516eada", "value": "3072:qd5b7djS5HECmfBjmThRhFczcmVRh865UG:qdh7djS5ECnTozcmVROG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436149, "uuid": "58a3fa53-36a0-486d-8275-7f91893121f7", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436149, "uuid": "1d11479e-e6ae-47ca-a043-a4dbc6a99811", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436149, "uuid": "a389a6e0-4d56-426c-adc4-15e2e41c327b", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a9e865-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436135, "uuid": "943a5faf-6037-4656-9905-b86037e869a3", "comment": "Malware payload (Mirai)", "value": "feb2eebca2cd98e0327af14012f59519", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436135, "uuid": "783f79a5-90da-43b7-b6f3-0d2c21e19907", "comment": "Malware payload (Mirai)", "value": "a773a77e50f82553f7f16b4dd1077e8c3647172fb0db4c25823072e6bf4a3f07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436135, "uuid": "51bd23a6-9e28-444c-9fb1-b13e5b9b9447", "comment": "Malware payload (Mirai)", "value": "c2518fb1ae2547ec39a39343f0c900061f47e1ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436135, "uuid": "d13076c0-367b-4615-a753-341bf61d43cd", "comment": "Malware payload (Mirai)", "value": "0a56441e710dbf8c41bad0ae7066fac2a4f5a8e02f0d179d144457ca4b20b6617670729f27aea2afa3d76f07866aaf85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436135, "uuid": "70b3c34a-ebf9-4907-8b81-d86cf6b341c8", "value": "T1A2739E23CCA61998C25842B8B170FF3A6763E91056536FF6059BCA7AA047EDCF8053B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436135, "uuid": "435a6700-5fc2-4ea2-886d-13404fecd594", "value": "1536:9/P/lVA7lTCiQbizKIJCk74Y/dAC9CM51UzV:9X9VUMiQbi2IRx/dA9+SzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436135, "uuid": "91926e8e-9601-4fca-8f30-f9180a517e2f", "value": 80376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436135, "uuid": "da6848d2-687e-47f8-8948-db64f3f54296", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436135, "uuid": "b5504ae5-4511-4a13-b88a-7644e7becffb", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39158f2e-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448524, "uuid": "13e6ca46-9806-4aa9-9c2b-f80ee9809ce9", "comment": "Malware payload (Mirai)", "value": "a4ea60785f7f1b830cc825567568bb83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448524, "uuid": "cda32884-223a-4de0-b729-c36b7eb72046", "comment": "Malware payload (Mirai)", "value": "a8158a01df6e15187781b2209d9c265a2f282ef10fa6c72bcd4f53a2cf67e84c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448524, "uuid": "4746cdf9-d257-4706-8e0b-590857c5ddcf", "comment": "Malware payload (Mirai)", "value": "169f910dd774f17e73481918974a6e5163e27441", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448524, "uuid": "9abff8d8-7e68-4483-8e23-cafec1df6aa9", "comment": "Malware payload (Mirai)", "value": "6e4117514d2fb91de38ec840da107aa96a9d5c57c758f95cdd392b732417c56ee9e3e76b50f5367973b3b700bea8e082", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448524, "uuid": "0ad3dc49-789b-41e4-9b2e-e27c106b443a", "value": "T128633B02B31C0E47D16359F02A3F27E183BFA99121F4F689651EDB869276E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448524, "uuid": "60a4a6f9-d652-4a5a-8efa-2153a417e37e", "value": "1536:9yJWBrmSTKrFUTJGwITdHQ7+uLxWDeIQS5A16BH17Qs/nXB/:04OxUTJK1vDeIL5xrB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448524, "uuid": "f177d33a-1df7-4eff-9cb3-b1a66750b356", "value": 72700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448524, "uuid": "8ead29ca-5c51-4262-b16a-492978f71707", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448524, "uuid": "fecde4d3-97e9-4c4a-8dba-10b22ed6a5ab", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89252f9c-4c64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413010, "uuid": "87c017d7-b245-44cf-b0d4-38f40101dedf", "comment": "Malware payload", "value": "782949b90ecf4d3a1edab9c6c135f008", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413010, "uuid": "2dff7d15-c8e1-4134-9c5c-822269074cbf", "comment": "Malware payload", "value": "a9403c4eee2abb1bc9fc89a7c012a619d59c00fc08fafd74565bad24073cb49e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413010, "uuid": "bb109781-b508-4b4c-8142-c8f504ca970e", "comment": "Malware payload", "value": "c81c651f0a9ab948b5c0173b239545e545bf1ebc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413010, "uuid": "b1d929a2-3ec6-4455-816f-6b9361412ef1", "comment": "Malware payload", "value": "9630bca43f4d4ee7974fed12cf8a21464281e639b5a32ce76dfe5c0528f5cd828a9b2873358cfb02d9baa72d49fcfb67", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413010, "uuid": "7e0b3f73-9f1b-4084-97a9-c7cb8a1ca1da", "value": "T14901DD9B61B0AC3078B5893CFD9786F01047141768451D1D709F7E04EF2CB4CF6A1656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413010, "uuid": "1fe1ff8e-9d6b-458c-b801-eac22b2f5574", "value": "12:Izzfsx80+alc/3LeHt4LZ/uPfFFHsFQzBct7j3FAVkVFhx:o5Talc/CHt4LUnF1GQzqt7phx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413010, "uuid": "203701b0-e6d0-4223-b977-0bbf8e45dc4a", "value": 747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413010, "uuid": "823b7351-fe35-423e-b8d9-3b79162d2537", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413010, "uuid": "384d71d2-ec26-48ec-8fac-25c789bf6561", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e867dd55-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389548, "uuid": "9b1e317c-4b58-494a-a179-ef0d4f5f1cb9", "comment": "Malware payload", "value": "4c6e1c563bbb86136700a5d41ac6a479", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389548, "uuid": "98c65215-6695-4685-90cb-32388942426b", "comment": "Malware payload", "value": "a98f849e8ee26c698ab8252d044b63cad643f75fcde595e0a0a63e7deca73759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389548, "uuid": "e58a31bf-1fcd-451d-9992-8500b9e6b095", "comment": "Malware payload", "value": "1a92c610d83d68f8c36332d0c849478325c033b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389548, "uuid": "f3b46b48-98e2-4b6e-99f3-e8edb3d3fc4d", "comment": "Malware payload", "value": "002a25838cf7d347c932d8530042649af9363f18be25dbaa72e37bf964d761a659877e4475c08395575670e600165f10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389548, "uuid": "a7b16a4a-76f1-4b03-8a23-dcf355efd551", "value": "T1FD26EA04BDC42BAAC07C9F7895EACE5123705D148AF15A362294FBE8B8762347F57C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389548, "uuid": "dbe0415b-9c42-46ed-8898-2ad1b2321a48", "value": "24576:Fs4ZxhQMrxlTKYXiAt+6P8jYfZw+HeUzE7Edl4l9SH9lQQ8APUG9YGEvnj1P:fxhPrxlTKYXhBjIkHTQQ8DpGWnj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389548, "uuid": "6a5c25f9-678b-437b-a4e4-2327a33f9c86", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389548, "uuid": "fb10a5a8-c41d-44c1-ae11-e669f38b0111", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389548, "uuid": "89392ed4-ea34-4dda-9d79-c15c62745d8a", "value": "linux_mipsel_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ea0412-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371476, "uuid": "cd3a1475-10ac-4579-9c96-58faf0fd021f", "comment": "Malware payload", "value": "46eab27bf3e5d2db7774afa5afc1ceab", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371476, "uuid": "f1853502-8625-4020-ab98-319b26a6bb4f", "comment": "Malware payload", "value": "aa24d58bdcd1d9100fd00a9ed40af5cbd866170e69721573fb52c9e2a3080dd3", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371476, "uuid": "1b853043-68d7-4ba4-8fdd-b7667d8220d2", "comment": "Malware payload", "value": "6c89c8fb27a56b18128a00d0060f01b8d73b6524", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371476, "uuid": "9429164a-2939-43db-96f8-ed296a89ee6c", "comment": "Malware payload", "value": "50732d47a15c946463e56238a543ddb46f61280b62b61ae7caa2de9ae1aaeca4a66b9bad6ba196ac136e50fa0db4b62a", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371476, "uuid": "94da7d73-645e-40a8-aa8e-03cf37e31751", "value": "T1F9245A0CBBDDF59FE93C167147A3086B13F0906312F54B0AEE861D9A9F1A3C2BD56261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371476, "uuid": "18f45fa4-bec9-45c3-ba4f-6d3ed0a378d5", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371476, "uuid": "b729b025-b8e9-4901-89b4-57c3c9265948", "value": "6144:O3uf99HFgDVRvm+UNgnbaqz159HFgDVRvm+:OAPFwV/hbRz1zFwV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371476, "uuid": "d7019000-443e-4a7b-872d-0ddeb456e2c6", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371476, "uuid": "b5938845-2244-473a-9407-60ad5106ffcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371476, "uuid": "eb7f0ce5-4c02-4fa1-9d78-864d5db54de4", "value": "aa24d58bdcd1d9100fd00a9ed40af5cbd866170e69721573fb52c9e2a3080dd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c76e6ab-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436128, "uuid": "b72c9a21-918e-473a-b93f-98d8d40a20ed", "comment": "Malware payload (Mirai)", "value": "2584d081c96e5bef5fa247f6eded3560", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436128, "uuid": "e5fdb1c3-0495-40e4-aa71-4ea9e2225d79", "comment": "Malware payload (Mirai)", "value": "ab97e14dc3ba8ce4f868bb3d9ba5985c5e1a91a7d6673b9e29145e36397a8a55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436128, "uuid": "09aef287-6561-4c01-a380-2da16af99522", "comment": "Malware payload (Mirai)", "value": "c6e569a051627e8506839b8b8c1351151642cf68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436128, "uuid": "ab378f38-b57c-4ae7-803e-da71a6c181cb", "comment": "Malware payload (Mirai)", "value": "cb6bb452b63a88192346a7a02773534870f1c0f9fe712e6c14d97ccf1a91a1dd9423804cc0af3da806626470c2b56b3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436128, "uuid": "45d1c6d5-a308-46fb-af83-137b66460179", "value": "T15703F24A92D2CA01E12E907D16EE319F6400EADE7369C1673F85502A7DFDF0E78146B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436128, "uuid": "74ddfeaa-9b95-4662-b422-0a3028859565", "value": "768:gI6Iak2KV6lFoUiSRfH9oUXTtxoMpv0AN5ZZZ2ET5lK9DM19DcunbcuyD7UHQRjN:/9akHcvZz/9oUXTP0anZ15lKGvDcunod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436128, "uuid": "d7606f2d-5236-4fa4-ba2d-14a3e300d968", "value": 41312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436128, "uuid": "13b3cd37-47d9-4444-aca7-4d40c0ddaa33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436128, "uuid": "fb44b332-e7d6-4842-a30b-7be3dd830a76", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb4db5c-4c71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778418385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418385, "uuid": "2a1ceec9-50c8-4563-b6b0-94e7d28b0bff", "comment": "Malware payload (Mirai)", "value": "a5eb1c8f73fcca6eb62ce9498220bfdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418385, "uuid": "7bc7490e-049f-4a81-aca0-1681f1b06f9e", "comment": "Malware payload (Mirai)", "value": "abb94890b9b6b7f0c957e6e6b572be64fed56d317a4afe6daf395b02ac9630b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418385, "uuid": "4f4b01ac-b30c-4d66-a98e-631acf35112e", "comment": "Malware payload (Mirai)", "value": "30c4408e1f9efbfedc862683e506295caa9db908", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418385, "uuid": "f542a401-6310-4ec4-a29f-c4e47082d851", "comment": "Malware payload (Mirai)", "value": "bcaecc176243e13754b1e0a92d0ce00ea154ce5387da82b2ee327c3d30a7ad0dce118679576e3d72106a1f1b21ce9047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418385, "uuid": "5840602e-7c56-419d-a48c-945626c90c4e", "value": "T1F6E35C46773A0D43E1A31FF02B3B23E193FE918212E1B5817459EE1E40B6E7A5A47BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418385, "uuid": "ecbb4a38-f2b3-468a-bb06-82b658c0d404", "value": "3072:amLfM41T0zVSM3PafQevRstungXATxlFOedKHW1auLEBp0n:aIftZ0zVSDSATXFOeoHWcuLEBpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778418385, "uuid": "db866726-f6d3-481f-8f8e-d13d2b5b12b5", "value": 149532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778418385, "uuid": "a1785860-a4df-4813-a4e7-7d1dde557e01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418385, "uuid": "9d9644c0-6130-4384-a056-beb2e6fd60a1", "value": "debug.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeee46b-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371439, "uuid": "3a970516-c257-474e-9aba-4ab25d1ea1e0", "comment": "Malware payload", "value": "58a4ff953cf2c28a994f75d33a5a0d50", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371439, "uuid": "2e059220-2478-405e-9da1-afd2ac5c1889", "comment": "Malware payload", "value": "ac326f8831a2fc2df803c5afebeb499c3688408df16961732c96a3e69e5bd400", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371439, "uuid": "ecdf6388-f268-401d-b3c3-fa1cc72934c3", "comment": "Malware payload", "value": "9dd8dc872ea6a99a3641cb463cc17cd193ea0839", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371439, "uuid": "5cb2fdd1-2176-4cdd-9b43-187ba39302c1", "comment": "Malware payload", "value": "af6fde72f3947dd939f221ed53cf04c78ee119111eceda8357587b3c330ecef4a1c2f0c0b118b1b4caa18e80a75b5579", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371439, "uuid": "312c7bfe-15b0-4a7f-b7e2-c1048881d0d1", "value": "T1F2F45C28B7FD671BD13F4731E572482853F26083B662C70B4E41A85E1F67B81AE167A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371439, "uuid": "5c1f0bd5-7aaa-4b4a-90b1-10fb267544f3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371439, "uuid": "555529e0-d58b-46c5-9b19-98b771a93fa6", "value": "6144:qHNXSfiNYzKavyGkpHmC3g95FR3mk75ucQqAomcEDbU65OxznDJ2Zzjhr/5CEmKJ:8YcwKakpgFRnBhnDc8QFRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371439, "uuid": "33d94400-b2ea-4da1-9aa4-7d9343719748", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371439, "uuid": "83ad16fc-baf1-44c7-bb86-d76ff5f25ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371439, "uuid": "3d5b14bf-960a-4280-958a-a630e998cfe1", "value": "ac326f8831a2fc2df803c5afebeb499c3688408df16961732c96a3e69e5bd400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c4d71d8-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778414089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414089, "uuid": "dd29dcec-4669-4326-afee-853d79c9996e", "comment": "Malware payload", "value": "2685fef30856defdc08e2cb149f791c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414089, "uuid": "4d954feb-8158-40ba-a2c7-7879228afd7b", "comment": "Malware payload", "value": "aee80e97379eacf38dcbf0147ad67610bfc06371392234cac1ea9f74aeccac41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414089, "uuid": "43f88e89-6b43-46c3-a325-05300165a8f2", "comment": "Malware payload", "value": "c3f570beac6948a84ea5383d8c08daba716fcbd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414089, "uuid": "89b6bf66-46cd-4142-aa69-b9de507af523", "comment": "Malware payload", "value": "adb2fd1103be655ba8b0d2d5df52959992e8cacdb3af95ca205e20522eb15eb197dda4def9f2ca474614b3253a19f2d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414089, "uuid": "04b53418-88e9-45bc-b12a-8624211c18c3", "value": "T1E1764A07EC6549E9C1EED2348AB29213BA717C495B2123D32B60F7382F77BD06A79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414089, "uuid": "94cc7e67-c13b-4654-b7d6-2b9fdb0bb697", "value": "49152:mwCohGOiHEOnVWmAhZ8wWPnnlb0LPAi5YZruLZMpqhalZux5lYvDprPzQ0EytLdl:mwZ7WdGarKZAqhyQyvDJXEyDdnnDXZEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414089, "uuid": "3a4045ae-451f-4ef3-94c4-be7823fe68d7", "value": 7553208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414089, "uuid": "bf057bbc-2781-4493-abda-1e5074cb7e3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414089, "uuid": "831b0048-8ac3-4053-a8cd-30df2d405d4f", "value": "vulcan_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdce161a-4c61-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778411917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778411917, "uuid": "17614fd0-d938-4bfb-92fb-4f4d03b611dc", "comment": "Malware payload (Mirai)", "value": "a7e90db928258b33cf7eabba36c22ff0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778411917, "uuid": "2b3380fc-d5a6-424c-938e-a760eb6134e4", "comment": "Malware payload (Mirai)", "value": "af2d34521e18ecd22e03fba7c6594aa35b89df26da89f2849fe2b2f5e5473c39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778411917, "uuid": "ef6456a6-a9b9-4e3f-8855-b916c25e4b3e", "comment": "Malware payload (Mirai)", "value": "4c3adc00b41afd6a64954cd0218a179c21c1572d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778411917, "uuid": "3bdbba07-f39a-4aa5-8b37-6c225e5e536e", "comment": "Malware payload (Mirai)", "value": "f247388f48db92e94652f7b074e6c287c61e87799a084f2a1d58133f48dfc9e51126ef98e028bcd69795623d8e816737", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778411917, "uuid": "18519e69-a471-49e5-a941-3c49f6b621f4", "value": "T19304E75F6E225FADF36D833553B38A31A7A833C623E0C586E17CD5111EA034E552BBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778411917, "uuid": "86990d15-7c3a-4107-be14-921f44298838", "value": "3072:onJGggY4z5iuMqqBq3tt0WBKC6GxCcM+Hv4888V7u4mNRBN5q:Hgqz5dMqqSaKCcvQyV7ujRBN5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778411917, "uuid": "de958668-f653-47df-8f39-2f30ce6b564e", "value": 184904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778411917, "uuid": "16bd80cc-3ffb-43e5-b59f-9a3bdcd9f72b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778411917, "uuid": "6ddb3fe5-8523-400e-bc05-f22b93f41e18", "value": "debug.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e48bec5-4c1d-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778382337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778382337, "uuid": "bc8b1461-353c-4d42-899b-5bacfb0af4a3", "comment": "Malware payload (NanoCore)", "value": "dc4fc9182669f2f31babe2486937c938", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778382337, "uuid": "2ba4d10b-7d24-438f-a58f-63a3134cfa49", "comment": "Malware payload (NanoCore)", "value": "b03c21000c03bb01455f622d56c8b074bb3a1b1586f79ca8279456916016a13f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778382337, "uuid": "23c54729-cb35-4b3a-8499-1ff18393629a", "comment": "Malware payload (NanoCore)", "value": "c14787f28b217bb252fcb874125043c669ca0dd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778382337, "uuid": "bb2b1ad3-3f5e-45bc-ad07-d6d751d5c089", "comment": "Malware payload (NanoCore)", "value": "e00483d7b3ca56b58576ad71880da25d3adc585ac288e9cebb44af0dc8268646c744c94df2761a2eb06481765eeb41a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778382337, "uuid": "174a8af4-9529-474d-b208-fd2315f95ff2", "value": "T1CB14CF657BA8892FE28E867961120153837CC2D3D9C3F3EF58D854B68B663E54B071E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778382337, "uuid": "a1d92567-3014-4387-a810-8897e9769bb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778382337, "uuid": "3dc7af40-af30-4cc2-b5af-eb7fd6eba330", "value": "3072:czEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIx+E9teJPqnXjTA9LWTbg9d:cLV6Bta6dtJmakIM5xETe5qnXjct2Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778382337, "uuid": "ca86f37a-3f6f-4ce6-bf6e-db35c3d5ea41", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778382337, "uuid": "04cc64ab-4308-43e5-8ada-f943445025d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778382337, "uuid": "c932d4d3-c332-4edc-89a3-c91aaa39a3f6", "value": "menangmulu.jp.net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b48ad3-4c0d-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkTortilla)", "timestamp": 1778375442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375442, "uuid": "8fb1406c-3749-4cf2-8cc8-1411d7c7516e", "comment": "Malware payload (DarkTortilla)", "value": "b33f727e8e014964d296d911348e7bf8", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375442, "uuid": "57a6c918-f60e-44aa-8652-75e0e7c7cf4e", "comment": "Malware payload (DarkTortilla)", "value": "b0d42bf65e480d232fa60d58d47eeaabf7b5a7d58c869185139a180f5cb4d920", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375442, "uuid": "2f896edc-4764-42b9-9f03-10f5844a4cac", "comment": "Malware payload (DarkTortilla)", "value": "15cbed03d85d3f975abef5d2a3babf6d2772c26f", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778375442, "uuid": "23e50cec-d132-4f4e-b5d1-58082d275ed7", "comment": "Malware payload (DarkTortilla)", "value": "cad97866cafd4ea5b136d9555f976ef7c395c0f9040076c47ac4587620aabf461551fa4d2b249e5a53f4002cdba2df3c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375442, "uuid": "6d38450d-6f71-445b-8ce5-896d7521ceb0", "value": "T1D825F0119E8B6B98E53B0FB8C093004473F0D547D3A6D7AF6FED14FA29A2B48D923561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375442, "uuid": "37d037ea-356a-4802-95b5-da07e0df8e95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375442, "uuid": "d53a0a7f-cfa7-4167-9e6a-37fc6d47bc6f", "value": "24576:8or8r76t4CllVkoav+HJ/oyfJuz0zy+3xVks:G6t4Cn2+VoycSyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778375442, "uuid": "c3d6eab7-304c-4bcb-90c6-5a25d249fae6", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778375442, "uuid": "fe646fc3-3eb7-4fc7-89a3-b18506fa6db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778375442, "uuid": "8bf2d311-2908-4212-b615-1259248ae7b6", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb7036c-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436261, "uuid": "77bb34ed-7ee4-4fdb-8aa3-996466a315da", "comment": "Malware payload (Mirai)", "value": "5384a9360228191e77fa103478ef6e0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436261, "uuid": "c78967cd-cc91-4c90-b0ed-fc129c6184f2", "comment": "Malware payload (Mirai)", "value": "b1b053529fc1565212710e482c82fe0f57d74a5962965a19842cbddec1d1e9d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436261, "uuid": "a30d461e-d7e9-4111-9f7b-1a1ae6ae33f9", "comment": "Malware payload (Mirai)", "value": "ec9b1ed4ce4c8abb9f1ea62984da74c4f3cdaf20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436261, "uuid": "69bfaaee-748d-41ab-a3a9-14c098542cef", "comment": "Malware payload (Mirai)", "value": "342c82015a29b9831cfb968840d965ce4333022bf665a9d65142d535990d239a510a49bd92249135bf4fcab5029c9756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436261, "uuid": "865cf87c-2cdd-4f37-9785-425a78b67bd2", "value": "T1E903E146818AE525F017A33795BF3AC74C0ACB4DC1F886C51EB0B87AB185E645E283C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436261, "uuid": "0d8eb872-ae01-434a-a269-6121b63f4259", "value": "768:XXyZ9boRkEz8+RYgMAKusWxnqpCRivcD66WAEIhX3ChOmrAR++43woN39gCeA7yx:XYmkC8+WrfW8pEivrVhEXShXrAR++43+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436261, "uuid": "3e6a144f-753b-4be3-91a4-20f5dc2fb95e", "value": 39692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436261, "uuid": "dde60f94-c506-46eb-a79e-5faccda68258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436261, "uuid": "c2f26c1c-e6f6-486b-946e-976042030a08", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc36e2f1-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778389527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389527, "uuid": "2c5c6c0e-6d1f-48c7-9a74-759d29263696", "comment": "Malware payload (Mirai)", "value": "e51ec9481106742538888f4063f34d71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389527, "uuid": "e4693318-afef-46fa-b2f8-4ff443060fb6", "comment": "Malware payload (Mirai)", "value": "b20ab6b5ca6c40a5d33681ea258760e05bb5ac14fa7a1ffd6ba3f5b4604a8ed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389527, "uuid": "d39a321c-7426-464e-bc69-3c4500da3729", "comment": "Malware payload (Mirai)", "value": "1e80fb66553d1fbc8277be8c5af9ec0673cd75f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389527, "uuid": "d5d282d3-140f-4a28-8f96-cc3db6d00b5e", "comment": "Malware payload (Mirai)", "value": "d819a3b88bf009a56c7cb4132218203a533cdc83cb4cd490d797e171b6326e28bd750b6df462c644e55fea6cdfbeebf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389527, "uuid": "2e040164-c226-4cbf-858d-52ff279d9b81", "value": "T152631B07BA428BAFC14BC2F403F766399922BDBE0A36F1E5E3E4FD861905DD05A1D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389527, "uuid": "a69172f7-ae10-4c8e-8b6a-7635044f5cd0", "value": "1536:jDHkHRxHBFPSWOb7PlNM5TGpXE7erdllVStmkP:vHkHvBFVObDMt8E7e7lstpP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389527, "uuid": "79b78479-448b-42a8-85a5-8940717273d9", "value": 69560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389527, "uuid": "2e910d3e-4951-448a-bf32-5c7ccb7d7a44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389527, "uuid": "f8f8c4ee-1be2-428e-8da7-654448faf4ac", "value": "manji.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea1fc3c-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413717, "uuid": "695f2bb9-8898-4bfc-9b3a-505484900ace", "comment": "Malware payload", "value": "a610a2418e9d071b90710eb0c63d48f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413717, "uuid": "806317d2-81ee-40e6-93e1-8c23c29a76c7", "comment": "Malware payload", "value": "b2d12311144ac229ad1eee6cae4915767805a8970268908d526dfdfc4cadd6d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413717, "uuid": "ccac0f04-cd68-4b92-b284-3b33c7d52d4e", "comment": "Malware payload", "value": "9278349d231aeea56989d555c52a1c0974896998", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413717, "uuid": "39e40793-4218-4bcc-ac12-6649674e54cd", "comment": "Malware payload", "value": "7ae57301749ff12a7d6bb7d4e199d08e6a7a383a6a1d542f6bfc04c5d8b8a0f67d98fc4a7c4f8b60cddaf8d15b6f8c1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413717, "uuid": "2fd09fd3-97ea-4e93-8641-b4470038eb50", "value": "T116563A42FA082F95C924893389B34EA127626D587B318752E754F37FACF63060F56F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413717, "uuid": "2ea48ee7-f3b3-4c80-8218-36c52438637a", "value": "49152:I9DtLCO8XJmL9mGPXFTOTBWCsbjb0WMs34RySnHEd35Eg:ADtLCO8XoL9lPXFaVnE5Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413717, "uuid": "8a9b32fb-e62f-49d8-9420-92d8df632dac", "value": 6094996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413717, "uuid": "f221fa6a-36fa-4115-ae27-4fc067cecdde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413717, "uuid": "8b7510bb-cd13-45aa-90e8-906e4e19b30e", "value": "zswap_shrinkd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f248dc5-4c78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778421476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421476, "uuid": "e77bc808-f6a4-468c-ad9a-e4b5f390beb3", "comment": "Malware payload", "value": "d007e8e6417aaac11dc560dd5d7a0141", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421476, "uuid": "905b5876-4f1a-4deb-b68a-ce70cb54a992", "comment": "Malware payload", "value": "b37aa7b03d30c481094256eb2361597356d94f346219d8859455eeaa59e6124a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421476, "uuid": "17aef170-aa76-4245-ae98-a0f178fde801", "comment": "Malware payload", "value": "8854a0b0a38a7681f526aaacbf8317b50201f471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421476, "uuid": "6e60efa3-e3b5-46d3-b25c-f40baa6ee2a4", "comment": "Malware payload", "value": "b3f70d406da4131dc79c3c11711cd7460e24ed464323cd1a6741e23e69a46298030207c57c72a3e1107bf3a7bb70bc4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421476, "uuid": "bfd6a3a8-adf5-4401-ab42-37e564419ff9", "value": "T1A7861A05ACC53BEAC42C5E7444EACA6522B06D140AF2463626A4FFE9BC772757F478CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421476, "uuid": "4760cb26-d1f1-4b97-b899-d20b63e1b88b", "value": "49152:WwByQgsYPXIHNCHnA0CQZC2BBA4uC7IE17Il8ZkFca5E01:SgLQZVdImDOF7EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778421476, "uuid": "a80d28b7-14c2-4858-ad48-9f0249d62a10", "value": 8126679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778421476, "uuid": "3ca85260-6ac8-4c03-90b6-0ee2fe21df8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421476, "uuid": "9c535d01-ddd9-4c17-b42d-11d071e5fe8d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a613abd-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436125, "uuid": "ba86153f-5583-4508-b64a-af308a3c5ee6", "comment": "Malware payload (Mirai)", "value": "65672d89caf6031cfbfc261c269bdfb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436125, "uuid": "2c8af4ac-7734-4e70-9cc2-00dba0c88224", "comment": "Malware payload (Mirai)", "value": "b39ac26653ff674a9bbb085729ae658995213df36e85cd757e114c504fc9eba5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436125, "uuid": "97efb6c1-7ac8-4102-ab52-d5428154cc62", "comment": "Malware payload (Mirai)", "value": "6eed9827e9977f9c0b3bb0aba2fff8feb2b73d14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436125, "uuid": "acdc6a08-39b5-428d-ae1f-baabeba81967", "comment": "Malware payload (Mirai)", "value": "0cbdaf6374440e487608c196b0f132775bbf34a9d377d68946916bfe896a14f925305d34df50fa23aeb31c73ab6c22d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436125, "uuid": "6598f20d-74ad-4b2d-9acd-50f81c1b32f6", "value": "T1E4935B22B579093BC5E4943712F35326F2F6438A24A88B1E7E710E8EBF156D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436125, "uuid": "a9d255ad-ac4f-40ca-889c-d8530abcff12", "value": "1536:2l5GrqkdLucbPVizYeBtPaWvStPhYm5roASoAtep5:JngoeNLa5hYOc4p5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436125, "uuid": "badb4fb3-c379-4fdf-bdf0-30d8a3b2e539", "value": 91976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436125, "uuid": "5c518ddf-4ed3-41dc-b882-b3342dfdca3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436125, "uuid": "fa8411d5-0087-4969-a21c-dbd0ebc418c2", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ab1cd8-4c9d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778437439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437439, "uuid": "4ed48ea8-1785-4ea1-af20-caf2628af643", "comment": "Malware payload", "value": "48c934cd2137dbcc7601ff325e79f34d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437439, "uuid": "cda68f18-d361-4d08-ab1a-0fe503f4c6b0", "comment": "Malware payload", "value": "b423a3c1c0a0a4cb918a28be83b3c06bd3a2c7275ebace976656e67f03a0b8cf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437439, "uuid": "905dfafc-b479-4832-b681-9e845f8fbc0b", "comment": "Malware payload", "value": "53c97956a18e41f6201f2705b7c13cb6704cdbf0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778437439, "uuid": "cdda34d8-28f2-40d9-8a39-c719b59d78c3", "comment": "Malware payload", "value": "8b3632185b32a8e1ed3e734a270b90edc3efdb49a92c54efd0ae7d2d7a3b12fc18aa0c1b0d32888eb7db51a67af12c84", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437439, "uuid": "b59dd2f8-eed8-4bea-adde-55edaa18af69", "value": "T185136D6526953C25AE99883B5D7F2F0CB9A983E2304491DDBFCB3CF18C1569CE318A1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437439, "uuid": "89e8f974-d962-43f9-a96f-e8df4768fe69", "value": "768:bNZs9NyXsZztCL9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bNOHusZBcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778437439, "uuid": "68483ef1-5601-4491-b2c4-b2910d937ace", "value": 45429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778437439, "uuid": "379873ce-c01b-420f-8f47-9daa76771a6e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778437439, "uuid": "33e039c3-9318-4da8-ba8b-628467d7ac7e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124c1b99-4c8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778429991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429991, "uuid": "95004229-8ffa-441c-b6c3-ee5497e15f8d", "comment": "Malware payload", "value": "6183ba4f12a21c2e6aa017179bdb1eef", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429991, "uuid": "c89fc09f-d51d-4abf-b1b6-cd9e4932f28f", "comment": "Malware payload", "value": "b4fc478b6c4699d52f42c382ce665e61d093fbef964a9e448aee5ca95ed261af", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429991, "uuid": "d8f72234-9888-4447-a1d3-da81fd02c243", "comment": "Malware payload", "value": "a8faaf9015eebcb5f43e180516863fae83f6721c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429991, "uuid": "3cf551c7-6ee9-4f58-ac4e-d4ce733f4715", "comment": "Malware payload", "value": "a0d8bcd3cf24385a870fea5bb2df7cd637b02a2324bd15b8d5fbae656cfc2a1b4453e78a7fabb698e8eff55919c58681", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429991, "uuid": "80e91cd4-e444-4641-86e2-75fefcc46c0a", "value": "T1E043F76BB611D1B4C496C2709BEF01B0A2B0B4B06B72312F3B0537B16F627D54E5AB23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429991, "uuid": "6c4d7474-7063-4a14-b632-13f22b8f42f6", "value": "768:Gh9nBR6ZvQzzcWAqibtLCyawrgV9ba/3ZzrdCD30h+:unBR6Zv+4BRbtLCyaw0da/Zrdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778429991, "uuid": "1782e031-617e-4006-8068-a14a9c58c312", "value": 58832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778429991, "uuid": "e27e3559-e21a-4b49-acd1-cd23232f012b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429991, "uuid": "9067dab4-5f2e-4a1c-ace0-09ac88419f59", "value": "exp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3642a8b-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1778436381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436381, "uuid": "5e1eb9b0-05e7-4f65-b720-db5d43de1b41", "comment": "Malware payload (Gafgyt)", "value": "36e51d11e70c04c60a9c3a4f088ed507", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436381, "uuid": "d24450b6-1087-4ce1-968e-37ce98279486", "comment": "Malware payload (Gafgyt)", "value": "b519ae088ee0fd4658c16aab474d51c6acdc5c9cd7fab3fd69032d05a45ffd9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436381, "uuid": "915700da-981d-4c52-aa16-7ff851e95a07", "comment": "Malware payload (Gafgyt)", "value": "4d11bd496da82d15b3ed13050f414e44f5a892d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436381, "uuid": "3ab23e3c-0c5a-4017-b6fc-0082308508e1", "comment": "Malware payload (Gafgyt)", "value": "e60bc3c687a0a4d5deddd0c46020038a1078841f0f0f11523ee783fb724ade9a77b5b2fc84405f05b74a1b3dbedcb4a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436381, "uuid": "70224a17-60a2-4a67-8bd8-65435438b510", "value": "T1DCC3D0D599A3EAAFF44206F7E840173BD324CB1A028099FAF3CCAB535C61727615525F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436381, "uuid": "d30b2994-a33c-49a5-a291-90d550b1d177", "value": "3072:1U/suahz+bPcp2dMVOUuatDdYpZtE1GfIF2b+w0B:1dLS7csOuCMZ+1GwjwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436381, "uuid": "1d3167ae-5a10-472f-8ef2-90ce1c6f3aa2", "value": 123522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436381, "uuid": "e87bf478-5ef2-41e7-becf-0bd237d955bf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436381, "uuid": "d4c50eb9-40a8-48ac-9a42-8b3966dcbdf7", "value": "bot.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a278892-4ca3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778439909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439909, "uuid": "9b855059-a0a8-4867-84ed-1c4ba55f2173", "comment": "Malware payload (Mirai)", "value": "77e329e531b7ded40c7b815173c76c32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439909, "uuid": "9a010718-5f51-4e6a-8db1-02d04c9adbfd", "comment": "Malware payload (Mirai)", "value": "b6438c75b0735ce7fe02dc8a73d6a2fdee93161f27834a4287e3dbba7baf474d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439909, "uuid": "2a98fa8c-6f49-4bf2-8617-8bf60cdd03a7", "comment": "Malware payload (Mirai)", "value": "1e95d35a50d861c17daf2cf0c978b96ad81b50ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439909, "uuid": "d4db78cc-c9ef-466c-b7fd-20e3c9f6aad8", "comment": "Malware payload (Mirai)", "value": "f803c2046f65419eed9a36876c6cfa428fe1a76f3670355578864cf8b7ea4bb195fc33a3cef7e66b51289993ae347b96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439909, "uuid": "2f881c81-f3fb-4c9c-87a2-64699734bb0c", "value": "T177358E5AF2B371FDC067C030839FDB626836F46551322D7B21C4D6352EA2EA41B29F66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439909, "uuid": "69e0505a-6269-4606-a258-45494b28134b", "value": "24576:dUUR7mqPty/FqzJob9SE3DihVE2k/6raNDw:mUAqPtydWJob9tH6rr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778439909, "uuid": "481dabff-8227-4784-8c8d-d425bc9162a3", "value": 1076112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778439909, "uuid": "b465b911-c657-4e16-877a-765d923f8b17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439909, "uuid": "e2c0d7ca-b323-4593-923b-9c82e0debe71", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf3f503-4c50-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778404425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778404425, "uuid": "f679c63f-ccc1-40c3-94e0-7c823ad296fa", "comment": "Malware payload", "value": "a70c79cdeb45f971874fde48babac7e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778404425, "uuid": "910df55f-a7cd-4b12-bb79-f7d8156edc03", "comment": "Malware payload", "value": "b676a6b6df7813c11861c9e532749d3e38873a29a7a79e64881e0bbfce598063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778404425, "uuid": "5f5e09f9-bd67-4d9b-96df-91e09a7934dd", "comment": "Malware payload", "value": "95d664173b56d5dd9dfaaced9331111cc51fd3f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778404425, "uuid": "115fe084-a58f-45af-8c3e-b30343556969", "comment": "Malware payload", "value": "b4cce5e3e5d6587d9641476591d2ab8e4446cad73b82a90738a977f3a3aade2238c37caf4b98d7f7abd5282cf82f75dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778404425, "uuid": "3b6ca4e4-1a4c-45a4-b4b3-919e345a1ce5", "value": "T153C32A5117C0E980FBED0C76F2EB268002B0562B756EB769AEC194B59B233F847C953D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778404425, "uuid": "ca849373-3418-4a6d-8075-3634a851356d", "value": "3072:B1qHEU+iJuR6t1fU6pLYTF2kfgnkxhmb7z:SkU+iJaU1M6O2Nnkx0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778404425, "uuid": "c4b16961-72ad-41e9-9acf-1bc2b2eb6798", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778404425, "uuid": "768763b3-848c-44a2-9c2a-14355266743d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778404425, "uuid": "cb8daff2-ff31-4e34-9286-5ce80dd3c3bf", "value": "matrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87054f77-4caf-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778445219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778445219, "uuid": "4ce8db6d-f7da-4c02-8d2c-15409f772299", "comment": "Malware payload (AsyncRAT)", "value": "0882916ef89e007c813131d214f4c5f2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778445219, "uuid": "35cc098d-064e-483b-afd7-7f57a272486a", "comment": "Malware payload (AsyncRAT)", "value": "b6badd77d0d32c295b8b9f66afef0437e4a6fdc9db5d8dff50a858b068f1d025", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778445219, "uuid": "6c97e160-2415-4e62-9be2-1ae445546454", "comment": "Malware payload (AsyncRAT)", "value": "5748ec0cd59f07b11abe86e213393c31019ca3ca", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778445219, "uuid": "5daabf9c-0a6b-491f-a957-7f2aadd03693", "comment": "Malware payload (AsyncRAT)", "value": "0c58ea78d0cebe9579866b568c479d5706d300eee6525ceaa5bc78499367982c6dbe53b00cd050a0a96142a5c3799d41", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778445219, "uuid": "a1e8655d-04b4-4f0e-9804-01a6ce64a29d", "value": "T101D3068026D48751D05C06B668AE79F006EDFD6E2101CDDF68F4F38A967B78FC61329A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778445219, "uuid": "7f059df3-9b6d-4040-8ee3-50c1dc14dc87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778445219, "uuid": "1c726446-30c3-427f-8fef-5f9672bb17c3", "value": "1536:ylQz7VmWQYCSk1GbbwwqDuENGqAvKJYrkVclN:y+7VmWQs0Gbbw3uPgiWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778445219, "uuid": "cb998378-ef67-42cf-9daa-63fa9c96615f", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778445219, "uuid": "28db2ad3-9108-4306-8f16-9e0d76362b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778445219, "uuid": "a151d696-6c92-43d4-a08d-2a30ebf4c745", "value": "Chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7409e2d6-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371314, "uuid": "a30b54ab-337e-47b1-a516-4aee41403ee8", "comment": "Malware payload", "value": "04a777e17f211d0b2f11bb362a51e034", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371314, "uuid": "7e766ba2-0c33-4277-981b-b42d04ea44b5", "comment": "Malware payload", "value": "b6f06866feb997e643532697ca43203bcb7dd8b4b6e6f721d4ac041a1c6c512f", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371314, "uuid": "6e580985-59fc-4b05-b929-9a1bc0f36314", "comment": "Malware payload", "value": "e88419276ca788225ecfe643363f0f85cd2b8f23", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371314, "uuid": "4c94882e-b311-4514-adda-de117dcce013", "comment": "Malware payload", "value": "b06d55882c98509df44ad2d98cdf8dae2e1fb109132afcd3e5351d22d2aad5f95e31f7e8fea637adff824164bf58932f", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371314, "uuid": "0f7c2038-8214-4caa-be7f-4370ede7d441", "value": "T12524390CBFDEE96BE93C56714693082B13F0906312F54B0DAD861DDE9F1A3C2BD1A661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371314, "uuid": "11193165-e324-43df-8eda-8a682e7efc10", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371314, "uuid": "31d9e439-fd1d-4fe2-80c0-0cff861a1193", "value": "6144:zi9KR9HFmHWmiAm+7tuAlrDY9HFmHWmiAm+:vFm2xAPDcFm2xA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371314, "uuid": "9737a801-d857-442c-946e-e542226a7e8d", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371314, "uuid": "80ba3278-6356-4b6b-9057-0389c6b2b136", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371314, "uuid": "c9d5dadd-006c-4fe3-a500-ba9691c652fb", "value": "b6f06866feb997e643532697ca43203bcb7dd8b4b6e6f721d4ac041a1c6c512f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0c7738-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436126, "uuid": "ef5bdc2b-3b88-42b0-ba34-a1f4a06623d6", "comment": "Malware payload (Mirai)", "value": "190596271f1adac37bac60d59f3e4de1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436126, "uuid": "142f3818-f4f0-4351-833c-47a7df2c2829", "comment": "Malware payload (Mirai)", "value": "b70abac5b0e9d24ee8fc19cf0a5111e685034852f626b695d4fbca8890896a84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436126, "uuid": "11f1dece-ba34-497c-a56d-a202b903539d", "comment": "Malware payload (Mirai)", "value": "00b81b165a5a069bc5f9a82ca51ca56bec022b65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436126, "uuid": "e7471127-6bcb-4156-b568-8bfbfff8e2dd", "comment": "Malware payload (Mirai)", "value": "aceb1a107fea4e8435fccca419e269424cde57e5d351e2dd602f399eae8af78ba8d3ddd76befa36b09c5d42db68e5ab8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436126, "uuid": "ae8cd86d-cfe8-4ca5-b795-89670cf3f211", "value": "T1CB13E0BC51898A11ED7908707DB90A453B928EF851BBB36B3134CA5C56DA8CFE5B06C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436126, "uuid": "5a971b27-0583-4f9d-9a44-78161bb82593", "value": "768:A6kNdsuHy0d3O7KRgn9V+LgzSCyaez1B9cjZxPGDqognSbs3Uozd:OzLy0d3O7KRgn9ALgqaezf9cjLPS7qbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436126, "uuid": "c0612680-1596-46f9-9d4e-64642e9663b3", "value": 41644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436126, "uuid": "75deb5fd-9e51-48ef-a5a9-b9c0a25e01ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436126, "uuid": "ad71412c-5d5f-490c-adfa-90913e95628d", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d667b4d-4c71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778418386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418386, "uuid": "bba29dcf-0d87-4601-ad0d-cb37281fa369", "comment": "Malware payload (Mirai)", "value": "65317b628cf252043b7eaa209123903b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418386, "uuid": "cd7772af-2c4a-4a40-a771-d448891a60f1", "comment": "Malware payload (Mirai)", "value": "b76c5f031e264d32604224a8f43cf812a8f203288f184ae465ca445d7c9340d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418386, "uuid": "07508e42-6e99-4944-95e2-0d85ac4afe46", "comment": "Malware payload (Mirai)", "value": "cf492a3656708b3e519b03e49176e8419721c9e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418386, "uuid": "0595cbef-c974-4f66-8ff1-276fa5b35c78", "comment": "Malware payload (Mirai)", "value": "9fd1fc4bb68302ba1056e1244b3ed36dc71a10d7074943682e1f3e469c640143f025e27edf3411ec588a76ebb52d183b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418386, "uuid": "67571ea0-14ca-4bfc-94f2-998d0a67709a", "value": "T177C3F744FD15836FC2C237FAF79A03CD3B3A1668A79733119A345EB42BC5B995E26120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418386, "uuid": "4dda9b9b-fddf-412d-8012-5787e2fb5914", "value": "3072:25w3OBlCnxITbR6kPKlqLH0L+bNY74eDmBQQ/W/mmj4Y:L3Ot6kPKWH0L+CmBQQ/W/mmj4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778418386, "uuid": "af0e5449-a261-4123-a537-f7017220649b", "value": 126837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778418386, "uuid": "ef4e3fbf-85f9-496b-8493-3321b521715b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418386, "uuid": "4640a0b0-4d49-4b7f-ab4f-75716b994c89", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d316b901-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371473, "uuid": "381a6be2-d8fa-4485-a041-24c8f2550b3b", "comment": "Malware payload", "value": "388bcab69d81d3b9665b6eaae2894077", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371473, "uuid": "b1b3381b-2e18-486e-a155-be6d60ecd61b", "comment": "Malware payload", "value": "b930ef95716e028e0d95434cd6792c034258c78f06a3dd31816f0015bae24259", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371473, "uuid": "11f1cd45-744e-455e-bfc1-ad272542022d", "comment": "Malware payload", "value": "f7557e9b87ecb032f078cb9a04241474bd3e4f51", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371473, "uuid": "93b9ee9f-d9fc-48c9-95d4-58b633ef1a8b", "comment": "Malware payload", "value": "1610476caf5dd5669cf4c564847b6fea04f05bdfb726c2022b608f79fae6a358253efb08f7f31a20db9575c353d465bb", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371473, "uuid": "6e280ed7-401a-403a-810d-7d3e99b8061c", "value": "T1B385DF5873F84625F1FF4B35B972550886B3B85AAA20C74F0D52544E0EB1BC0DDAABB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371473, "uuid": "eda18837-92f6-4b00-91b9-4d8cd92e305a", "value": "49152:OCTPdiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:oKloSWVTR5Nhsm8A6xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371473, "uuid": "9ca44f60-6815-4b3e-be07-096ef2cfae8e", "value": 1869312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371473, "uuid": "84196dba-5069-44db-8502-881158c30158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371473, "uuid": "bb95a787-fb76-424c-b782-55a8bb13dd03", "value": "b930ef95716e028e0d95434cd6792c034258c78f06a3dd31816f0015bae24259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d77c48-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413964, "uuid": "519a679d-d3d0-4156-8198-01b03959a25d", "comment": "Malware payload", "value": "d62475f5f3c304a5048f27945603dbbc", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413964, "uuid": "b6ec63ec-7f63-4104-8b1d-417cf1704e9b", "comment": "Malware payload", "value": "b93306652a11a991b3701582b1802b1f4f728605b753e2c89aaa53d1c2957112", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413964, "uuid": "145a7feb-30fc-40c4-9832-c07fe4a6dbe9", "comment": "Malware payload", "value": "1b36eebe268a2fa3d9ffb17689be9afa84a0255c", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413964, "uuid": "cff9f4fc-d785-41de-b7f6-8d5d463231a9", "comment": "Malware payload", "value": "cfc3beef25590d4c8aebeab167e55817a15d0a5301d7d52ea2ce2654ebec53e55e2627fa9b3e3c8bc5efc3a1053e5945", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413964, "uuid": "590a3abc-43b6-4125-bda4-444ab4badd60", "value": "T174A533CA506FAE09FA4E5B59B13E56B36FCD930206BE8114BD5B5760B936C8E2D0C03D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413964, "uuid": "69d99bdb-1de3-4360-ba8b-dd42a25de241", "value": "49152:2n3rTpp02UGM/k9gvGO6GK9Jpl/+HRIdWaa7yMZeBbWAG4XwQT/nSDV1:AJuPZ/k9gvGOR4l+xwaUCIXt+V1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413964, "uuid": "48b66e61-9a8e-4674-8e87-8a873ac791d2", "value": 2107244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413964, "uuid": "268d729e-fbc1-4f6c-ba11-a8ed5ab3d9e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413964, "uuid": "4feae136-5df4-423b-907a-cc8a6800ebee", "value": "vulcan_ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb83d804-4c68-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778414813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414813, "uuid": "c5de2f44-c7a1-4cb4-9490-61f05b7b4daa", "comment": "Malware payload (Mirai)", "value": "c5848645d69c2180bdb59c45e87cf5f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414813, "uuid": "e25455d6-2ece-4a1a-9683-e6ebbe05e2b5", "comment": "Malware payload (Mirai)", "value": "b93c50bf08ffdd666baef615ab59783d3f0c8d68d6e80bdb6f028f9373bc1b96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414813, "uuid": "bef53c20-454c-41ad-b075-9ac6b8b2de3a", "comment": "Malware payload (Mirai)", "value": "e6279666995951839971e13365e3d2d6c602c6a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414813, "uuid": "1720ade3-b787-4fa8-a3b8-fb8b67a17d2f", "comment": "Malware payload (Mirai)", "value": "46ea5ede68d6be6ba3efef502de3fe09f0560798372c132bedbc455bb4363f09495ac714f30abf2b0cc796845f5f3d13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414813, "uuid": "4e99a9f0-4576-4337-aa52-947ef6642edd", "value": "T1274113D916AD42792FEB5D27F2AD9449B18896A724C06E6E5DDC3CB4824CF042449F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414813, "uuid": "f107da4a-377f-4401-87f6-1fa6c1878f3f", "value": "24:vIHbLuI3OGL/7I686ALxC7IWFJoLXICzC6qLhBI/TLAXIwFcLfFIRBL4ImEmILE9:vESqPH0ML0rZqPkiohYM1ZIAQ7Yn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414813, "uuid": "c6e3d70c-19e8-44b4-80fd-74ba6aed1819", "value": 1899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414813, "uuid": "ace02990-7646-4033-93f8-f103252df604", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414813, "uuid": "65b9ebe8-2645-4382-8c18-e6eaf3dc880d", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18acea2b-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413680, "uuid": "3d097afd-bba7-42fd-90e1-2a37b1893421", "comment": "Malware payload", "value": "fbf82a8149df4dd019246b3b4e79f648", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413680, "uuid": "596ffa18-b4c6-4b9a-8c09-3f557359b9a0", "comment": "Malware payload", "value": "b94be5245021bba5e75311a8b25ae93bd4d72d4af78eff322d15cc70fa31dd88", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413680, "uuid": "5ce9ed5d-1d2d-46e9-8c72-2d38e5c97f4f", "comment": "Malware payload", "value": "3444bd28d2f8a48727397d9acd127acd4c84f6e4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413680, "uuid": "b0689928-5850-4fbe-a6a2-2d35a490228f", "comment": "Malware payload", "value": "9a04c7f7f69d937a36afbd7d00a688aa9b97f11bf6d821101daff990e6e341ac0cd1c04e558f6d7ac35bdce4a65252e3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413680, "uuid": "602b84d7-ab11-4f6d-af5d-4fbde7a621b7", "value": "T12566F6C1E991D24AC63D6D31EFE6EFD8E26B2F315C885A4AC9C8F73E18B314580B5560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413680, "uuid": "c717d562-916a-4a2b-acdb-b66bfa555fc1", "value": "49152:HckQa8PbfA3gHC35mQvGlDMVXcJWNNakW3bE+8ddgIc4whY73TvuyMHHDt5EN:HckQa8PbfpHT8VsKtEw7tMnDjEN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413680, "uuid": "7d077004-b4df-4f8c-be82-5561f3ec7b17", "value": 6553748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413680, "uuid": "0c3b2d58-d440-4b5f-a926-4c7ddb4118ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413680, "uuid": "4dd5ec20-ae69-471f-a660-9f84d56e1844", "value": "edac_polld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c6bec9-4c34-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778392582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778392582, "uuid": "a24d7a65-d408-4fe0-9cb5-102425dfde12", "comment": "Malware payload (NanoCore)", "value": "02f4add7aba095758ca784153755a020", "object_relation": "md5", "Tag": [ { "name": "auto-sch-xml", "colour": "#92066D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778392582, "uuid": "83d892b7-4fac-40a2-8e77-ae253711a179", "comment": "Malware payload (NanoCore)", "value": "ba6a7fd0de9f3ec4336fc2acd716e09ca965aafe506e0eb1f8da6883cf001a55", "object_relation": "sha256", "Tag": [ { "name": "auto-sch-xml", "colour": "#92066D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778392582, "uuid": "6143f19e-d959-40cc-ada0-9d6361592a96", "comment": "Malware payload (NanoCore)", "value": "3bacd8016237d272c0f8748f81bd1a2a846371bb", "object_relation": "sha1", "Tag": [ { "name": "auto-sch-xml", "colour": "#92066D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778392582, "uuid": "ad726ae7-8535-4021-960b-d63d6bb55dea", "comment": "Malware payload (NanoCore)", "value": "fbb8a44876e682867af610de02929004d9286d8def42af6d2e4397d1c51cd09b30128915daa70fb2179bf5987a743404", "object_relation": "sha3-384", "Tag": [ { "name": "auto-sch-xml", "colour": "#92066D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Remote", "colour": "#EDBCBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778392582, "uuid": "c7834e6b-1c7b-4d5c-b6cb-1606510528d1", "value": "T11514C0563BA8492FE2DE857960120252937CC2E3ACC3F3EF28D855B65F267E5460B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778392582, "uuid": "3115ea4b-bd11-4666-bdc0-cee3a952c160", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778392582, "uuid": "66a58470-8a34-419a-ba8f-cb1ef4dde398", "value": "6144:ULV6Bta6dtJmakIM5npr7A+ROS+roZRzg:ULV6BtpmkwYtc/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778392582, "uuid": "de6e3162-7c91-4570-9928-bfc4f595c84c", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778392582, "uuid": "622a8f92-d8d1-478e-91a3-80bd225ab2de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778392582, "uuid": "651143a4-e77e-4762-bef0-7c9fed474547", "value": "GoogleChromeUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505a2499-4cba-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778449852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778449852, "uuid": "f3ec9e3d-6c58-4780-bb02-5d4e0003c880", "comment": "Malware payload", "value": "6649bd43ca4fa82c7aeaf5d34b5fbc08", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778449852, "uuid": "59e58ec0-381e-4d35-943a-a2a3b81a8f51", "comment": "Malware payload", "value": "bac560d77f3bc2f5a05e2861d0d51892aa28a7681066fcaf5fde64a4503cd2e3", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778449852, "uuid": "270f49e2-7771-4bc9-a13f-c13cade8ea3f", "comment": "Malware payload", "value": "6b7f5bb91adf6b8c5a62f4dda2eedc01cdb5bead", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778449852, "uuid": "8dc41deb-e2b3-4562-81a8-d86d059679fa", "comment": "Malware payload", "value": "81b8bf27fec6a20989cea8fbb43a72929ca86c468c422bb9670138c698627ea07d2a860145fda3761900006fdf63d0c8", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX9.file", "colour": "#5F9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778449852, "uuid": "2b507e19-69ad-4a07-9c70-850f80bbcbe8", "value": "T18D64E042AAF94658F6F75F34297404255E36BD56AF75C29F2241B21E2A72FC08E30F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778449852, "uuid": "98a92ed7-a90d-4a69-9168-21d3d77f6a35", "value": "6144:So9oec8mQN2Z+WlH3EsX7JNDP3FxIKlMrc7DodHCWjUoeoZLE+6kIjW:So6J+Wh/7XD3FJM6DoWKLL6vW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778449852, "uuid": "1882db41-b818-4817-b225-75b755beb510", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778449852, "uuid": "fc83c243-a418-4921-81c9-3907993a4139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778449852, "uuid": "7fa01b63-8681-420d-adc7-37bd1d8aa6cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68abd19-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389545, "uuid": "7e8565eb-9dac-4bb7-8c06-9793e4b4e9c2", "comment": "Malware payload", "value": "80b597f963d277ec56f499b482f818bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389545, "uuid": "15faaa66-9e96-4c42-bbc5-b1aec2857bbe", "comment": "Malware payload", "value": "bca1e7c785ad48bb1d47059d65a67938c170ad2840b83765f8c8542e51045f27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389545, "uuid": "cdf02e64-5277-4407-9e1e-d7ce9250d36c", "comment": "Malware payload", "value": "ef38a69750ffc7c72642f51ee5367b1aabd3dc15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389545, "uuid": "713d27af-12b6-4019-adc6-2279fca71723", "comment": "Malware payload", "value": "4e176bd85ab799416535a38be2764fc6cc17de1de6deb3a9f189f5c12340dceeb901a20fbd66076670c177f69b59bb5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389545, "uuid": "486e1d50-3921-4c87-a84b-16a849c09d6b", "value": "T1FB262A137E18D71EC2A911340D72CEA4AB2D2C9A46DAA917F745F309B8F216C496FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389545, "uuid": "e063faa5-d984-4228-aca1-e4ff3a88fdaf", "value": "49152:Ja0r7g+JseJVhfWLWZxvLpkK4xpLaZBvT9kWkBMZyVESV/tDkHozqXU5g/3IwdMd:4wq7YO7aUJOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389545, "uuid": "f1c92599-9b9d-48a9-855f-790efe694df7", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389545, "uuid": "a798fc3b-0b7f-4921-b6bb-4362df3dc0e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389545, "uuid": "fe6481b7-d1f3-4768-aa2e-684addd809f4", "value": "linux_mips_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d54f7bf-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448531, "uuid": "c55c8847-de92-40ff-923c-f1618908ec39", "comment": "Malware payload (Mirai)", "value": "481f679b442d4971a6f945bab5e7466c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448531, "uuid": "17dd2765-01d7-435e-9c49-ec11c3f21034", "comment": "Malware payload (Mirai)", "value": "bd5774f39cb08ec74333f3a80483b43c2c910d2a2238784746f98840e58cecb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448531, "uuid": "24848e5d-a046-4c72-9b86-c2ef8dc8319f", "comment": "Malware payload (Mirai)", "value": "99a900d9f74908d8e511266062b962ca3e0abfd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448531, "uuid": "1ba0907e-5ab4-4b24-bc68-db440e3fb0f8", "comment": "Malware payload (Mirai)", "value": "ebc0cd6346195ef0ffd235e10c8782c7b66f2ca39edf94b49ca8a22992accea4448a0ebf97b14cdead437fbdf1566757", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448531, "uuid": "239f7824-b107-4f6f-8f50-d17e7df85b39", "value": "T13B535BC5AA47D8F6FD5602711173E7378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448531, "uuid": "42a51e2f-ff43-4777-b08a-525901123911", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx6aQGP++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4bDP+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448531, "uuid": "6551927e-c70f-4654-b287-a4f6dc869fdf", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448531, "uuid": "4819f87c-0542-4cc0-b97e-f35246efd1d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448531, "uuid": "22c506df-a0a7-47fe-9e02-8562ebf6faf7", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4704fa-4c7f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778424751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778424751, "uuid": "db7c63ac-8178-4952-bf5d-faa370b654c9", "comment": "Malware payload (AsyncRAT)", "value": "b98b6a539831103e055016fd560d019b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778424751, "uuid": "bd4b8225-c84b-426a-993f-a91a142bc0aa", "comment": "Malware payload (AsyncRAT)", "value": "be325b9cc973ccd930094f73b3886ed98a178fa691ab1b8a77cd2143aea4e299", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778424751, "uuid": "7fcec1c3-62e1-483f-919f-4dc2aba461e9", "comment": "Malware payload (AsyncRAT)", "value": "a55fa380d35113d8c9f9bd27c769a0dc4e740f98", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778424751, "uuid": "31d4d3b2-eff5-41f4-86a2-8f2b724d6b82", "comment": "Malware payload (AsyncRAT)", "value": "3449a5e8ef9a3a5d89d6eaf294ee075edfec4ad8ece291e2c118e825fa8ff838d413a7680c0a7e99e1846e549cb6ce4d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778424751, "uuid": "ac271603-a2f6-4f47-a0de-e8885ffb6451", "value": "T1D2333C0037E98126F1FE5FB89CF1214586BAF6633502D51E7C8842D64B23BC6DA52BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778424751, "uuid": "701fd4fa-4c89-42b1-9520-2d74f602e456", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778424751, "uuid": "b6f89756-a847-4f83-ae51-dafbc9e0a475", "value": "1536:C3Ds0sJ5L12UZbjHW9kvxXHuJmJN6OJkmVcl:Cn25L8UZbj6k5XfJNVk8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778424751, "uuid": "cfadf52e-4a2e-4103-938d-9e18e16639e3", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778424751, "uuid": "aaaf57c8-4c27-4fe8-a565-b7e4208f0000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778424751, "uuid": "af8a6a89-9967-4dee-bf1e-400062e6f4b7", "value": "hyperastro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a82a9e0-4c07-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778372962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778372962, "uuid": "93496ba3-d8f0-48b6-aa05-20fdad67d3a8", "comment": "Malware payload (Mirai)", "value": "c13fe770b18beca497c72dd254f15b4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778372962, "uuid": "27bc6e4b-a3dd-4dd5-b593-d35796828deb", "comment": "Malware payload (Mirai)", "value": "bea2863980eedcdc57ea14a6c733e7f68ac786f1793ae52a45fc6bf5435d66f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778372962, "uuid": "cd0f03ca-e59a-4af0-b28c-79c8eb797401", "comment": "Malware payload (Mirai)", "value": "de7b95bf137e49c0f5152d62a24a21ca3e9b7897", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778372962, "uuid": "8b875c58-dcf9-45c7-aa7d-3af0a1551270", "comment": "Malware payload (Mirai)", "value": "fa3f7f382052e132ff8f8fa6ef8b3533b12881e8282acf641becdbec85cf66a1c2d01d02c19af7aff77acb33d87f82a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778372962, "uuid": "f2229b6a-4c47-4228-9a92-9288a0367c50", "value": "T1524629236F98DB1EC628123058B2CA9567291C8A46DBA517F251F31DF9F20BC496FCF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778372962, "uuid": "2e838b22-6ba5-453d-a7dd-e78f249dd9a1", "value": "49152:f2gr20Q9SbhXVLmmUu0QRpVwYkxcG6m6S61ndCr+QbKim0HH:eA5vnSJm0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778372962, "uuid": "f153eca1-31a2-4be4-8aa8-571fa14ec46a", "value": 5439488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778372962, "uuid": "a40a1e63-a39c-4bed-8d2e-423e9cfb09d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778372962, "uuid": "ec3567d6-3a0f-4329-b187-ad54b642d5c2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e954ad03-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389549, "uuid": "23335c67-ea52-48e6-81fb-2df65a4b0149", "comment": "Malware payload", "value": "d72a2cd945e8b342934b85752a787c7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389549, "uuid": "f8bc0a1b-b7ff-439c-a4bf-3aae2c5b9c1f", "comment": "Malware payload", "value": "bec8e9c158b9bcd6d0aa11b104f8cb94b79d04cda820557fbd3b33881ae86cbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389549, "uuid": "eaee4a85-896e-4749-9851-dc64c8d3e124", "comment": "Malware payload", "value": "369cf41d06b32bd5320d0dbac75c8a44042b7331", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389549, "uuid": "29b96ffc-81bf-481a-9abc-6502a05b7164", "comment": "Malware payload", "value": "3a0f6198f176d716c90c8f50a62bc7f58b88528d8f07d84f9f9ae9563d5bd9ef533a15bd37826ad64260ee271318f91b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389549, "uuid": "c0c4d3dc-ce66-41b1-be3c-2a8ff640d90f", "value": "T16926EC15AE82AB77C1DC037445FE565A22502F484A91132723B8FBE83E7773DAF5688C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389549, "uuid": "ef4d5128-c3bf-486b-b69a-57387fdd0573", "value": "24576:XeoDfL74xEopf/oPDnLHoTiPUuLX3rcwI1yYz/StUNuxD4LM508l5lhZWTHhUXEw:pP4xFGHowQN24c8LOl5rZWrhUUsjj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389549, "uuid": "2f6ee088-f3b1-47c1-ac96-68be56146b0a", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389549, "uuid": "bc91443a-da6d-4a83-945a-1e4082a87c22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389549, "uuid": "0e4288ca-0200-4a1d-b302-d4e9d7ba62dd", "value": "linux_mips64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c6630a-4caa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778443177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443177, "uuid": "b12c12f7-e34f-414f-aa6e-e802264dd582", "comment": "Malware payload", "value": "7667be339e9aef971a8dbf013f587b3e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ChainShell", "colour": "#0D0755", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TsundereBot", "colour": "#1721FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443177, "uuid": "3712b36d-05eb-4a24-b85b-98246e692899", "comment": "Malware payload", "value": "bedb882c6e2cf896e14ecf12c90aaa6638f780017d1b8687a40b4a81956e230f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ChainShell", "colour": "#0D0755", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TsundereBot", "colour": "#1721FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443177, "uuid": "a469299c-c5cc-43b9-8b9e-47ab0a08c864", "comment": "Malware payload", "value": "3299c21d4919bbe9e73d30b04efc0981f76e808a", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ChainShell", "colour": "#0D0755", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TsundereBot", "colour": "#1721FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443177, "uuid": "7c74c958-c899-4676-91af-f2bae57d3142", "comment": "Malware payload", "value": "7b70aac36993044bce7446eaf60daeeba880266a9e5880cc3b27c86607240f29db38ea4531e9539a832318d9545c13e3", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ChainShell", "colour": "#0D0755", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TsundereBot", "colour": "#1721FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778443177, "uuid": "f6049636-84e3-499d-b169-86b9434a0857", "value": "T1391479D426E1F40352CE0763BF166AE9E13E9CA2A8CCB547D294B98DB8BC54BC174DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778443177, "uuid": "2be21baa-17f6-404f-9017-3f83551b2897", "value": "6144:Is+9Jy0uGIft47IB8L/gnQQGAW2yZQOzM9wacAcOu7IEE5KY/UHISP8EZBKmav1y:X+9Jy0uGIfW7IB8L/gnQQGAW2yZQOzMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778443177, "uuid": "f0d8df54-7ccd-4785-a7b1-b5dc21492677", "value": 207122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778443177, "uuid": "423cbddb-ddcd-40ed-b02d-1de116a8bfe1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778443177, "uuid": "42229d71-6fb6-4bb6-a06d-c40210b99fb3", "value": "sysuu2etiprun.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d941f4a-4c64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778412991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412991, "uuid": "d6e2f21e-67bb-43c7-a6da-d2116d11af49", "comment": "Malware payload", "value": "08b2f50ae2cd68db41b6915a070f5d22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412991, "uuid": "846f37d2-a62b-41f6-bc2d-5b10ceac2eab", "comment": "Malware payload", "value": "bf3196976be53253f092234dd14829ea2d6c10e13de42faf3c8da2816c7501a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412991, "uuid": "19b21c92-16e2-4e6c-83c1-4f126dbda5b6", "comment": "Malware payload", "value": "d0b912b22988343dfc6c18ab3bb297496fac65ca", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412991, "uuid": "782d7e38-799b-4c12-b35c-65aec0dff659", "comment": "Malware payload", "value": "b0236890b8edc615a514a6932b2965c9f53b1d32593ee3b4d4eefb671c63f00cdd60d57e47a12fb397dfbbf3fb4f80d5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412991, "uuid": "b24a7b04-d9e2-44d9-b5df-0de94cc736d4", "value": "T13D763B97B8924952C4E43637BCBE81C432630EB99BC7565B6D05EE383EBE0D90E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412991, "uuid": "7ff23739-6440-46ab-a251-88f426de5dad", "value": "49152:VjvDcbJfA8h8gkfcTUd9Pjxs5FVw0+qV/WmOD2S6P4GFsbm5zvuL35Em+S:dx8h8gYcAd9Pjxs5FB4GFsKEpEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412991, "uuid": "c81fded2-a982-4af7-8ff8-0a490d9cdf7f", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412991, "uuid": "3ec821af-6dd0-404e-bf74-5f8cd5404c00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412991, "uuid": "8a854dba-831a-468a-993d-422cba80166c", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b73bde-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413649, "uuid": "be7a7718-dab5-4be4-a04c-dbb8c4ea1390", "comment": "Malware payload", "value": "5029a0601e5dd4b0a7a59ac89ebc1f2f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413649, "uuid": "0407ab57-5fed-48bb-969b-ba476b8894dc", "comment": "Malware payload", "value": "bfbb46437d3f5b4d47197dc3c29e19e0e580ef80ddf989482818a24f1281e461", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413649, "uuid": "77c8e31d-bc1e-4dd8-b4af-7d8014cf2eb7", "comment": "Malware payload", "value": "5f6cfbee3177fa2ded995b217ba15f4e8bb90738", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413649, "uuid": "14ced132-241a-4063-839a-95ce1f66a4ca", "comment": "Malware payload", "value": "5ff187e62525e87dc1c7eed32db3f0ab896b930fd09a30b75b4b9c03e46c3aa9de0392dccc45878f7b69f1c56e885ce4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413649, "uuid": "baf060db-e103-4b44-8b71-248fc2acc3f6", "value": "T109566C0EFD24CFA5C6A003B649F912981331AD026FC74B03A239F77CBDB6694DE46695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413649, "uuid": "26b6f79c-015a-4e2a-963e-b95652c4296b", "value": "49152:LYgkD4meJ4ZYEcS0uJm4yYYupigw+8p15vKhg5EK:YDy4ZYEcy8xEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413649, "uuid": "b4cb7038-2898-4ef8-b0a1-04db4b838298", "value": 5963924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413649, "uuid": "bbceb01b-fcf6-411c-abe7-7ad85643f1bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413649, "uuid": "f68a753d-38bd-403d-b1d7-5a12ba39d63f", "value": "cfg80211d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b71157-4c52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778405136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778405136, "uuid": "a2a56ebf-d1e1-49ac-8359-3e9ee76f40e9", "comment": "Malware payload", "value": "f24d90b49e70ff6ffa9b6764db5d2eb7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778405136, "uuid": "f5e8092f-fb17-470d-8e04-b9255c745898", "comment": "Malware payload", "value": "c283d62a0b3a8b073dc436c71611f6d1ecb324b70a4f1c5cd46ec9b4beccd02e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778405136, "uuid": "6cb584df-c668-41ee-ae19-8b6bdf4baf3b", "comment": "Malware payload", "value": "f6942f623d841692435adae3807606322a426024", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778405136, "uuid": "4812eb6f-0d67-4a17-8efd-b87ff213557e", "comment": "Malware payload", "value": "7e74047616deffa1ddc52650f0a00747ec664b27061e1864c3938e2ad39bee2a84a8b560db091d21383e86a2b626469d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778405136, "uuid": "1215e511-70ec-4f3c-84f5-d620e07f4598", "value": "T12FF2D09011E3B8E6AD43257388F90F9C23574E6D3444D63DEE28E4CD0C90EA8EAE755B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778405136, "uuid": "d1e7fa84-da77-48e8-859e-726820e52ad5", "value": "768:ryB8LcwkhxPXrH+DIMFRdph58OovRWK+7DScDXDHeFnAih6kiERb:ryGLM+DI6XovRWPDhDT+au6tCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778405136, "uuid": "46b00f3c-00ef-4763-b6b5-0ebd0f93a467", "value": 35204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778405136, "uuid": "23568552-8d02-4c0d-9956-6c10c34add40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778405136, "uuid": "6a6be741-4dbc-4e07-89fa-c3fee099a4cd", "value": "Dienstangebot_Schlegtendal_P_05-05-26.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3470013-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371447, "uuid": "d371f355-d083-4e8d-80a1-bcd3755d28d1", "comment": "Malware payload", "value": "2da1c35a53c799147b7f6a046498951b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371447, "uuid": "ddbeb6d6-3f02-494c-984e-a4f3cc3e3113", "comment": "Malware payload", "value": "c2b0cfbeb2f6924f708ce07c9f7f7225ca349833fff5171820892dc71b45bfcb", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371447, "uuid": "9791f270-fbfe-4aa3-8725-b1a4d6a8e8d1", "comment": "Malware payload", "value": "b8a408f5582a7f542fb7ba417012d77f4bea9252", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371447, "uuid": "749e0007-d5eb-4581-a753-54896c9083b9", "comment": "Malware payload", "value": "a5b1d4e682fcd12197d8b5eae98e8c12aef611df8b4c8dfc72656e17745c9a70dae11d2be672d188b8dd4b9cd4c43bcf", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371447, "uuid": "b60d4447-c525-4b8f-a5a7-2bdaa8f948a5", "value": "T15045BE5573F85615F1BF0BB4EA7254088AB3B95ABA20CB0F4D52940E1EB0B80DD99F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371447, "uuid": "d23070cd-a7cb-4bbd-ac47-5aad3ccfdf7d", "value": "24576:wqLPxKruNSvD1t6jmpngU0/SZilOBonsVSlEI6:wrt6SFz0/S2OBonsglEI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371447, "uuid": "e5be32e2-2e3c-444b-8eeb-0c98bfef59a6", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371447, "uuid": "0b6e0d4a-4bbc-4813-b5cc-8871cf399886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371447, "uuid": "88c36739-e2d9-4e4b-a68f-9f7284d6ab73", "value": "c2b0cfbeb2f6924f708ce07c9f7f7225ca349833fff5171820892dc71b45bfcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bc1061-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371293, "uuid": "d4262cb0-5bd5-4cba-9538-0e154b0029df", "comment": "Malware payload", "value": "1d4acbdad2ec9250a57515a81ab65c5c", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371293, "uuid": "f4471fc1-4313-4b2f-87e2-fdc261970fb1", "comment": "Malware payload", "value": "c2eade3ab794928358989461a6ae52c21e9539a50246aa5218dcd5fe1262c462", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371293, "uuid": "fa2535d5-87c7-42b6-9314-b288ac2c5871", "comment": "Malware payload", "value": "c7b4724800be59b7d0356a59460906da1f0285b8", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371293, "uuid": "25454f23-c4dc-44ce-aed5-baca17eda07a", "comment": "Malware payload", "value": "10e303b796b5e8fc96aa60aa91ba1b6dc2d55a7fc2dcc3233b7d8b5c0d137cfa5028481ad1e209792e7140d474c81319", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371293, "uuid": "57ccbdeb-9dec-404d-b5ad-b03f207f232c", "value": "T1D7258D1477F8671BE13E873186728C2513F1A09356A1C74F4E86E94E2F67782EE067A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371293, "uuid": "f2ee96b7-7c70-4a47-a5e8-e6f6931c73ad", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371293, "uuid": "a08385a2-f622-44d1-8b49-7f63836811e9", "value": "12288:bXwv2NaLG0Fq4NB6IBbPY0DSMyZQlwwZ08IBbPY0DSMyZQlt7rLFLKFqm+NB:bn8NB66jvSMll886jvSMllVNNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371293, "uuid": "451c519e-a412-4a6f-9dd8-df73b22682fc", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371293, "uuid": "f9bb60e2-249d-4e96-ba4e-805116997761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371293, "uuid": "8bd29975-2e5f-4f07-86bb-b8f5b07d3cf2", "value": "c2eade3ab794928358989461a6ae52c21e9539a50246aa5218dcd5fe1262c462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e9bb67-4cbf-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778452163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452163, "uuid": "3b9efca7-f0c9-41ff-bc9f-3c3c66c409f4", "comment": "Malware payload", "value": "7f4cf4540eeb083cd87e715c8ba03a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452163, "uuid": "1515ef59-c85a-4a6b-8e0e-8105034c4bb2", "comment": "Malware payload", "value": "c41dffb911fc273c2d3b355a28f0b5f2c75e979471af05292bd8cbf7710900fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452163, "uuid": "864efdfc-6316-442d-b6da-adb8c122ef6f", "comment": "Malware payload", "value": "2cab4fc29f4fdc72f4d31d390fbc0d3f25146409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452163, "uuid": "f5a6d50e-186c-47d1-ba10-e0eb546e3dc5", "comment": "Malware payload", "value": "e5457286c5b5d4744cc7a4ed102485336cb32c057e1a21120a4cc9672b2d11212e42b94870798fdc0e25a4c1dbd38413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452163, "uuid": "675cd8da-6b5d-41d4-b3e6-bd5bd4413e27", "value": "T19D962233B64E673EE46A45364962D910443F7E5D641A8CA386E43A4CCF3A35C1F6EE0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452163, "uuid": "be7d0a2d-2cb1-4338-87c2-2bfb03a1af7b", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452163, "uuid": "3992a117-7b7d-4fd9-aad0-8182ea7ccda3", "value": "196608:rDbzGkTp1E24ZAjIc7LOynhf6P1+J5MkaTuy+AEEuB4O:rDHCZAjIc7xn84bMrTuyLuBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778452163, "uuid": "15f07753-746e-461c-8649-7ec584b1daf6", "value": 9147738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778452163, "uuid": "3468944a-7db0-41f0-b7ff-19aba41651ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452163, "uuid": "404b049c-478f-4241-bc68-e46d31c47515", "value": "SecuriteInfo.com.Trojan.Siggen32.40770.14453.10033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be70b6a6-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413959, "uuid": "cb27bf18-9f7d-4e02-8cd7-6443cc1ea5c3", "comment": "Malware payload", "value": "622a2a65785444912365132e88dd7296", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413959, "uuid": "eee36fb2-79e6-46ed-9cad-0d48cbbb9210", "comment": "Malware payload", "value": "c57bdf8101bee2999e534d62cd7a951e80b12d7f49df0d499cb34cc5c2607e17", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413959, "uuid": "96a4caad-bc63-4c70-8ce0-7ea6f7ec82e6", "comment": "Malware payload", "value": "f4352c2281258dd2f9582725462c7278eb0778fc", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413959, "uuid": "673b165c-2b0b-446a-9240-500353fe73c6", "comment": "Malware payload", "value": "1b22ac2fdadd20d4449edf930907d439f913945fbc439ccab27cd809b3bbc5cedd80a0e847ac01728030c5a299d50393", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413959, "uuid": "a04b01e6-bd9e-4ba5-838f-d04d0f718678", "value": "T14A9533614129CDD2E87CD8A1C240F3800AF476D28DE59616CF77AF7AFCADA19B0C1676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413959, "uuid": "a6a30426-ad46-405d-83c1-a392a45decd0", "value": "49152:46uRirOQ4PGO6/7/rUN/u6CWI3Rsn3HTnEQQQP2x4f3vXN/aCs:46uRiyfGjDaunBsnXTnEQQQAQBaCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413959, "uuid": "f3cccd8d-be01-4e34-ae51-dff544176c3a", "value": 2035212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413959, "uuid": "0b65b4e2-2e3d-4895-98af-488b23e785fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413959, "uuid": "6d4941ed-f26a-4a81-b03c-76aceb04e1f4", "value": "vulcan_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b37627-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448461, "uuid": "0ac53e35-fad0-4e2d-9c36-97e738bf0c3c", "comment": "Malware payload (Mirai)", "value": "ca2de58e8c486aadd0c1bfd544cd20f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448461, "uuid": "dafdfc80-0abe-4582-95c9-cfbbf19b4163", "comment": "Malware payload (Mirai)", "value": "c59f0b456c5f1dda4973cd875b29b90903f2bfb7d19d10559b3d49d0cf4e3e52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448461, "uuid": "b08d550a-eaec-42a4-aaf6-3839445fac9f", "comment": "Malware payload (Mirai)", "value": "f2492167f2d8dfe2dd604457cd3e5351c36a046c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448461, "uuid": "f89aad2f-a26e-4ab4-8275-ee81e2b0e9fd", "comment": "Malware payload (Mirai)", "value": "544fe156f3b60e3ab8cad0745c0092a12aae180de4a6b92d8175b3a9b39249f219b2e2696ed0492741351102e7228e72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448461, "uuid": "a43a86f2-ee18-4192-8494-f9dc62a826b4", "value": "T15203F1EEFA443C8BD96F4EFF57ED45596DA1B180A2834F859208CCB97A7120A75088F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448461, "uuid": "544f479e-d164-459e-9b12-2482201bde6e", "value": "768:jVyIwYjG0JFZSuLIW7SfKr9kqcd9S35bs2AUSeNAWP/WT:jVyYjXJvSAIW7Sfm2/SJbsXcNAUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448461, "uuid": "63a5bd35-4a3e-47bf-99ed-7a8980530f77", "value": 38096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448461, "uuid": "8f8be3fe-7cd7-45a0-9260-e8ab7c67effb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448461, "uuid": "038b21a3-b2c4-465c-9698-0e2678228e3b", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbf8ad3-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778414202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414202, "uuid": "c9245490-3f37-465c-ad94-eaa0465fb340", "comment": "Malware payload", "value": "d54b481e8f926a71313d16a51a41b5c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414202, "uuid": "235136dd-9249-4795-acf9-9beefc129a4a", "comment": "Malware payload", "value": "c63c377f30e2c0b623ccf951e70ab8fc100385289c3123af20d44ee5fe56f77a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414202, "uuid": "e7392a3c-ad21-486e-a627-1558e1c6b8b8", "comment": "Malware payload", "value": "e0f3098469f08b69a49ea588eff9e7fe9c4ba1a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414202, "uuid": "0909ef8d-9919-42d7-8218-8afb7db1b463", "comment": "Malware payload", "value": "6210d654ea01195d737f4a7f0fda45e02393630628b95b6ba3a9b5f15ef4a3ef94eda0d815f95b0f1f965ed8ea0ab5a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414202, "uuid": "ce98a378-223a-4788-821a-582df44a3897", "value": "T1D1764A06FA496FA1C924493385F34A6137626D586B318B53AB05F2BFACF73050F16F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414202, "uuid": "f49dc775-ffe5-49b4-88c5-218b0af648f3", "value": "49152:oRtkpCdXJcQvIgl94HCgAu2vrhAy2ADcv/UsXo+8Rhu9DftGf35ED:wtkpCdXJbIglmHCRtvrWzwu7QED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414202, "uuid": "69c751a4-f05c-4260-bda6-762012636f6d", "value": 7405752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414202, "uuid": "84079d3e-af0f-48bc-a709-24295e609ca5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414202, "uuid": "44d34752-e5be-468d-8ccd-307cad680ed7", "value": "vulcan_ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab1df7e-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413899, "uuid": "518301e9-2771-49f9-b614-727aa03bee21", "comment": "Malware payload", "value": "5231ec2a299841359f1f74924c8dcd6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413899, "uuid": "57fabad0-d3df-4758-9019-1e8d0403d463", "comment": "Malware payload", "value": "c7a6996375c78738455b81e8ee045e1bcf7e55e7beafbb60d9140d4458a5f330", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413899, "uuid": "8fe70f73-7ff2-46cb-8dd9-fb9e3cebfcf3", "comment": "Malware payload", "value": "768d463f2f1322156c1ea22aedb88d291606ba5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413899, "uuid": "5c184801-4f92-44b9-8b75-2cc34ec754e7", "comment": "Malware payload", "value": "dd35a579ac8cf4efdcfd817c7079b6f17dbab31f15b61afc88b1268e6cd9e18cea3b1afc338b7559ff473ad20a5c4bf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413899, "uuid": "26993997-ab47-4fb0-995b-971d7408cd2c", "value": "T1C266F6176B2CE70FC628313459B1DE84276A1C9645DB9527B386F309E9F20AC4DAECF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413899, "uuid": "da0a059a-e50f-4ead-952d-c39b2ee941c5", "value": "49152:DIRDV3WZadNTVAYdmT53rTMbeEkajICBW3YZzbOt1wg0fnOQpHHEt5EQ:tTMITJWnOQpnEjEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413899, "uuid": "58e47bf8-2fe1-4d88-96b1-1dd8733744a4", "value": 6946995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413899, "uuid": "45032946-290e-4a87-ba94-630ccf4ec71e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413899, "uuid": "ed15ddb7-3c38-4dd3-936f-95f4ef821a55", "value": "kswapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3496ca20-4ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778438638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438638, "uuid": "3bb6da90-90f2-4601-81ae-9fd646f17fe6", "comment": "Malware payload (Mirai)", "value": "0cefb62cb56322ccbfc4084d3dd07269", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438638, "uuid": "fc660f18-b312-43b7-b459-3801a0dee517", "comment": "Malware payload (Mirai)", "value": "c8353dd35570181b8153af1a7009735dd7f33747c71d86b044faca07a74b2501", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438638, "uuid": "6396d25c-5201-421c-808f-0ef6731c0fdc", "comment": "Malware payload (Mirai)", "value": "f8d620f27435a11c297c408db55150756d7519e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438638, "uuid": "e7993399-466f-4e89-afad-b24adacc04ff", "comment": "Malware payload (Mirai)", "value": "aee41abcee24f9a702f4f5bbca07a1aae9c8fb0db124e4001259568949c595f5510be8bcf1c3f71e030dcd8631413ee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438638, "uuid": "ad1f5500-5720-4be5-baf0-d444453edbfd", "value": "T10D663A136A2CEB4EE62822304DF1CA9467291C9541D7A917A395F31CF9F31AC8D6EDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438638, "uuid": "a15e1e13-04b5-42dc-857b-2b36fa13374d", "value": "49152:kvUys4ReyYls4Jm40AdXUQtmxZDV5GohtmiVPGruuXCfi9LnhlaQLO1pgkE3mHHf:peZT0aQLRkCmn4jEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438638, "uuid": "38028c39-3792-46cf-9016-0da5ce0115bf", "value": 6684865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438638, "uuid": "263e0f4c-ec1a-45ec-a4f6-f1d654dec0b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438638, "uuid": "a8983a24-07b6-4fe5-9ec0-d0ecd0d0b6ba", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4ecf59-4caa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778442970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778442970, "uuid": "8cd762d1-0d9f-40e4-b04b-880e777987e5", "comment": "Malware payload", "value": "5c65dd08f9591eb6c50b772f2d36e0d8", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ChainShell", "colour": "#0D0755", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TsundereBot", "colour": "#1721FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778442970, "uuid": "b7014049-cf9d-402f-b628-c0f071aec7ed", "comment": "Malware payload", "value": "c8589ca999526f247db4d3902ade8a85619f8f82338c6230d1b935f413ddcb3d", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ChainShell", "colour": "#0D0755", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TsundereBot", "colour": "#1721FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778442970, "uuid": "11ac9cfb-be85-4415-931d-208a583193c9", "comment": "Malware payload", "value": "6e2ccdc883b46445b86c8ce9bcbaa186c916335c", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ChainShell", "colour": "#0D0755", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TsundereBot", "colour": "#1721FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778442970, "uuid": "bd180cbb-3ed2-43be-9c05-484554945638", "comment": "Malware payload", "value": "27e75992f2fc5774a900e5672fd6158d889afc78d8c258c95f39071053e2238a6be95be7e98b47830e29b370aa73268a", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "ChainShell", "colour": "#0D0755", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "muddywater", "colour": "#492604", "exportable": true, "hide_tag": false }, { "name": "TsundereBot", "colour": "#1721FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778442970, "uuid": "d26b0946-b2c9-4d59-9928-54418e7e2044", "value": "T1301539D42693D403B18D0A63BF057AECD03FA972AEC8E547E2A4759D28BC407D9B8DC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778442970, "uuid": "66bb16bf-abf8-49a1-9362-cd9d75c5cd43", "value": "12288:fbRR0/10gHzYC/PLlFrRRq0B+q3TxZQ9eHjZYaAR3naDCZiAgwhomEXLktIjl3vE:t6/13nLXrPXx5jZYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778442970, "uuid": "7cb6799c-e8c5-4380-8349-b5c0e0ae86a6", "value": 901738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778442970, "uuid": "32539968-d156-478d-8b13-293c09828ff9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778442970, "uuid": "d78fab2d-5c10-4374-a717-63bb898d3427", "value": "VfZUSQi6oerKau.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d143a238-4c71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778418715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418715, "uuid": "7664b78c-aec0-4b39-b296-f8d72dc5f455", "comment": "Malware payload (Mirai)", "value": "7dd6ce1b16f9f1322ad61c5cf09b66c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418715, "uuid": "e9d0b11f-cfb7-4760-96e7-568d93505249", "comment": "Malware payload (Mirai)", "value": "c875e3d087a3829ab1af76fe8005143bc13be4845f8ca188a131fad8db55f10d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418715, "uuid": "66dcf167-e853-4acf-a9ee-b802b4f9cbfe", "comment": "Malware payload (Mirai)", "value": "4444c56b0136dc5d0990439d0333b3d8caa8e48c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418715, "uuid": "fe301f03-0f88-44b9-89fc-4517226d4074", "comment": "Malware payload (Mirai)", "value": "cbd36de123312b68328fa430e84e5ae46ce8e0ef5b616af77f78039f2537cce5d5188e1055ad2adbbf229a1471fc2f79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418715, "uuid": "4622a158-8df4-4138-925a-6870057a6688", "value": "T1F3B3295B5A2C1B47C4AB89F13DBB23F0C7ADB56122E122C5E209FEC05776AB06432F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418715, "uuid": "d52d3025-e935-4fa1-841b-a1c9bbdc3ae8", "value": "3072:AuDRSXW84Jw/N8IjQ0A3KDryCrsmg31+CBtWZDY:9SXW84JuqIjQ/3KfyCYmg31+CBtWZDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778418715, "uuid": "3e0e1f1b-a534-40c6-af10-3825d352ef8b", "value": 116689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778418715, "uuid": "1fb9f524-4c21-4102-86fe-fce007c51f76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418715, "uuid": "679d239c-c4b1-45fd-9ef0-556b8d9bb737", "value": "zyre.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15faf107-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448465, "uuid": "37455f12-6a27-4bc5-8fc1-7bdd01dbd143", "comment": "Malware payload (Mirai)", "value": "90897e93a54747ba6e9476d0bf605794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448465, "uuid": "53cd6990-f8e5-4375-ab66-827d397541f1", "comment": "Malware payload (Mirai)", "value": "c883cc254a3fd9a939487efd46dfc898491d607f0af9e43834201cc86797f87c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448465, "uuid": "94fd8297-b729-4b48-8cc9-a7e972cea3ff", "comment": "Malware payload (Mirai)", "value": "a481e9637c0328af90841d681020331d73f892da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448465, "uuid": "2dfa9642-bc7e-41bc-ac08-2ba7f040357e", "comment": "Malware payload (Mirai)", "value": "edb3111c0160f4df0b36f18dcba4ead1ad4201ec19096f588b8f732b5616d574800c07adac1ee12bf9a6367bef86d801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448465, "uuid": "3e90c9c5-e276-4e4a-a89e-da7a8343a037", "value": "T13A4302755707BFB767272072A83120512BC20DBED0FD71352BCF6AE427898265EAA04F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448465, "uuid": "c5625f27-2923-45ed-8547-07aca29964d3", "value": "1536:lbiMujKdc2INwlwypVKNrGVU56Luy6tlV1nLJ:li4uyfK0rLd6tlHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448465, "uuid": "0ad007af-82fe-4dc3-8014-6fd516899b06", "value": 60152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448465, "uuid": "d4f56545-99bd-4829-a6b3-15768a405f54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448465, "uuid": "b3b93266-86d9-4ac1-8199-67fe4a3c6c8d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc41e33-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371353, "uuid": "b6b1304d-2d56-433b-890b-b3ee8aab62be", "comment": "Malware payload", "value": "efadb0f05735cd955eeb079947da0d97", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371353, "uuid": "f8e827a1-5cfc-4220-8243-fdb5522c7a3c", "comment": "Malware payload", "value": "c965885eac5b296b1062de60ea9620b74e89fd57d26561aa60f106c93d02f8de", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371353, "uuid": "6c08d65b-93e1-49f3-b91d-8ada7b9d6247", "comment": "Malware payload", "value": "4ca9de2a024b5dace508430469d4b03b29924d41", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371353, "uuid": "c5bb270b-79c0-4ed9-a146-2d5c82dc0806", "comment": "Malware payload", "value": "dd1e58ec63b2fb8294470f2ada77bb64db59797695f72cdc148156b8c52c4143cdbe072885373bc835fe12e339f21215", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371353, "uuid": "d6d16e5f-3367-42a1-8b56-6d1ef3b61657", "value": "T17A143A08BFDDF55BE93C167147A30CAB13F0906312F54B1DAA860D9E9F1A3C2EA57261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371353, "uuid": "df096cd7-959d-4190-8b58-9026359c3adc", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371353, "uuid": "ecb2abf8-6894-4df6-9e34-88b77e78d07c", "value": "3072:bxNU7Ju1Sh9oF903zcm+T8ymdHJpjUoyEC5lv3VwBSh9oF903zcm+:beJp9oF9Nm+T8ymdHJpAbf2M9oF9Nm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371353, "uuid": "4b60f309-4342-44b7-9398-b596548aacdb", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371353, "uuid": "b0c16bf5-63c4-45e9-a4bf-7fec93da4c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371353, "uuid": "0fb58407-18cf-43b9-9d16-e9f92d3dd2d8", "value": "c965885eac5b296b1062de60ea9620b74e89fd57d26561aa60f106c93d02f8de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa5253a-4c0a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778374420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778374420, "uuid": "66c05101-c34a-401b-b416-7df0ae4957e5", "comment": "Malware payload (Mirai)", "value": "8c1a06808c879f6ab17cff1be8d44677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778374420, "uuid": "e4c62e71-caad-4649-919e-9bab6d6c2e93", "comment": "Malware payload (Mirai)", "value": "ca6e649f60e5e5975a6287e142f27d3e4d946928c4c5663e21a75a71a63bb262", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778374420, "uuid": "061ca5d5-d16c-4883-ae15-42fd48695e77", "comment": "Malware payload (Mirai)", "value": "34766123aa4db30aeee547eaa7f46d783b435f1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778374420, "uuid": "985fffd2-f442-4bb7-83ca-f9ecbf571505", "comment": "Malware payload (Mirai)", "value": "3a0ba0a34ba81846f57b09d810d6dcbb39a2deb56429709712bba9f94f190c22f5d9ac863991774a9ab3ff0f43ce5362", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778374420, "uuid": "dfa30eab-c27c-41db-987b-78194c69c522", "value": "T1F283D788FE15971FC7D272FBE78D03CD763A1F69A7E6311599316E9033C5AA0253A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778374420, "uuid": "3a49229c-711a-49e3-bf19-95b3e29d9c31", "value": "1536:0QK8pbywDlfVDZqYhmuCysO1lHoqQh+zXobeBo1uEXZXIsyORxem:9K8pewheYh/sYV6h+D4uOIoem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778374420, "uuid": "e281b598-6bb7-43c8-8bb4-6544f8ac1c70", "value": 81768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778374420, "uuid": "067cc82c-2a46-4794-93b9-d74e8b8d6721", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778374420, "uuid": "5499c00e-50e2-49cc-8dcc-1d89413b57cb", "value": "8USDaF.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1165ade9-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448457, "uuid": "e9d35c62-76cc-46f0-9564-5d5cf74552e7", "comment": "Malware payload (Mirai)", "value": "511e608d321fb977464cd8979fdb3e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448457, "uuid": "76fc2cd2-f138-45d2-b5c0-2a098e8cb800", "comment": "Malware payload (Mirai)", "value": "cb1568409634b335b04db2599fd84de34022c280b53a200b94032cc73c43e1ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448457, "uuid": "9cbf190c-bb36-4454-969f-1afe46e77504", "comment": "Malware payload (Mirai)", "value": "0b8397b9b8d637af62e7b15f7305acc7f51d071d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448457, "uuid": "a6320ee3-5960-4d8d-9cbc-df58b1e2302a", "comment": "Malware payload (Mirai)", "value": "8f59530bfb64fc9e8ea33582f805fb11054b9b0d8af2e498191c1042568fd16ef656a2de1e70b6e2830a0ef1bde73ea1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448457, "uuid": "1f686d7c-0ad4-4291-a2ec-f0e7dc37cf4f", "value": "T137E2E1511246B9A0F9F0DC37B5781BCCF7AB47F5C1FB32AB252126B9338246D4A3454A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448457, "uuid": "f164e907-ad71-4c9e-b794-02f179b609fd", "value": "768:XeBsVPxhgZLkXCP30a3LadyBNY0bRmShDs3UozI:XeGVPxGZGC8a3mdSOU5kzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448457, "uuid": "0cf1c06d-61d2-40cb-bb1f-8c714cffc1ec", "value": 33872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448457, "uuid": "ac355a55-825d-4101-9307-0951de905c23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448457, "uuid": "d665dc61-77f5-432b-ac2d-29a1ca2e3cfd", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d380ad-4c8a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778429270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429270, "uuid": "1de2ebde-d758-4ff0-9390-bd38056dba6b", "comment": "Malware payload (Mirai)", "value": "b62e6404907848a9320735f6c31f8321", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429270, "uuid": "1796934e-16ff-4fb8-88cd-d9873a4014b4", "comment": "Malware payload (Mirai)", "value": "cb27374ade75a3b17913cadbee61f2b5331e2c9b4430c0a462ec5b8470d4b243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429270, "uuid": "122e5927-5291-42fd-97e7-9370b8eb1035", "comment": "Malware payload (Mirai)", "value": "72d2d3a136a1c52acbfb1b3bf75db9e3ff146daf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429270, "uuid": "eab2d621-3ded-4667-a75f-09f11a4fed4c", "comment": "Malware payload (Mirai)", "value": "d7b0e782a6263368ecadcba1131cc8440cb9ccc60a6e78dfb01085fb8031501980c54fad1a57d689da8bf170b56ec95e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429270, "uuid": "19730147-eb88-47c9-b78f-9d7171ffd269", "value": "T18F34A71A3A12EFBFF568863107F38A7097D521963AE19346F26CD71C1E2028D685F7E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429270, "uuid": "01032a04-170f-401c-b36f-0674244591d4", "value": "6144:sx7f5flfnJXQhAoMlaDm7zvnreG3Ai/a9vNYzpWe:ubfnJXgDizvnreG3Ai/a9vNYzpWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778429270, "uuid": "47061643-1666-4edc-8390-50a8fb5d97ce", "value": 238353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778429270, "uuid": "d0cddae2-c77f-4b02-ab8f-5f4a7c702a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429270, "uuid": "f732f091-1c82-4fc9-aa6a-d83b8fbf1b4e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0634352a-4c76-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778420521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420521, "uuid": "03b09836-9342-4b9b-977e-eead318796bd", "comment": "Malware payload", "value": "a5661c4b16e45ffd98033e115fa6a6f7", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420521, "uuid": "8ea52173-f42b-4c62-8fa0-f6f76c0be0e5", "comment": "Malware payload", "value": "cb7e648ddb11f82cc0a08a205bb454416dab964285547859daecccda14ed6570", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420521, "uuid": "3b43e0eb-cda4-4890-b111-9878caec2d73", "comment": "Malware payload", "value": "324552977e12d83c79edb238ecba78e5c1b42e31", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420521, "uuid": "5558e652-d0df-4414-aeb7-b55cda0f6712", "comment": "Malware payload", "value": "b6efaefcbc15f9139ffd5852292986b1b21e7a4a378c9e23e70c197f1415901cf5fd5005f477a0400ef1f739d663549b", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420521, "uuid": "29d1beb3-64af-479a-8464-6c083f7b88c7", "value": "T18BF59D02EB515AA9C4FF527C18F2870063367189FA87435790459AE82F9B3D8EFC57CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420521, "uuid": "cf2799df-96db-4b47-acd4-6e9e4d0166be", "value": "49152:hDv4wMH7leyML4/InISirO8pOSh6kaJFXy9ttr6kopHVuG5uN3ik+IQoWen:ulSUI3icFXMf1opHVuGENSk6oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778420521, "uuid": "e867832a-7c66-49fa-94f9-9bda45a899bf", "value": 3636314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778420521, "uuid": "90286423-2cc0-443b-9dd2-614ea3a196bf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420521, "uuid": "8af7d812-5cb5-4518-9ee8-cc4f525dc572", "value": "Sweep+File+Cleaner_1.0.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42b04e9-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371421, "uuid": "534c1460-057d-434a-ba3e-dd26237745cf", "comment": "Malware payload", "value": "bb222b8eeba085da84392967eb1cfa88", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371421, "uuid": "3154d547-b342-4aa9-8311-92b62ffc0fab", "comment": "Malware payload", "value": "cb80616543ced795ef0f5197a4b24f23a74d736253da011bfaa5e8baed5c0e8a", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371421, "uuid": "f2f1f8fc-c7b1-4450-b7eb-55d4a197950f", "comment": "Malware payload", "value": "73840e1b36f8492052c6de5158fea8f1c6419d97", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371421, "uuid": "5fce4cc5-48a9-4732-a63b-87470758988d", "comment": "Malware payload", "value": "62870db6d9d6ddb84504435df825facf52f3c754c378bcc8b1bdb7dd9d08bb3d208ad6cc390493b8cfd45f88af7967ff", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371421, "uuid": "cb8af820-c004-4ea4-b779-9a5505d23b79", "value": "T12D85E01873F84629F1FF4B359972501886B3B89BAA20C74E0C52594E1E71F81DDAAF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371421, "uuid": "7f5a2b2b-4c81-4af0-aeff-83cbcb559cb7", "value": "49152:TGOiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:+KloSWVTR5Nhsm8A6xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371421, "uuid": "9c575cce-4709-46f3-83a0-2ec4b49e72ea", "value": 1861632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371421, "uuid": "cf43b69d-6def-4d2d-8708-2585bff375b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371421, "uuid": "6d052736-3f74-4d48-ab9d-464792b77a88", "value": "cb80616543ced795ef0f5197a4b24f23a74d736253da011bfaa5e8baed5c0e8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec36d244-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389554, "uuid": "605ec3e9-6436-468f-a967-ca805b951a13", "comment": "Malware payload", "value": "800062474c82231a9168f63aff67b0ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389554, "uuid": "8438eed4-73f1-498f-a4bb-a671e8174ea2", "comment": "Malware payload", "value": "cbd8b2f53c447be4bd9989bc74a560812d3fae038930eec89ed8accdf5806ff3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389554, "uuid": "36f6a27f-4674-4fcd-baec-76a63167f896", "comment": "Malware payload", "value": "818fa9c1fe2cf5388edc2f0708dbf724dddc4fa2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389554, "uuid": "3c5739f7-834e-4723-a78e-e81498c0ccb6", "comment": "Malware payload", "value": "c4c2bb59de6cc0cec140626206a8199e40f22c37e9c520fb7df897f66c6f250bc1242d1c45cc81957a0f6e8719069072", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389554, "uuid": "3dd41d85-74db-4e9f-993a-4386d5f9acfc", "value": "T1BC26D814BDC42BAAC02C5F7491FA8E5622706E144AF25A366265FED8BC762347F07CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389554, "uuid": "e35d4d98-04b7-4afd-a38a-f97cf74edc9b", "value": "24576:xcpe/Q8UnMZAErRr1INmCnCOPI3lS3eKn7VAjCD0kLMjvnSsajv3djTpnT1P:/onM+0INO6vdDxLMjijnnT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389554, "uuid": "248915f5-c53c-477d-a888-e9c722c20c66", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389554, "uuid": "23cdeeb6-d628-4a74-bfe3-59b5fa90203b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389554, "uuid": "3633e7cc-99e8-40e9-ab2f-955efcdba04f", "value": "linux_mipsel_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13659cdc-4c23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778384895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778384895, "uuid": "34ec2c92-dd1e-4180-8864-bf88e7c16a0e", "comment": "Malware payload", "value": "958abb5a0e2d6f1221cae713dfc4e6e6", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778384895, "uuid": "981b8627-8973-4db1-a1c4-cd4d2b65f677", "comment": "Malware payload", "value": "cceabfe8bae493c1eaa774971a5159a97a299babd4759a9ebc6016da6edc420d", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778384895, "uuid": "11580b00-b129-4dce-9f5a-d5f5b6cf2a68", "comment": "Malware payload", "value": "3ad52ba4fadb6ccc98d7386150e7e53e10eda979", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778384895, "uuid": "9dcd4ce0-02c5-457f-a783-451dce8e0c47", "comment": "Malware payload", "value": "dd67b765c2759985d7e09e402042b5fd6cb13e083ad4dfc0e907f174e7faa34235209337e893f66a7982286a94f0c02e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778384895, "uuid": "d0870597-270b-44bd-bbba-8f18aa828c33", "value": "T12FB4DF41FB5D4D3AE0A7577C183B6648D5DABCB30E61D4AB4B1AB0371C631903E1B1EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778384895, "uuid": "769399c1-7a8e-4d21-91ce-40a8a3b355a4", "value": "ac2eb90ac16cb42346e0b5b5a3e23d2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778384895, "uuid": "2416eb29-f07b-4dbb-957b-c591c57ee839", "value": "12288:bi6NBUbFMvsGj+PhM1a2w0Uh4xD/xKmeTGyfmmTDyy:G6NBUbmxxxdeCooy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778384895, "uuid": "b7555355-afa2-4f30-b014-b4f0b801ac11", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778384895, "uuid": "db75ce84-7a26-4e41-942b-343a0cab01cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778384895, "uuid": "d9f637ed-35cf-4a54-a83e-4764d23449e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca08af6-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371328, "uuid": "bd4f2a67-2fac-458f-b0a0-eb05bbf87e0a", "comment": "Malware payload", "value": "82eec6451794fa2c7223244372287be3", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371328, "uuid": "5c4574f5-577e-4c56-8ed0-b6195e08da9a", "comment": "Malware payload", "value": "cd384d69ce89f1bc9bc399c842351717f910acbbd6d3449b11feb96a4dabfa66", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371328, "uuid": "a7eaf212-c953-4214-82b9-f4c0df0406a7", "comment": "Malware payload", "value": "005e0b6534476e17699e955e978a016e3f35010b", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371328, "uuid": "a5d31ca4-7acf-487e-b612-dff368140bb8", "comment": "Malware payload", "value": "dab57a0bdc6c3fc6ad4d471c6b5911ec559d494e75fc505a92533f5f4b692063fbcc53a2a70b72ef3aa258dba8345cb0", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371328, "uuid": "07425692-80cf-4574-9fe4-107732e77303", "value": "T1C7F44C28BBF9A61BD17F4731E5720C2853F26083B662C34B4D81A55E1F67781AE067B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371328, "uuid": "74df0fcd-631f-44ea-b888-92d06313c1af", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371328, "uuid": "e2bd2021-5696-4693-93ac-53d533d122cb", "value": "6144:BSbm+jyX9Z7Ulyong08Z9MFH8RSmk75ucQqqo6iVSzI+a7xWz+4XckMRFKOyKeXh:uH0ZUw08AFc5x+xRRFReXAFcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371328, "uuid": "da249a56-02e0-4781-949e-62473153c8b3", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371328, "uuid": "6768a996-50d2-47e4-bbb5-36232783e65e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371328, "uuid": "03a8c91b-4ce2-433e-872d-b30236dd1568", "value": "cd384d69ce89f1bc9bc399c842351717f910acbbd6d3449b11feb96a4dabfa66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfefa7d-4c6e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778417095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417095, "uuid": "1eb46421-9fd5-4f86-8e2b-2654f872f68b", "comment": "Malware payload (Mirai)", "value": "9058d945fecc88c9f532d17e3a852044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417095, "uuid": "7d2183a4-0814-4fb2-8dce-dc65b214a2fe", "comment": "Malware payload (Mirai)", "value": "cd443eed8f0ba949b67742d331c54997323d008d698ce3638cd9bb5f17452ccf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417095, "uuid": "5c3270ed-1443-4d52-86bd-a8541bf8cf8a", "comment": "Malware payload (Mirai)", "value": "9abb7826bbe8b696544a7a6cd83668dc89a09aef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417095, "uuid": "2e3f01ca-e664-427f-a89c-80480e82ff73", "comment": "Malware payload (Mirai)", "value": "d6a4c7b5f6c039b7c91b888cb88f95975f0c4e942fc308b95505a4696ddb1666c1c55ada64741376fd25322b39f78056", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417095, "uuid": "2dfee94f-c754-419f-a2ca-87e00ab4bdd6", "value": "T122D39D62A5325CA8C12381B47035DAB55373971283031CF7A9A5CA7C818BEDEF63E3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417095, "uuid": "5328adb5-019a-4e27-b326-cd8d6692399b", "value": "3072:rbbkS4Z5n0+59alwnfLcscRTIE0cc+5uEaBK:zs0c9cRTIlu5uEaBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778417095, "uuid": "1969f8a6-fbcf-41c9-924f-3a104ad7ae56", "value": 137200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778417095, "uuid": "63d2e735-380d-4256-a998-f074592413aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417095, "uuid": "57230d71-1256-4f7d-9285-778df9f704b2", "value": "debug.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db80478c-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389526, "uuid": "2cbf9353-0eb0-4be9-98be-6b4dc1b4e0d1", "comment": "Malware payload", "value": "39ffb70b10907b0d0b0e18881faf69fb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389526, "uuid": "b592b4bc-bb34-4b7c-abe8-cae9a37bb765", "comment": "Malware payload", "value": "cf9f82b6b554af980292d23d13b36f54b3eb56f047c814b48aea1beec0278776", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389526, "uuid": "8258cf42-2714-48f0-9ee2-5c662cf6dbc2", "comment": "Malware payload", "value": "1a0603af11cab0b35d20c59bd168ec5b001117a5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389526, "uuid": "42ad2a28-78cd-44d0-825a-6114fbb5f01f", "comment": "Malware payload", "value": "29974f2bca0930a0eccfae42fbc98ffe1d555179a7a692a6853a91bcfccf71ccdf497f218febc56c063072910270369c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389526, "uuid": "3303a6c2-39ff-40e1-8e74-d766eb8825a7", "value": "T1781179CA95E0311984ECDD1030AEDA4740448ACA32A57BDDCDBD64B7A6C4D20F57DF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389526, "uuid": "b95d1d95-d21d-492b-b56b-14fc037c12f8", "value": "24:8etenleYalehKle8IleOleFeZeeEe97reooeaeQn:8LlclhlilVlwqxE4yd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389526, "uuid": "f23ddaaf-e66d-4d19-acee-d3dcd1cd331b", "value": 1068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389526, "uuid": "8bf63a85-2414-43ec-bdac-bde6f39fdec7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389526, "uuid": "3135c18b-5544-4c8e-9adc-5babf9c54ad4", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a602a28e-4c6c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778416495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416495, "uuid": "2d0e1f1c-b755-4c5a-a88a-efe62500ab24", "comment": "Malware payload (Mirai)", "value": "7e1e105464998c5d3c24be6ff60d7080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416495, "uuid": "6cd8e3e8-4e43-449f-b993-f015a3809c89", "comment": "Malware payload (Mirai)", "value": "d039dfa993a7b84d38c63ec1b945b2a16f856e692cd1f2ac26af9f90a81b2b8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416495, "uuid": "c2130308-6c37-463c-88f5-ca90d8447e29", "comment": "Malware payload (Mirai)", "value": "630d27e8d9a98876a70c7408d3d4aba6c26f1d9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416495, "uuid": "afafe809-08e4-460e-bd31-500d25b9c4a5", "comment": "Malware payload (Mirai)", "value": "30cbeb562e7fe14ce73cdf7dfd755f6ec0aef2633d2aa220dc1405ab42bf729a69ef642439ccc1a85403df0881674a41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416495, "uuid": "5ae1df02-4bf6-4f93-b009-17b162899467", "value": "T1A3A319DFB8A24A1DC6D646B7762E938573B55374C3CB7203D8144EF8A28F10A4B36B85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416495, "uuid": "8c8c3859-41b2-40ed-a1c4-8f23eba70c02", "value": "1536:FweAIPw860Bk1lVFSj9VPcMUQDyd9OSHUuDAIkdJwCGB:hDPw8xBQFMDcMUx9OLuwGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778416495, "uuid": "4d66959a-80ce-4b02-a23a-dd8f87f3539e", "value": 104944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778416495, "uuid": "78b87134-f528-4d3f-a068-69ffb910dc78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416495, "uuid": "58ae0545-df03-4ff4-8074-c48662e9a0f1", "value": "debug.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482fb643-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778412472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412472, "uuid": "4775cc4d-c279-478f-b158-e536d43ec157", "comment": "Malware payload", "value": "488b9148c254f0beffc72d15f54b281d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412472, "uuid": "824a8ff3-b67a-40bc-a2d3-ac590fb9ec36", "comment": "Malware payload", "value": "d0f437514193499a46ae5c78ddccaf61ac9e3b1db1570a502ecb213009edb802", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412472, "uuid": "1e38f8dc-a286-4ab1-ba1a-0bff284c555c", "comment": "Malware payload", "value": "04ef1c4de179da85de14e4aa5a32e228192e3a86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412472, "uuid": "8c090f3e-1503-4887-9a3e-7e3995b3fe54", "comment": "Malware payload", "value": "1f6ef1347511f1095e1699a6a7d3eeffacfcf10e1366c1182019cd0d3fcd8cb39c657368ebb2050d4d1ebf53b75aeb59", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412472, "uuid": "f45c1bc9-17a9-40f1-ab40-5dcd08d8f120", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412472, "uuid": "9e824b55-eb72-434f-b318-d4e6cdbd4eef", "value": "3:uVJA3:uV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412472, "uuid": "eadc1cc6-1d26-4ecf-ba71-488daa570705", "value": 13, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412472, "uuid": "55c9d793-4fe4-4364-b0ff-1436f4a724aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412472, "uuid": "a68cb005-8131-49c4-894e-e0b6df81254d", "value": "d0f437514193499a46ae5c78ddccaf61ac9e3b1db1570a502ecb213009edb802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d06fe17f-4c91-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1778432457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432457, "uuid": "852fad49-be20-405f-8d72-9a565259dc6b", "comment": "Malware payload (CoinMiner)", "value": "f68ce139d0b34c0050a94360ceef8949", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432457, "uuid": "4ed61f59-63d3-4403-b362-534a58e0fa68", "comment": "Malware payload (CoinMiner)", "value": "d0f5204860a8c1abe22bb20719dc0a43510ec5f9f3c9246e15c5439310d87655", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432457, "uuid": "e3cbe283-15fd-4ba2-adce-e619c7ba1fed", "comment": "Malware payload (CoinMiner)", "value": "0927918718fcb1d7e509e4410768e3456ab1419c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432457, "uuid": "79c8fe48-2f30-45e3-a62d-1a6346c0ac51", "comment": "Malware payload (CoinMiner)", "value": "2d58bcc376950dfcabb1bf01fc99c5c9e67ff3759456cf00f23591bc16ba68fbea8f427d79ac95e99a5bac70d1a1ff31", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432457, "uuid": "432c946e-6167-4c57-94c4-545745836d21", "value": "T1D3223A2E6E4A4032D3E08AF026B58A5E567D557323C6B3EBF333C5854BA83458401AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432457, "uuid": "a0d6b480-9e4e-4e37-b02c-0345e6508cfc", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432457, "uuid": "379a2e44-6d0c-4619-8d12-56db3968bbfd", "value": "96:GFgd9oUzYz/9PYz/mUJ5sAJB3dCsLDbFx+ZQVFzN4PFJxGE9mZ2FFhxC7tCEKcfy:w6oUEWJrJBHx+eVIPFJxTEZmFhSKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778432457, "uuid": "7447c368-8282-4f68-9c6c-29d4515528b7", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778432457, "uuid": "7e9cf11a-0d95-4856-b34b-d9c5ae910d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432457, "uuid": "b359f922-8917-4eaa-a012-34b8ab1198d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1eb6c96-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371417, "uuid": "a867ab35-9d24-4de9-81bc-04c3e2f50fa5", "comment": "Malware payload", "value": "398d06766a0535ecba830bcd58a9d4eb", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371417, "uuid": "2b5a2265-17a1-4ea1-ae33-42ed001b3bbf", "comment": "Malware payload", "value": "d426b877bb87d8f06301957dcb64e89ae8a51c3ef70e12e64fd50a3e086500a8", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371417, "uuid": "c075f057-7df9-426e-9e94-88de2e89dee6", "comment": "Malware payload", "value": "5bfbcd15c7cc8233772e49b7693e5759dbaeb4f2", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371417, "uuid": "f27cbb53-d539-4f14-91a2-8c77b521e82c", "comment": "Malware payload", "value": "7c07e9cae8a3dda39a4ba39ea006aa221bc5229faa4cc0e90f9cf30b8106177449ea5a3555b0a71d275297f06df6e1cb", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371417, "uuid": "55ceb0f1-3f9f-43fe-aa8f-8b078da17b9e", "value": "T12C05482473FA660FE17E4775E6624C2A63F264936611C34B4E43649E1F63B82DE132B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371417, "uuid": "e9d1c82f-8eb0-4e67-96be-837561d5b487", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371417, "uuid": "eb1afe04-a86e-4c13-afe0-9c4ea487b743", "value": "12288:0OeO5Oawispm7FfzuHcCWqc0p+EFVB42uB:0OeO5On6RkTnch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371417, "uuid": "25f8c05e-120c-46b1-a726-4a0e4e8d4e9f", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371417, "uuid": "5952957a-21f4-4d77-bb2f-bd24fe439008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371417, "uuid": "91640520-4fc1-4639-be88-f59da3d91ff0", "value": "d426b877bb87d8f06301957dcb64e89ae8a51c3ef70e12e64fd50a3e086500a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ae7584-4c30-11f1-a769-42010a9c0008", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1778390449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778390449, "uuid": "45e33194-27e6-442f-b115-57f7294eaa44", "comment": "Malware payload (Cobalt Strike)", "value": "078b3ab17372d9f6568dae2be29393e1", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778390449, "uuid": "b7c194e1-fa0e-48c2-a57d-9dd0fa9c77a7", "comment": "Malware payload (Cobalt Strike)", "value": "d46e966d978515b900ae003dc3b56225199de590e62165bb073138935e9b4294", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778390449, "uuid": "90ff569c-bf9a-429e-a2b2-16b41e22d1c8", "comment": "Malware payload (Cobalt Strike)", "value": "0539bac46f6aeaa1910a54a24acde9f5e5a1ca5a", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778390449, "uuid": "2fc38d82-c17f-4ffd-939c-58f280085d18", "comment": "Malware payload (Cobalt Strike)", "value": "7277182a6219266dba80fb303daffd1b6a812d8a64c89f30089454e749b4c01e9cd55f1c304cdd3844fe27d9b454b02b", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778390449, "uuid": "991ade4c-69e4-4dc4-a99d-26075beb9c46", "value": "T14B26AF12FB465AEDC0AEC070829646311A75F8DA1B25BFFF059492353E6A6F02F7835C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778390449, "uuid": "d414dfc0-50d8-42e7-9578-ed76ccf33b87", "value": "e29812e4d707ec43bda440dca1652c1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778390449, "uuid": "f15ac36d-ed07-41da-98d3-f093162de044", "value": "98304:CYZ3vg29zj+z/cB+e5/9uPfdly37pltV9:CYhvgen+z/c/0fdl2JV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778390449, "uuid": "0c8d59d9-7b26-4169-971a-757c08546f8c", "value": 4824064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778390449, "uuid": "74d40a50-9c84-4270-95c4-e76472b8611d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778390449, "uuid": "6e597bcb-5659-4b75-9a64-008037ae6d6e", "value": "\u7533\u8bf7\u9879\u76ee\u540c\u884c\u8bc4\u8bae\u610f\u89c1\u53cd\u9988\u4fe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8a793c-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371432, "uuid": "45b232bd-3813-4ca4-93c9-d17bf540f082", "comment": "Malware payload", "value": "e4907119feb1e33d1378b19977a36c5b", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371432, "uuid": "82b475b4-098b-49f5-9b77-58fa85c59b5d", "comment": "Malware payload", "value": "d4b378e5a1ae3e997310e6520bbbf71dc4b31d4f6319be96af2817ededd7a51e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371432, "uuid": "641a6eb9-e260-42fb-aa0f-70a1c8334193", "comment": "Malware payload", "value": "e86986c9941af5daca242ab70c1ca563520f7255", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371432, "uuid": "52885c1b-430c-4efe-a0b9-20136a230e99", "comment": "Malware payload", "value": "4b261f014e23778f4d2ec15c11a3e0c0ce086b93e6869ead7db8e165eed310cdbe83e0f45be02d721debb6f7bfcf6f53", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371432, "uuid": "c0e771c6-965e-4d11-a9c0-6155eb306696", "value": "T10D257C0477F8671BE17E8731C2724C2513F6A09356A1C74F4E86E94E2F67782EE066A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371432, "uuid": "ed7a1623-1d22-4eeb-958f-5f62d5cfcc45", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371432, "uuid": "9edb165e-21ef-44bc-bce3-4d547b378beb", "value": "12288:9wv2TGLGAFqALAAB/2nZm6kfgiwZ0q2nZm6kfgXLKFqALr3AB:pecABemdfxzmdfb3AB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371432, "uuid": "494fb4fb-29d3-4ee0-a827-0d378cc36f5d", "value": 978432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371432, "uuid": "797f6113-873a-4727-bb75-a5d3e62de28b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371432, "uuid": "3c971af9-d756-40c4-bae1-47f2aa6ca227", "value": "d4b378e5a1ae3e997310e6520bbbf71dc4b31d4f6319be96af2817ededd7a51e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b360f7ad-4c4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778403203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403203, "uuid": "44c408e5-5222-49dc-af89-e88b85f864ca", "comment": "Malware payload", "value": "e9c71cd5e21fdd04f7cb03ee7a301f15", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403203, "uuid": "8f57972d-8f67-46fa-a3d3-a4f432308963", "comment": "Malware payload", "value": "d4c620b8fc7aca439861ce67b6f9132b89c2869887ac3f6a1b3008099e43b976", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403203, "uuid": "9f87db21-6f9f-475a-aec6-0c8d007d3a7e", "comment": "Malware payload", "value": "1efa732612cd3d49687e0c4653ab758a2c5c2f27", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403203, "uuid": "f409d6a3-ef1b-4680-97de-4cf414acb01e", "comment": "Malware payload", "value": "d86fa2833fa2cd33db8e096987b8e21879cda8d723ed02cd2ee4ed6b88584bf83ef3da20deaeda21a1fe52e874cda332", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403203, "uuid": "57f1dd29-b7fe-4f6d-a520-a58f8d715a2a", "value": "T13D6633B7F42C9AD2F42F947A90A0299083E5335EE543D8FA57B171D472E2F4A44CE326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403203, "uuid": "4ed4b95e-02fd-4966-bc5d-acb55f79beb5", "value": "196608:+Zftpr2BsorYug0uU+HB/OGUElH6XU8YYlbHXUi:+Br2BsovgrU+h/PUEl0U8YYlbEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778403203, "uuid": "5c37953f-b67e-4480-ba3d-8cccd46a20df", "value": 6608951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778403203, "uuid": "49907c9f-9ecf-4476-966d-94f3ab74dd46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403203, "uuid": "d3513919-794e-41cc-8b97-2c069c783189", "value": "httpsgotextileltdcomgotextileltd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1e0758-4c71-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778418387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418387, "uuid": "90e5bad4-0c59-4664-9604-b455b2dc9c9c", "comment": "Malware payload (Mirai)", "value": "2d8a426c26906f60d5a84e029b65b8de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418387, "uuid": "38c0b69a-c626-4a1c-9dd6-b080b34f003f", "comment": "Malware payload (Mirai)", "value": "d4da9ddd2263dd8e61b2430e918813fbfa33509f69d19ce318e23ae89da10425", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418387, "uuid": "26ffd20e-ef5d-43e6-b92b-5ec8808ab752", "comment": "Malware payload (Mirai)", "value": "65e6c84dee5d877e858b023b19dcba5b4e2d973c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418387, "uuid": "b42a9d41-7d97-4e07-815f-31f60cf0f994", "comment": "Malware payload (Mirai)", "value": "072dcdb4f9232d3bb798d454403a49bb4fbc34741378db97c926aaf106f8e8829e9a5c7e36dd87544ea4112b1441f868", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418387, "uuid": "aaf0a71b-23f4-49dc-a364-ec4fce67269f", "value": "T10FE3A32AABA19FB7D80ECD33059A4A02108DE55A52D96F6FF2B4C51CE78BD4F44E3C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418387, "uuid": "44248ba2-fed6-4475-abca-256c6703be5c", "value": "3072:6oRuxZyifFaChpSSYz2Vnbmuc7bTaw2RLY:6xxbaCbYz2bmuc7bTaw2RLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778418387, "uuid": "df6aaa50-f961-4165-a1b9-03caf2deb655", "value": 155073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778418387, "uuid": "7582212c-1c55-4076-836f-489e5515522d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418387, "uuid": "1e9efe30-273c-40cd-980d-fdce59bfae6e", "value": "zyre.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcb1052-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436127, "uuid": "42fec02b-b4fb-46fe-8848-747869da4485", "comment": "Malware payload (Mirai)", "value": "23a861abaa326a22eccc7b5f31cc7ab4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436127, "uuid": "8ad4d53a-39e2-4223-bf0f-15b8e7b48d51", "comment": "Malware payload (Mirai)", "value": "d4ee5f4a62a60bd272a3071dada5541d6a4a631171737911c6f7c78dd99e6e48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436127, "uuid": "f79b3054-a772-4fc0-accf-be17af8f0fcd", "comment": "Malware payload (Mirai)", "value": "defed6ef9e39c9f53c5513d9b9e092325c03376c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436127, "uuid": "93c21b5f-8e52-40fe-8bfa-350b466c7274", "comment": "Malware payload (Mirai)", "value": "f64785e9d198b21746d8866879c0b227af37b5251246bc89ed3927f3850efa04279d7bf3efc2f5fb733e7d32c8413452", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436127, "uuid": "ced899b6-43ad-40f9-bc20-d918e505cbca", "value": "T15F13F1B72717E6B9C077A7B0529446C1EE74E82B965B03DB2EA4F93C2C7E0585D00EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436127, "uuid": "cd639ccc-cbd1-4291-94dd-62d3388487b0", "value": "768:g201GjDlPCGZnkrZpdaz8syl6wA53VuCeU5L/MgFPZc0SAZBx056:g20wjDlaanGZ8yl6w2lurgFPZVSAnA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436127, "uuid": "3f2859ca-310f-4c63-be5a-8de9655401ba", "value": 41988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436127, "uuid": "ab54dc45-350c-4ccf-afbb-7c609a6a667f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436127, "uuid": "a6f29899-4b30-44a3-a515-cfabda962429", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1693e059-4c72-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778418831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418831, "uuid": "c403070c-e8ba-4e70-bc46-3e741e464dbc", "comment": "Malware payload (Mirai)", "value": "01d12dae1a4be86e19cf0e13b281d045", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418831, "uuid": "14c9a303-1f24-43f5-b5fd-7018f20af2f8", "comment": "Malware payload (Mirai)", "value": "d759cfe6b473736ea79e9ebcbf3507bc16ab03e8ccacece2ac8b268569653a48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418831, "uuid": "2b971870-ccd8-459c-99e4-54eb4796b93a", "comment": "Malware payload (Mirai)", "value": "372fe46ec2ab7903d2783991edac07eda78271e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778418831, "uuid": "9f030005-a812-4408-b30d-86249a345226", "comment": "Malware payload (Mirai)", "value": "d6e9b02022f4f7203b78aab62ed2d689fe3a25dc0863580e0e155f97023d9deb5f7b26143ba7504ec560670aed12f841", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418831, "uuid": "7be72895-c207-4ffe-a111-812df082e9be", "value": "T124D3F73B2B270E23C0C9217101E35232EDB9D75938AD8B97B9E16D6C3F1AA9434167DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418831, "uuid": "92fce609-9dae-4bc8-a7a1-0165bee566e7", "value": "3072:t0exDtq7a8Likn69EuVHhEvV83vN9LWNfqQmg31+Ye8W3fY:ieBik9Eu13axmg31+Ye8W3fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778418831, "uuid": "d7247119-9c69-4e54-a25d-e17c88f2126b", "value": 132964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778418831, "uuid": "761fce73-b0ce-41cf-a798-34392e0dadc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778418831, "uuid": "3bf201bd-8812-43d8-a8ff-c22af119ec1e", "value": "zyre.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f39e720-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448534, "uuid": "4d0a4561-1ce8-4142-842b-0007727ecf50", "comment": "Malware payload (Mirai)", "value": "359062d9de6cf76b4833360abbc4870d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448534, "uuid": "d77e70ec-6096-40bd-81e5-f8e3b929cc95", "comment": "Malware payload (Mirai)", "value": "d7c2f81f1d09f08a13308b05ebabd859563e34f4e2f2fc6f09ec7f9f7b460940", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448534, "uuid": "3f943d3f-b5b3-4ff3-8049-3e6956932b07", "comment": "Malware payload (Mirai)", "value": "9a05a010e5b0026b37e26cb5926e18a2b9938a20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448534, "uuid": "ea998bea-c2f7-4c33-82b6-5f33ef92d203", "comment": "Malware payload (Mirai)", "value": "b6f0248d0896acf19f68f2a6606a60ec19af1e95ad23d368595a56c1899a9ae06fe12ae4a5e2d8b118fb27fd462b367d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448534, "uuid": "0dd59dac-22bb-4366-b8b2-ebe88a24f00a", "value": "T1EBA3E506BB650FF7DC6FCD3706A9070225CCA51B22B83B367674D928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448534, "uuid": "aee8fb5f-6069-4c27-8193-499c3dc29400", "value": "1536:LvGefaZSdt+s4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdg59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448534, "uuid": "a6290afc-d1fb-4438-bc2b-d787a56c2e29", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448534, "uuid": "13cd3345-6c92-4270-9843-f353eb42c594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448534, "uuid": "59d8005b-2ba5-455b-852b-eef314dc5ff5", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfa162c-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371300, "uuid": "d762b575-6709-41c3-b4b2-ba6afa96dda8", "comment": "Malware payload", "value": "0026bfe4a7284b9f3ac9edd25ec377f4", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371300, "uuid": "18c5207a-99df-4581-835a-e36fde826d30", "comment": "Malware payload", "value": "d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371300, "uuid": "4215b0fc-10ce-4eb8-af8b-9df996c6990f", "comment": "Malware payload", "value": "b359c3115e726a6b930ee2a45345b5f4bfcb454b", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371300, "uuid": "d7461606-d936-4407-bb30-0a7b3edcc95e", "comment": "Malware payload", "value": "10ba67a760c65dc86dc86e122c5a9557bdc10ccd204a775a5658ac86363cbcb929f6dcf2152e07bdab5d80663bcb8b80", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371300, "uuid": "0ee3fcce-28b6-44c4-a15b-a8fb8e9202e8", "value": "T1C4258D0477F8671BE17E8731C2725C2913F2A05356A1C74F4E86E94E2F67782EE066A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371300, "uuid": "d913b31c-8ca5-4465-9449-e86e52835426", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371300, "uuid": "b63676ac-666d-4779-80fa-97d6f79692bc", "value": "12288:Mwv2YvL4QF3J9KBDnBxEIowZ0CnBxEIukXLnF3JeKB:AY9DKB7BiPABioBQKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371300, "uuid": "1b123a29-c5b1-4710-97c2-6d6fb12c07e0", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371300, "uuid": "bca519b9-9d0c-4d91-910f-591ad7e6800e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371300, "uuid": "cab51f71-5d2b-47cd-ab4b-f68055a0f73b", "value": "d7d21799371cee58801df6cb696166b87565159995de6c9bc047c3dd02c9dde2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7a4dbe-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436160, "uuid": "f83c1be1-3bb8-4a3a-935b-ae03f8a510e1", "comment": "Malware payload (Mirai)", "value": "a956d77ae01da9c4581ca7891e870d02", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436160, "uuid": "c64ac120-bcb6-460b-aaef-2112dff829ab", "comment": "Malware payload (Mirai)", "value": "d86c47c10d7ce5b2477e0cee7a55884b5886492df3611a96c72074a054b5349a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436160, "uuid": "7d371f78-4d33-4331-ae73-657a8195cc82", "comment": "Malware payload (Mirai)", "value": "c2d509c63d5e8d5efa3f718c922e3f1df3e8eb4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436160, "uuid": "26473c95-a8e1-459d-80f8-7febd583fccb", "comment": "Malware payload (Mirai)", "value": "17d05d06f2ff459d17810b6017bee3026630776b2da82cca0a7f515d991bc52388d6f8a3031834db13ab07c50a5b38c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436160, "uuid": "2604a70c-3f33-4c33-a305-6223a49a7dfb", "value": "T14B8329C1FA8BC0F1D91B89304067F73FCB31E9695061975DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436160, "uuid": "8a4e4bc5-eb1d-484d-9cfd-15e5415a14a6", "value": "1536:HInlZzkj+0cO4xoPEw6HMAyvleEMWximKjfTsv4gz9F7EN:HIlySh9is7HMAQjwmKjfTc4DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436160, "uuid": "a7a44d75-1964-4ed8-bc3a-fde1a7c130dc", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436160, "uuid": "ac316805-25d7-486a-af4b-7d5cddbfdcb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436160, "uuid": "12056392-3d7a-4d0b-8060-3af4a819fda7", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866994bd-4c82-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778425890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778425890, "uuid": "f311acbd-ef3d-47e4-a058-30f95b24c842", "comment": "Malware payload (AsyncRAT)", "value": "0b61849bd3a7bb1d2ceb8c00403fda33", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778425890, "uuid": "06466d00-db08-49d6-b3c2-3115abdea8de", "comment": "Malware payload (AsyncRAT)", "value": "d8740abb7cd757336668faa4a79ee48697b22efae7668a6fc25cf0e20525245c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778425890, "uuid": "eeba9956-7df4-40b5-92fd-3e28093da72d", "comment": "Malware payload (AsyncRAT)", "value": "fd5f5ae2862c93d35d3d82aa8767b87f9694a40c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778425890, "uuid": "5a057139-e0e3-4f0d-a8e0-f83764b8653f", "comment": "Malware payload (AsyncRAT)", "value": "364bdfad9cc0611b5125dd8e1cb96330d912e3f8c95432893f22405081b7c4ff18aaeb010463ee60fc9813bb2e12191d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778425890, "uuid": "ae2aeafd-166a-40aa-bcd8-7efcf3d34ff5", "value": "T1ABB33049E919485DE82D0E7C6CF3A45606D5BF37E508ABC40CDCB8CFAA33A860EC5759", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778425890, "uuid": "397a644c-f817-4aae-9761-5bdb25c1be97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778425890, "uuid": "7c054dd3-4e94-44e7-9c7c-311c8f01c68f", "value": "1536:wu6YGpTPso25kBdUn3b1XSJc+Ed1mW7DB5NRlmMGCCz:wu6YGTPso2WBGn3b1h3d+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778425890, "uuid": "b045733e-7abb-4a76-a168-9d80c770745e", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778425890, "uuid": "11f3f367-0bd8-408d-baf3-ba6da313a618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778425890, "uuid": "4c164a38-2760-49bc-bc2f-3467892adc51", "value": "Telegram (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5b2ebe-4c6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778416027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416027, "uuid": "cd5a13e6-0770-4a4c-88a8-dccfe9faaaf1", "comment": "Malware payload (Mirai)", "value": "84f429c21cc27366a9d7da52e7534bdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416027, "uuid": "aab3acd7-df45-4231-8556-f86ea31e6447", "comment": "Malware payload (Mirai)", "value": "d894e2e41ab5d0097f38c8ce615e5be5687ead1616ccd7a61b539bed6421b86b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416027, "uuid": "8c75b90d-a7aa-4b5d-a428-a16a0ee4306d", "comment": "Malware payload (Mirai)", "value": "eabacf287d59131b59f758c6af7a334272bde474", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416027, "uuid": "d640b9d7-b062-4246-88ed-02ee338b5921", "comment": "Malware payload (Mirai)", "value": "ee56051536f575d407c0bf680d4206ab1ec5f559784d383f16b85f44aa419a39f25184bc5f31e42776c64866e79fa7e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416027, "uuid": "135f71ec-3fbb-49d1-a8b3-e85e51cc19b0", "value": "T164262851FECB44F6E9031E3044BBA26F67315D058B29DBC7EA507F2AE9776D21932208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416027, "uuid": "c2686330-b829-4c2d-992e-128ac093d063", "value": "49152:DpMwciYpuWQYs7FR5+Q+uvvunTcP8+pvrIW++xFzbiT/5NJY2QNVEH:VMw0BOR5+Q+uvjPM3TQkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778416027, "uuid": "f8952864-ab16-4161-8c0e-da47f99c6e86", "value": 4792320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778416027, "uuid": "d267b4d2-ed2e-49db-a78a-71017f31a523", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416027, "uuid": "bdfa3aed-2463-4b29-8140-88526b5e27c2", "value": "i386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74633cc4-4c91-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778432303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432303, "uuid": "b6b3c4c1-abdd-42d2-b0d5-30d76d6ff265", "comment": "Malware payload", "value": "593fd77a27ef3b9b2c62a867ac76b9d8", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432303, "uuid": "7e36f208-9305-4642-9976-6a2edd9ae826", "comment": "Malware payload", "value": "d8c3390961a31b3f3ab0b15c583da294b4abd467ee74e62a1c9535b03bbbe1e3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432303, "uuid": "fd568a5d-ef56-4944-a75c-585151bb676f", "comment": "Malware payload", "value": "23bba89d6f7aac2453e3454825a9b50b47a618f6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778432303, "uuid": "f7246b3c-81a7-4b91-919f-48e3dc0147d2", "comment": "Malware payload", "value": "049a4b1138fe18fbe32413c9f6ebfb8931eae606f940e9aff51abef36e66d8af3126f8588d3e77e76d8ac4cfbf14ecf2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-43284", "colour": "#DBC0FC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432303, "uuid": "bb58bf24-9f63-4c24-93e5-c45854c16a90", "value": "T1D07309E9F819ED67D7C29335E9AA4A11F3391039870226D73F0413EF678B2149E7B648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432303, "uuid": "2ba9fe67-1287-4f90-8897-891cfaefba0b", "value": "768:q5Ced9E+2uj4Z7AZbK+8SB72hIuL7aHSb7:Kn2uja7AZbK+8v7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778432303, "uuid": "ae329618-3976-4cf6-9167-f29ddedff274", "value": 76440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778432303, "uuid": "697843ca-b126-49f2-9c61-449e8105ad51", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778432303, "uuid": "ca1ea0fa-900c-40de-b8e6-e77877742215", "value": "exp_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab959836-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371407, "uuid": "08a2fe23-fc96-4873-b48a-fea10b0bdaa6", "comment": "Malware payload", "value": "63a173b1c45dfdee1d5ec91d5f3b8e40", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371407, "uuid": "82b914f2-c076-4fd6-9b12-ec76acf12230", "comment": "Malware payload", "value": "dab0f534e82994637842f0b9df8fb41ac803174288f5765f9b1a20118f2cc543", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371407, "uuid": "abb9db35-d06a-47af-8f95-d24cfef0d613", "comment": "Malware payload", "value": "352f100848eeb6a1d9e856404fd00c77fc6381c9", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371407, "uuid": "eadf31ce-c004-49f9-a25a-1b45d2c807e6", "comment": "Malware payload", "value": "a4df7aaf9692b6b56be3a4213702e64f8b9ec8e8e063df9be0e5e488d690d3c14b47de0623d6f2d2aa34b41442530bb4", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371407, "uuid": "2cfd165f-e18b-4844-9411-5b34c6290465", "value": "T1F7F45D28B7F9A60BD17F9770E5720C2813F26083B661C74B4E81A94D1F67781AE167B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371407, "uuid": "c157ce3e-7dcb-4fbe-9a8e-48eb5c6a25d2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371407, "uuid": "eebc54b6-ebed-4684-95fd-2abc2728e25a", "value": "6144:7BpxHnC+IxZtLydqP2NcSrf0eBm4/9MFevamk75ucQqGoe/ZpxnlpnyZunr+R/e7:7PFn4jt/40x4+FeTxnvwuodVow7AVFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371407, "uuid": "f8f1f76f-d65a-44c7-bfc4-21a97324d314", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371407, "uuid": "668b7eef-0a54-4d08-84a9-3cbcd3ae9988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371407, "uuid": "948d6ee4-f6bf-4630-901c-64dcdc690fba", "value": "dab0f534e82994637842f0b9df8fb41ac803174288f5765f9b1a20118f2cc543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424d88e6-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778414180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414180, "uuid": "0671fd4a-cf6e-4758-a375-94ba378dbd03", "comment": "Malware payload", "value": "8f2fc9e26891e0ded857724f3661c322", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414180, "uuid": "b5bfe1ef-5a5f-4309-a38a-2cd1f0ce49ee", "comment": "Malware payload", "value": "dcb650ff600a7c40f203e4c187a8a7300dfa2d2d736bbe31d02a13438cdee014", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414180, "uuid": "ab00c032-6a2c-4cfe-8d0e-d988f7b5eac4", "comment": "Malware payload", "value": "c6d93669cd29f77358ee910986ca277fe44c63ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414180, "uuid": "6cc955ab-cccf-4230-8f9f-70627e95367c", "comment": "Malware payload", "value": "41e6c1e44cbf08fabae4aa403b44d996e4b960da535907b07507d8440efe9c6e9a7390143d8ac01a239bea972e53d4e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414180, "uuid": "f9e6338d-a836-497a-bdde-eb5cd5a51e07", "value": "T1DF666B45BC2DB462D6C976346F6252953339BC088F81C7272A18BB7DA9F2354CF237A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414180, "uuid": "a487fca1-7670-4a7b-96ec-9e71acabc460", "value": "49152:0VLzZt5GFIy+72YtMETMaSX+DRwM/Gq8eW2S0FmM35Eq:0VnZtuIy+N6ETMP+D4uEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414180, "uuid": "7ad4ef19-a55f-40db-8d6a-bf05e1d3627f", "value": 7078072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414180, "uuid": "b16eb90d-6143-4588-8636-4c78c90f45b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414180, "uuid": "fd095514-fb2e-4697-9b75-5377ca575e41", "value": "vulcan_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0df7e78-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371469, "uuid": "0e4216a5-2b65-453b-a3f6-7d83ae2f3763", "comment": "Malware payload", "value": "f257b03791902cf5b4325dc3e21cfdce", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371469, "uuid": "8f2bb684-f5d2-43d4-9248-c121034c7060", "comment": "Malware payload", "value": "e000156b20841ef26203fe3df9938e563ac12c768a422d179be09ee18a6d1400", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371469, "uuid": "88e1b08c-76bc-4634-b1c3-577aaa46c2b6", "comment": "Malware payload", "value": "7bc7326f428bc37f1459dbf4c083eb1cdc2a7450", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371469, "uuid": "b34ad19b-2fa0-4c2c-b712-0de758dc5fd1", "comment": "Malware payload", "value": "34019a66baf2ea686f00bc8ed144f432b092310d9371726005c0e6376a7a170ebae04e186c96a67f02650597e286d3b2", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371469, "uuid": "ba67a543-c612-45f0-bc91-1a652e522644", "value": "T1A424490CBFDEF95BE93C067146A3086B13F0806306F94B19AE860D9E9F593C1FD5A661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371469, "uuid": "59b881f1-5d1c-4ff2-b71f-8dea464cf0a3", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371469, "uuid": "0ba6ff17-c241-4bc4-a6cc-d29fad2531f2", "value": "6144:EUfvS9HF3m+WDvgMJE6hCKYcvD9HF3m+:lOFlHwECVFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371469, "uuid": "e7411bb6-e682-4e27-a6f1-d85aee0debef", "value": 226304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371469, "uuid": "1b89cd32-ca59-462b-8d3c-c7f899a96145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371469, "uuid": "afae45f2-a7a0-4941-8d11-487b87ff7279", "value": "e000156b20841ef26203fe3df9938e563ac12c768a422d179be09ee18a6d1400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d826c3-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371394, "uuid": "8e1cc188-0924-4863-8ead-f2ec18a6e5f3", "comment": "Malware payload", "value": "a17ca0eaf0c2b3227b329a32030cfdc3", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371394, "uuid": "dbd4099e-9848-4991-af31-50e589e1e0df", "comment": "Malware payload", "value": "e0adb1e997263dab177b658eafb1b612114100a39342bc0384f0accb81d58ca3", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371394, "uuid": "292c25d0-a6c7-4276-a893-09fbba806a92", "comment": "Malware payload", "value": "68a7a3442a8c21ca2e52885ab18df083ad660ff0", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371394, "uuid": "2242f50b-e59d-49aa-866a-b2079f4c5df4", "comment": "Malware payload", "value": "913a6ef10fb7cefa4743754ea49595f1ed67d0ec7177fefc7a70555d30ddd9afb76596a3f0fe7e6225f88eb6e5296a12", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371394, "uuid": "69966fa5-ec52-44bd-b61c-7a22b5914e96", "value": "T1C3244A0DBFDEE55BEA3C527046A308AB17F090A312F54B0DED860D8A9F1A3C1F95B561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371394, "uuid": "6d25d463-0049-4420-9fde-935e5ea42cee", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371394, "uuid": "7e9d07d8-ba3a-4947-a540-0b58971ed01f", "value": "3072:X/pm2tQSQ9HFTO5pLAAm+LkmJ/UP4eayLiUbkMenSQ9HFTO5pLAAm+R:RpC9HF6vAAm+LkWNWbkMi9HF6vAAm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371394, "uuid": "b8bc9563-cd57-4091-b9b0-07d5788f48a8", "value": 211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371394, "uuid": "8486b1aa-f04c-4105-8cff-0849c1dc7a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371394, "uuid": "793169ce-5a79-4caf-b3a6-fc9408808291", "value": "e0adb1e997263dab177b658eafb1b612114100a39342bc0384f0accb81d58ca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65efbac-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371425, "uuid": "87b9f8dc-9317-4d73-93f8-24c95184bd7d", "comment": "Malware payload", "value": "2a8432e0f2af4e0c3d44cc84dfb94aae", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371425, "uuid": "3466f0b6-a21d-4a4a-a7d1-938535137e6d", "comment": "Malware payload", "value": "e10dbc117d0ddbcb00210af75e7e1e94eed4d97951850ce0a2b06589bb8a0797", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371425, "uuid": "71ba4226-5a78-4e12-9d31-2a11146251fd", "comment": "Malware payload", "value": "7dcf28adc65ff0740491840881041615a6db0fb3", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371425, "uuid": "73f388b9-2e9f-4822-9682-198b140f7800", "comment": "Malware payload", "value": "3e0ff35d5afcb27d07e8f0b2685970291b7015b1cff061dce43a277030ad68049655e9b59a53404dd77f212e0b874def", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371425, "uuid": "f8fa2b2e-bc0d-417b-9904-2ba4c0a6cc9e", "value": "T16285E01873F84629F0FF4B359972501886B3B89BA920C74E0D92594E1E71F81DDAAF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371425, "uuid": "90b19e7f-7144-4cbe-a33a-497844cd9027", "value": "49152:paDOiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:svKloSWVTR5Nhsm8A6xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371425, "uuid": "620aad99-587d-4dc2-84d5-4082b64566a2", "value": 1861632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371425, "uuid": "fc961c55-b036-4545-bd84-6ffadda44f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371425, "uuid": "05a098f0-1f4c-4abd-8c69-e775f3c157be", "value": "e10dbc117d0ddbcb00210af75e7e1e94eed4d97951850ce0a2b06589bb8a0797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb013919-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371459, "uuid": "56c0fda5-0cf9-4d16-bae4-9f3aff51dfb8", "comment": "Malware payload", "value": "96209a0aa840140434037841aebd4f75", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371459, "uuid": "e84c4dd2-db41-4d9b-b001-1ce9fada4ccb", "comment": "Malware payload", "value": "e205331fb1de2bf6cd7e0ddfd0c083174a07a1d68daa5bef9570180fa4e7d27e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371459, "uuid": "a793efa6-a92a-4abb-987f-914ccecd5d98", "comment": "Malware payload", "value": "4ee9bfc75c26712e675262a14e29d2ee643883e1", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371459, "uuid": "303f57df-ef22-4e04-b79e-7dca7091ff5a", "comment": "Malware payload", "value": "a78b98762c467f42097da524f80521019f896598aee3d055de075e6ffef9cb0572284884e92a5e51c20a9cedad3e6473", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371459, "uuid": "27e915ea-8c19-4281-b61b-85ff97ca6fae", "value": "T117243A0CBFDEE55BE93C167546A3086B53F0806302F94B09ED861D9A9F1A3C1FD1B6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371459, "uuid": "7001f06e-8ce6-4af2-b37e-bd29193f48a4", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371459, "uuid": "161959f7-9de4-4da4-95f2-2b371bf42525", "value": "6144:JWXXrq9HFrjam+ZPQcsCFUsrzM9HFrjam+:QmFrjO7sUzoFrjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371459, "uuid": "07f87fc6-078c-4127-903f-00b06b0f748b", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371459, "uuid": "7ebbb8d8-4609-4706-a86e-371ba77866b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371459, "uuid": "6fedc67a-fa63-4f62-bdb7-bf2dc6fe2e87", "value": "e205331fb1de2bf6cd7e0ddfd0c083174a07a1d68daa5bef9570180fa4e7d27e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "123d339f-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413670, "uuid": "6c7f754d-9db2-4842-b45d-d5ed81ca0045", "comment": "Malware payload", "value": "4c3822fe93c661c7fcdfda7b3d3a0d00", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413670, "uuid": "303f86cb-005b-4e09-b3b7-0cf70d404918", "comment": "Malware payload", "value": "e304dea758fd2bc8654b2f71ec5c0ea4bb5a4dba4309ba88ce05974de0bf8902", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413670, "uuid": "5b1ec451-f173-468e-ac80-816b71c9b283", "comment": "Malware payload", "value": "75fc21aad4787106de61272ebba1c97f601dbdc7", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413670, "uuid": "fb313392-5dd8-4b6f-9552-af5a56ba5b11", "comment": "Malware payload", "value": "35a9d54ebb01e245ba3b5c05fd7ff54d99ad63ae5ba2a57f7cc2ae85b551d281706ae40e9988be341559f18dda95b0eb", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413670, "uuid": "77459eb5-0209-4477-af5b-a3bf5f7d7ba6", "value": "T1678533E0ECB7D8B6DF81EFD6075EC1A8DC414F781D4CA645896F10E34C1C6AA26962B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413670, "uuid": "ece487ba-90af-4869-bc20-2bda4fbdedc0", "value": "24576:NhQ4JzMgoSVQomnQllRTQqCfJTPnjhbHlRtm4QVD9N2IB8WGV4tRsgAfSI:o6ycTQbZjLf+D98IBWsl1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413670, "uuid": "4944fba0-48fe-4002-89e9-93190b44500f", "value": 1726792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413670, "uuid": "32103597-0f57-4e87-a411-d2466e895bdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413670, "uuid": "591b886a-6bc2-4921-a5ce-11c2dcccf30a", "value": "rcuop_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2df153-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436129, "uuid": "377c7d63-30e4-4878-b526-d71bc8da5619", "comment": "Malware payload (Mirai)", "value": "6227204b5a1b2fdb3b3c223cb4dfc09e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436129, "uuid": "17810973-987e-454d-b54c-2236ca1bdc68", "comment": "Malware payload (Mirai)", "value": "e3e5f0188def13696548fce52d38ddabb1bec9ab7b6b570fd43ebf98d1bf1829", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436129, "uuid": "80c75c5d-d03b-4232-b6f9-9615a7c1a830", "comment": "Malware payload (Mirai)", "value": "9114b7f8b44fbf025287da5f26c550e6c9891df0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436129, "uuid": "e1650a2b-f9bb-4975-943a-c88c46867bb5", "comment": "Malware payload (Mirai)", "value": "89396a8eee86019dca599e71bd9aaade857391617c6fa0d03bb3ef35756d0e4c0a37178d33942587fae952ba0d91bddf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436129, "uuid": "8979242b-3814-4f70-8e7a-2bf016a6c8bb", "value": "T1019328C6B401DC7DF80FDABB4463290EB631E36116931B26675BBE63AD321E05917F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436129, "uuid": "6aa221b9-f393-414c-a8f0-adf989e60148", "value": "1536:XQ1JsIO7ywe3iyRBzPQRIIecan4UtAOtFW6O35Pb8bMThLbKrTsX5vH1M0zfTnV3:XUBDQLecan4qw6O3BfuAvVMqYuaB/wD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436129, "uuid": "92dca3dd-64ac-4586-a96e-495b27ad05ba", "value": 96732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436129, "uuid": "75dec8f2-df19-4329-8c4a-15d24e5750e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436129, "uuid": "7a5dbbf4-aeef-40f9-a0b8-5e6a7b211679", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f8915d-4c76-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778420632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420632, "uuid": "7803f6ab-3939-4c80-8019-a6fdf7ce227d", "comment": "Malware payload (Mirai)", "value": "43fb0c2af5beecd7091083b3782e3776", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420632, "uuid": "69a22347-3a9f-4508-ba93-c301da60a54f", "comment": "Malware payload (Mirai)", "value": "e4b199199b911fbf70f2b0b17b02830226d1a978952ec48a96b1829426c9164a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420632, "uuid": "41f0e272-f475-4301-94ba-ed8c427f6f08", "comment": "Malware payload (Mirai)", "value": "9d3de34b77a858fee33498e31c870d132b054d54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778420632, "uuid": "bf4391c1-728a-4a53-a863-760d92f03d7e", "comment": "Malware payload (Mirai)", "value": "255a86f41f6ca3ae36d4789a63bbbbc697bcf0b33a2ba23367c7711185731ebb25ac9c5f0780d9236084cc3f48b4476d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420632, "uuid": "784ef5e1-b8ed-47d7-aaa8-9d1f66cdcb37", "value": "T14EB3290B99A15EF7C14AB9756DF355300B4EE9104B1F1A96A539AAF8430F9CFB00F368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420632, "uuid": "b7cd4d4a-7173-4ca4-a265-8f75fa7b94de", "value": "1536:TmtLT0AvzA/FOXIeqUKoRVj7YTdFCBJ3tpb3HAf1iemb31+t/+bWZaY:ytLTPIto7adFCTHAsemb31+tGbWZaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778420632, "uuid": "97a0ce56-737d-46c1-b935-7db7bc9f686b", "value": 112530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778420632, "uuid": "bdbdcaa3-8412-48f4-87f1-8b8cc17a74f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778420632, "uuid": "a81d5f69-9172-4a7a-9be6-d10178a5227f", "value": "zyre.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd28309-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413820, "uuid": "71c4a195-a8f3-496a-85c1-9056731c9985", "comment": "Malware payload", "value": "db3f124244eeb044144200f0db4705e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413820, "uuid": "30942e57-7de4-4a19-8d20-0ca8c1df7b3d", "comment": "Malware payload", "value": "e4c395b8e828a4120023c97cce380d4064b83959669e1f42cd4c2a004281e9bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413820, "uuid": "56048488-9d4e-4d1a-a73c-2d729567a1a7", "comment": "Malware payload", "value": "7f464e58aef09fcf856ca40e0cd2c21a4654b665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413820, "uuid": "8bdb95fc-366f-42b9-90fb-4db8afb35e3b", "comment": "Malware payload", "value": "e99224df54e60c5fd541c32e6a6c02b4e2090473815bcc4baa792f2e607959465958fd5b7c620203130b5720c92d6d54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413820, "uuid": "b6294dbc-07d5-4638-8762-8837d8eaf220", "value": "T12C66F819AC842BFAC02C4B7454EAC95623B05D144AF1467A22A5FFEDFC762797F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413820, "uuid": "647f222f-a304-46c4-9df7-20365dedb733", "value": "49152:HwiUwek4EaE7mjWi8OWqNyDNZcsALIqtG7cdOg5ED:zmjW/OWZfXA9ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413820, "uuid": "e1f52f65-bb1b-478a-b909-8a49b3b3be45", "value": 6946995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413820, "uuid": "c99b4f24-62c9-40d1-8fa1-208474ad1a1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413820, "uuid": "32f9e36f-b33d-4961-9d4a-d8251d699421", "value": "ecryptfsd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b644ac-4c63-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778412459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412459, "uuid": "6f48fccb-c493-4007-8b57-13bd34bbde57", "comment": "Malware payload (Mirai)", "value": "c38346de8c83afd7dde7c0eaac96be42", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412459, "uuid": "24fe2158-234a-45d7-a501-7c8811915bf4", "comment": "Malware payload (Mirai)", "value": "e6a5e43bd602bee11f85a18b60e271c7b62dc7ab6af4abb01e53b7b0d0ba8ac0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412459, "uuid": "e9032c98-148e-4d17-ba2a-a7874387b043", "comment": "Malware payload (Mirai)", "value": "7f695ed0b0851e876953765eb5804d88e2c60d86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778412459, "uuid": "2fc92622-d68f-4666-8c08-a76a95337c40", "comment": "Malware payload (Mirai)", "value": "23167ba81b0787fb149afdc9d89153189b5f486ba1dc7d082ebdb9c939441224386b96577bda34d9a7439cf5a408a3e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412459, "uuid": "78046574-01fc-4fd6-8ab9-2a4aaa59dbfe", "value": "T1C8530A82B641C6B7E10320F112F6CB631571FE7B5822D59EE7A53D71EB242C0A62277D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412459, "uuid": "4cabcd29-61aa-4200-9706-a635aab903e3", "value": "1536:I7NxGrol8WmOcMaymiNEI+YBCPcjK0XRX/fIfyFsWWb:IRxGrol8WmOcMVmiNT++CPce0hPfIaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778412459, "uuid": "65c274b1-7a67-40d0-9c09-f07b2751cafc", "value": 66332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778412459, "uuid": "444c8ffd-2bd7-4cef-a3be-b7dcaea490e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778412459, "uuid": "30d56ffb-1864-4619-8f39-4eac772875dc", "value": "xtc.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e599ce-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778435989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778435989, "uuid": "de2a0822-6795-4fa9-b186-a839b0576117", "comment": "Malware payload (Mirai)", "value": "efb108db4a5e13de90660c02fa8ff3a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778435989, "uuid": "e6f31294-0579-4b75-bbf0-e61a2da5007b", "comment": "Malware payload (Mirai)", "value": "e719a800833dbdd2616854c0b942cfb84c470e1cb5a5a97d6d10262f9523f21d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778435989, "uuid": "5070c7d0-71c8-42b1-a41a-c7420cb2dfce", "comment": "Malware payload (Mirai)", "value": "acdc4ba96df681ad6eb72e3459f55d7d453e6279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778435989, "uuid": "9c3a7a70-085b-4649-850c-9fe8bf88bf44", "comment": "Malware payload (Mirai)", "value": "5e0b7144d26c1a131f8e9b2aaad76523804b1273deef1249cc3f2f9474a83630be776280a6baabdc2d36fed3e818c7a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778435989, "uuid": "cdb5e711-3d73-4188-89ce-3e9f71d93961", "value": "T16DE3DF6EF8C07B53D6C72ABEF78E60247213033AE7E533019D60552513E6E690EA59F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778435989, "uuid": "cde66871-c8e3-4752-95b1-02c96cba0901", "value": "3072:g8icHMgi9Qyxkhhf1FIc/s2ZHsUAmQrDke/CLZTQ92d:lr5GQye0+sOsKQ3kVyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778435989, "uuid": "84cfb310-bce7-4b7a-a790-0feab685f17f", "value": 143858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778435989, "uuid": "83321089-0a68-4085-99ed-89aa0beecb6d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778435989, "uuid": "f270a7e0-4286-42e6-aa0c-5a32ba1350fa", "value": "bot.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29f8248-4c6b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778416140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416140, "uuid": "8cfb3b29-517f-4a73-b8e4-1e510d0eba9a", "comment": "Malware payload (Mirai)", "value": "a3de6a10c583d7f939e1b4d81730600c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416140, "uuid": "87101732-0cc5-4dd7-90fb-20a49cff3482", "comment": "Malware payload (Mirai)", "value": "e783ad95846a77a2ca78254a319f312abf0ef7eed4938dae8cd84331094f445b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416140, "uuid": "efa0883c-27dd-45d1-82f6-d9191f153896", "comment": "Malware payload (Mirai)", "value": "b0550c20c88c5a5fc6a3b5b1e2245ffb65d65e39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778416140, "uuid": "ee283412-e1ea-4ad3-a50d-63f1b1b6873e", "comment": "Malware payload (Mirai)", "value": "7e86904a455e28b9476122fc688a37ff8d1ae7e57f2a6340cbef33277229f8c782663659e77263dd548054a794ff8cb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416140, "uuid": "e1706d18-7e54-4013-82a0-9716e7dfeab6", "value": "T1B6C33BC1B54B80F6E84B8C3060A7F23FCBB0D57580E6D259EFC99E35DA5B945522238E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416140, "uuid": "ff9374e8-17a0-4974-96c2-55de87343249", "value": "1536:WTyjWF8yrL7poNhgea3+L2yckHfC7a/YxWkapr/0dLCn4AXsCyAvrXDwb:W+jQ8e7GfDa3ztCfRvrp70xK4Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778416140, "uuid": "3dd4dc8f-5cb6-4ffc-b04f-9ff44fc723b0", "value": 124716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778416140, "uuid": "44c95cb2-83e6-4344-885e-968de903158b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778416140, "uuid": "528dcfbd-64f4-4bcd-aa10-1344f5524aaf", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f0e5d3-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448544, "uuid": "fde94cc5-0b7c-4dd6-9e75-33ef7850ebdc", "comment": "Malware payload (Mirai)", "value": "24a158ab66c9eafdd54a771e19ef2d8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448544, "uuid": "57f7205b-b6fe-4b7e-ba6e-f4269dd72f81", "comment": "Malware payload (Mirai)", "value": "e9120b8d01de4b2eb955e821c5a6ba74b24c9f18bdd337da4e7211d048a39447", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448544, "uuid": "dfc91b24-1d79-4573-96de-b147c55dea8b", "comment": "Malware payload (Mirai)", "value": "704db68af1790486740b3d45805cff4fbe3be3df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448544, "uuid": "056e7a8b-0933-41eb-a618-3c71f9088e7d", "comment": "Malware payload (Mirai)", "value": "2c375ce3ad964704056e361ca77473a92b583fce366ef8a00e7439969e3b70e99e9ad6f99ece167e54a0495990243999", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448544, "uuid": "0d6eb0a8-b672-4293-b058-bd87caa02401", "value": "T1CBE32C46E6814B13C0D2177ABADF42453323A764D3EB73059928BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448544, "uuid": "965de5e1-b9bc-4b21-959a-eca6062e4d8f", "value": "3072:U+UgVWIx0UEaK0U4560zSlzhXRzM9hO3+keLUM/9g2JCVF:U+UzIxLEaK0U456xl9RI9c3+ZgM/9d8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448544, "uuid": "a24fdfda-065d-4820-866b-e7eb321401f6", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448544, "uuid": "e869ad96-c4d7-478a-971b-981da056b5c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448544, "uuid": "1468ff7a-e9bd-4586-a28c-7c71b177a74e", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67963da0-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436147, "uuid": "0fdddcda-d598-476d-b06f-090d03ea4e5e", "comment": "Malware payload (Mirai)", "value": "3197d996b348ac02d78f9959517600f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436147, "uuid": "66b56342-4e6f-4bec-b7f9-d1b85681244c", "comment": "Malware payload (Mirai)", "value": "e912219b0edcf135d3dc61fb15032ec7508d519f44968509766d0b27bb694c39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436147, "uuid": "29ba3229-2acd-4cc3-ba9f-8a5111ad1ea0", "comment": "Malware payload (Mirai)", "value": "c35c38e82561b1e02cb8061120f382a83dbce32c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436147, "uuid": "f58c5aec-4d6d-42fd-b9a2-75285fd5c4a0", "comment": "Malware payload (Mirai)", "value": "97235dbfeb3fad7b2bd10d0ed0ae77f717858f39ca9949d394cc503b2415acc38e3a978dce915eafc70bf816d475b4a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436147, "uuid": "ce1b58c6-6216-46cb-ae1e-cbe0ae349de1", "value": "T158045C46EB818A13C0D71779B69F524633239BA4D3DB33069918AFB43F867DE0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436147, "uuid": "7977bfee-0bf0-412f-8ae3-6abda9321db8", "value": "3072:OUsd5o+DImaehF/h9PZpgBmsXCKiHUdIQy3d0fM/9bezpFM:OUrKLaehF/h9RpwJCDH0IQy3dEM/9YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436147, "uuid": "f2ecb743-0982-457b-ae2a-dfe3e311b081", "value": 176507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436147, "uuid": "e319deb6-ae85-4a9d-85d4-13332c6beebb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436147, "uuid": "f577e115-fc52-40dd-9e14-1d1e1ca0905a", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4868c8-4c6e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778417094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417094, "uuid": "6700c2e1-51f6-40e5-b8a9-24df05312f0f", "comment": "Malware payload (Mirai)", "value": "252c515e20b94bdab8c10f64d6534797", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417094, "uuid": "63b99823-1363-4579-8815-4bd685a7db97", "comment": "Malware payload (Mirai)", "value": "e93b535e9be82f8fe9b4078ac5570f272c1a58659f7a2e700c011d2e30e85b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417094, "uuid": "da1b03a0-410d-49cf-a9c1-d6e9d7f10c9e", "comment": "Malware payload (Mirai)", "value": "d2ab4209fa033a63dfcffe0f048e9d3152f9cb69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417094, "uuid": "931c194c-f4c2-4125-b93a-70580223e908", "comment": "Malware payload (Mirai)", "value": "e64c80cd3937078112a85b4f742d5e4fdfb252d60255f5a7a085cf17091e0ef7c20cf7c1ecdc0fd2c53418ccb79851f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417094, "uuid": "00bf2397-bd66-4218-9b7d-a1fcc39774a6", "value": "T12FE32A49E950976FC2D227BEFB9E428D33371B68A39733218A346BB42FC57591E35120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417094, "uuid": "2bbc7fa7-de12-4845-b7a9-3fe0cae329c8", "value": "3072:615lBxn9TYbyE9q/Z4wgUa3jMlN9in3KtjXAMkZnvmFRJgrSIp:2Bx9TYbZJwpaT023KtjQRtvmFRJmSIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778417094, "uuid": "92e9d6c8-74c3-481f-b86d-85bdc2aa83d0", "value": 143121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778417094, "uuid": "3d16cf80-cc4a-4699-9273-69c89d52c997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417094, "uuid": "3f3cbce2-56aa-476b-804a-a1be72e6259d", "value": "zyre.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673b9b74-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371292, "uuid": "049b5795-f849-4976-99be-f6970a36e253", "comment": "Malware payload", "value": "4dd79c77e711f3e5b31d82378c9b1800", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371292, "uuid": "bcfc00d1-525e-4354-bd75-ff730d3ed96d", "comment": "Malware payload", "value": "ea51380cc90e151dc7cf078c9102b1c612277132e9f74aa2077d7718c4f916eb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371292, "uuid": "ac3938d9-21c4-4103-a846-25ef97433c9e", "comment": "Malware payload", "value": "9382cd6f87e80d77ec411abd0a1f630ec119bbf2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371292, "uuid": "c6976892-daa2-4870-ade9-5429978eb412", "comment": "Malware payload", "value": "a92b045837946c83aee8f7ddf04ce50aaab519da3ca2b1210ae437e710ca69d97cabf4c7dab8e5faf85ece62ef7209b7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371292, "uuid": "6d638338-9908-4d90-9d66-cca5eb1fe305", "value": "T194136D6526953C25AE99883B5C7F2F0CBDA983E1304491DDBFCA3CF18C15A9CE218B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371292, "uuid": "d7430b68-557a-4ac9-99f5-1825c97e25f2", "value": "768:bFs9NyXsZztCtdJ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:baHusZzcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371292, "uuid": "408a9507-1d30-4003-be5e-44c89adf320c", "value": 45417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371292, "uuid": "21714665-24b4-456b-a833-3db517f02a1a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371292, "uuid": "e7e5bf14-909e-423c-87ae-36437825672e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c0ebc7-4c5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778408681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778408681, "uuid": "7ccbac81-012f-4f34-b4db-912cc92cc767", "comment": "Malware payload (Mirai)", "value": "7dab74fa48a7fd481d1eef90d93b3581", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778408681, "uuid": "ca695a6d-846c-4d81-a3f6-5c8ec89184cc", "comment": "Malware payload (Mirai)", "value": "ea554e7a4ba315ec793f8bda9110901a183be074d2192a913cd2fbc1bbc9f0e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778408681, "uuid": "b0d0b2a8-b8a3-4eb3-a682-502923220cf9", "comment": "Malware payload (Mirai)", "value": "b475fbc9ec448e73fa39b8b2794b3ed6cb9ac0c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778408681, "uuid": "8781a9f0-68e3-4166-807b-7865e0a196b6", "comment": "Malware payload (Mirai)", "value": "fb1a0e4fc9438431d2732104202b231a7640984b439cfbda822fc4889f39635488604d337828c35ad60483925cf75903", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778408681, "uuid": "dac3c1c7-389e-4ff6-a039-a6c54f784692", "value": "T1E7E37CD2F402EDEFFC0A96BA445B0109B464B3617A930226B3D76C5FA93A0D16C5FF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778408681, "uuid": "df6bee52-11f1-49db-b5ac-d6f544e4b3a7", "value": "3072:01AwwFjbYSYqhxvELFHuiHK/y5ufyj7C6:01cjbvtELVui4y5qyj7C6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778408681, "uuid": "bf738393-0123-4a88-bef2-329141739cee", "value": 148268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778408681, "uuid": "761eafa3-5ae8-47ca-834a-ba919c70b623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778408681, "uuid": "180af8e6-f60d-442f-88d7-e3f891406859", "value": "debug.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc5840e-4cab-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778443618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443618, "uuid": "cfb0123a-1fbf-4216-98f9-d144f1d05026", "comment": "Malware payload", "value": "eb8f12ba696837a9f3d1a2b5376b0d32", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443618, "uuid": "a40f24e5-c727-4c54-98db-348d6749285b", "comment": "Malware payload", "value": "ebdcbd16ff01b6ca18d24d50510eca24de5b1ed8e9ac9e88f762408407b7bfc9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443618, "uuid": "34298f48-26ed-45ff-b783-54083ec0b23c", "comment": "Malware payload", "value": "f7a72fb11c3069c3b45e3d635cd5f55bf272290f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778443618, "uuid": "bea253d9-7ba3-4f23-806a-023802ab8d4d", "comment": "Malware payload", "value": "5bddfcc4e5fa2c512010a80c00d34ae9753ed207e4c1c115262f1adab1df4989357450d9a14585e3ccf449b59c4fbb88", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778443618, "uuid": "4aec2258-e8e8-457c-8cf4-ca59c3cc0603", "value": "T196E05506440C02F03B0A93B433F68D85C22A646B98E2CF08DDFF40E08A0E10C532FA07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778443618, "uuid": "8a316434-2849-42e5-a421-283a9df2241e", "value": "6:hkMZM5MZLLh5IFkMWFkLLh7HiGGFzPOx0vc2IBCCI/NDiVP797UKh7Unh1FKg7Uz:hIXFhWFwHlGFzP9RyIN+VKfk/bxR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778443618, "uuid": "569a248d-f0f5-428d-96dc-f33fef2fcec5", "value": 418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778443618, "uuid": "d31f4404-4a24-4624-9795-928337fabde1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778443618, "uuid": "1e8a4ae5-00a6-48d5-b420-fb7e077a2409", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad71d9ad-4c4d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778403193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403193, "uuid": "69fa2285-61f6-424c-b5d3-b677d9f143cd", "comment": "Malware payload", "value": "958f7e9a8cdb70babd1eedcd6ada51ed", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403193, "uuid": "100fdf26-c666-40c0-8a92-18b271c16dbe", "comment": "Malware payload", "value": "ec39ccc54182ff595b683f542d08951a62b765bf6efa8d59dc5ae16ec7d27bae", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403193, "uuid": "519ef446-25a7-4a03-b042-5e42d8c9d2b5", "comment": "Malware payload", "value": "4052d7642f5f95841290e67ba7ad5f20483baa7c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778403193, "uuid": "a11f31ce-22c6-4678-96f9-0a1eff37791a", "comment": "Malware payload", "value": "d29b0798bd1a2e9f5f958f5d9eb086448f615bd08dddf3ea099cdec0f5098c183a330c9c7740aa24fb892806c90c508d", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "gotextileltd-com", "colour": "#DB8BD4", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403193, "uuid": "6374220f-81da-40f6-b0e6-a5c10910efe7", "value": "T1BF82B51273F5485706831695E2CED30DAA29426B40966EA0BCDCD385FF7352B83F97E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403193, "uuid": "a18bb685-f2ad-4f92-8f14-cc9ed368a41e", "value": "192:Zcidd1hgPbdiAEpbmkbehbnvAGbzNXF4/b4bGAxvmAQFJDbSIDKSIxF9tGCTyzH8:cRnO4YJnD0QCkDwoLgmg+DQN//3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778403193, "uuid": "b7b081eb-64c3-45ef-ad92-19df74e3ed3b", "value": 18546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778403193, "uuid": "d9a81e5e-61e5-42be-a8d3-1fcfdfca1b3a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778403193, "uuid": "9a377645-5ac4-4dd4-9117-2fa7a8ddc811", "value": "jensydesign.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddc55e2-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436130, "uuid": "7ef3c6e0-a9eb-4a7c-92fd-9b1c2c9f66ab", "comment": "Malware payload (Mirai)", "value": "11b3bf79e7315b0fc969392fe782a2bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436130, "uuid": "01364636-04f4-4f24-829c-2de1789b4d5b", "comment": "Malware payload (Mirai)", "value": "ec4a6e74f77859c83b058fca81a8077bd59f3d7d89ab0e3e1f36d4170cb2a299", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436130, "uuid": "0ff79c87-31d9-4a33-90a5-5880f87c37d4", "comment": "Malware payload (Mirai)", "value": "fe2880097ee5eaa03c02e1db56a460e4c99bd600", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436130, "uuid": "504eae90-48d9-4b70-a72b-a2ec01bc0bdd", "comment": "Malware payload (Mirai)", "value": "bb134865237055ff610a6260868ae01a7f84f57abff20e5d8a6e18b43eab3acc5050bf93febde753484e23a009f44079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436130, "uuid": "b036785d-fbe7-46fb-a256-00b30f07d0e2", "value": "T1B7B2D016144DC560C6343D39F56DDAD312834AACA1FE2C2A3349887A67CED56726B3F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436130, "uuid": "6900d57c-a591-4372-b3f7-fee77584c16e", "value": "384:6E2biV2BlW7PUOtmnUYLvqOrBJpFCcvqtJTFCl+hhPsw8U2bhymdGUop5hu90:6Eb8BULtmnU4v7jQNwctsw8UQs3UozMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436130, "uuid": "c4bada23-07f1-44bf-8c8d-c370f3bf8e00", "value": 25128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436130, "uuid": "c382b6e0-3328-416a-884f-6b6e0e3ecd8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436130, "uuid": "abf34f68-9962-43e3-b4e3-5a42d61145f3", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc07dcd-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371410, "uuid": "9232b736-0cc5-41ad-83e3-0609aaca12ce", "comment": "Malware payload", "value": "262a2053da79c71804560c4d18ce4db4", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371410, "uuid": "c734425e-762f-4c72-a766-e25aa2ca3cd5", "comment": "Malware payload", "value": "ecf7ad7182250a6dafae5973a50a6f4db5eef7e52285e3f1a1107c7f0621a7f5", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371410, "uuid": "5ba841c8-7cb9-4660-b89d-0e92594425a8", "comment": "Malware payload", "value": "366b00bac6f5479daf80bd8eb158905f8de63085", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371410, "uuid": "8d9ce5c9-7990-4188-96c7-b85a8aa541d5", "comment": "Malware payload", "value": "54115a646f51d2404d5655af059f550ffdce038a7b1965cc9d013907822c11af1a3e0114952fe069875a84f434b5849f", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371410, "uuid": "165d92e4-c5f8-4729-b537-0885320e2b7e", "value": "T1F2259D14B7F8671FD23E873185724C2513F6A0439661C74B4E91E88E2F66B82AF177A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371410, "uuid": "68492426-c5ff-4ea1-8b70-c509475ab222", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371410, "uuid": "594a4555-6c00-43bd-a5d2-07fa2ea6cdd3", "value": "12288:/s0CyyYaFiU15ABFLH85Mr+QmVskcILH85Mr+Qmetm+yaFiU1Q5AB:WUUrABFLH3+mILH3++czUeAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371410, "uuid": "16fa37c8-6cdd-4422-8cb6-26f5eb187551", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371410, "uuid": "27c439b8-26c0-4b0f-82e9-b3071ec2b3ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371410, "uuid": "1c8ed420-7cae-4a36-82ec-e4ea0a9bea67", "value": "ecf7ad7182250a6dafae5973a50a6f4db5eef7e52285e3f1a1107c7f0621a7f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9eb6f5-4cc6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778455051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778455051, "uuid": "3f824124-1178-408a-a9d3-313262fbb207", "comment": "Malware payload", "value": "acff286c3c625aefa00f595cc8a596c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778455051, "uuid": "46a05d68-b900-4c70-856c-1553660a6f9f", "comment": "Malware payload", "value": "ed2ac7943ab449cb3fe968e9ebe9d1b212f33a94fa3dd309a3ddeff2f461c7d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778455051, "uuid": "ea1e9c28-f92f-468f-bea2-fa67c293c1c0", "comment": "Malware payload", "value": "15346b6ba82442242e4aad5d0aef86438e91d00b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778455051, "uuid": "021aefda-429f-441e-b29c-d81b7eedd2bc", "comment": "Malware payload", "value": "a81a40dd3cfce5d97c8b4dfb74055edfa7743dcc396ca4ba74374f7a26774db77359c4a4a9dbad016d7da330944f41ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778455051, "uuid": "4b2b9e6f-b5d1-44b0-8ef3-6eb9e1ee35ed", "value": "T117E69C77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778455051, "uuid": "afabbf22-6b7c-45ac-94ae-7087bd68d3bd", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQJ:cqYUQuVDt0TZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778455051, "uuid": "d1bff5c5-a160-45fa-9f62-20c9abd360bf", "value": 14647296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778455051, "uuid": "585f2a40-36c0-492c-84ff-d1119086e2af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778455051, "uuid": "87340d14-3c6e-41fb-ae85-ded49ba78666", "value": "ed2ac7943ab449cb3fe968e9ebe9d1b212f33a94fa3dd309a3ddeff2f461c7d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a830908-4c6f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778417576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417576, "uuid": "97f4e2fa-9db4-4443-8cdf-f46bdb5b4243", "comment": "Malware payload (Mirai)", "value": "8e2a86a74d92fa8c4c15b1a433ab3cac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417576, "uuid": "b7d55ff8-bed1-4d2c-bfdd-682058539198", "comment": "Malware payload (Mirai)", "value": "ed407ad4103d26cee46ae1f0d99d9a2a7be2e5ea192e005848480450eca51536", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417576, "uuid": "e55b5185-2925-4177-9ded-724f266880f5", "comment": "Malware payload (Mirai)", "value": "d3e5bf3a0553b2d8d0dc1e26d3abce077df5320c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778417576, "uuid": "8cba164c-125b-448a-a76a-b3bbd07a7fb6", "comment": "Malware payload (Mirai)", "value": "7bcbf615c5fbd4f002b71d769583233cdc493dd4999e8dfc85c1b65d78466362128ed7f2ce222bd4ee97ec96357bc402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417576, "uuid": "2fc06970-5958-465e-9c48-1833ee0d89bc", "value": "T1DDB34B41F352D0B2C0431BB112A7CB760230EE726766CA0BF79C6EB5AE31685B55672E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417576, "uuid": "bcfe1699-59af-4222-a6c1-f6f11a062d53", "value": "3072:rumXl/jwEqG3rK8Q8jzILvKoPfRN6a8ucjc9Mll5xr2alSlE:3XlegrK8Q8jzIua8ucjcW2PlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778417576, "uuid": "e76a0197-05a2-4d75-bf4d-bdf7c98ff3a2", "value": 111251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778417576, "uuid": "106dd1bb-18ab-4387-92cf-058efe263476", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778417576, "uuid": "168a8209-286f-4c3c-b69f-0bb114dd430c", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce23ee8-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371436, "uuid": "2ead217d-e480-4125-8a03-f1a204a9efba", "comment": "Malware payload", "value": "32f81aba340843d1618666a648623198", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371436, "uuid": "42c0ce69-57b3-4840-bd2b-437306c7f9c5", "comment": "Malware payload", "value": "ee7dd8f8d0c12a3149b8c9767f408a1ab48485b80e3095bcada9ea2302efe69e", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371436, "uuid": "4f80360e-c1aa-470c-9c26-8a397608eb17", "comment": "Malware payload", "value": "ea35e3ac37b07b0115ab7d8a7927ec6f395f1e61", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371436, "uuid": "03aee40a-daed-4039-af22-a85d1b8e9deb", "comment": "Malware payload", "value": "c83cdf310ccd4ddade1d5f594d038b0bc64ebb26344a468f52c2e300e534e9736dc8bf44484c7f71a79ceb0e7622b67d", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371436, "uuid": "dd941fdb-4e68-42a0-a582-1f8da03dc4e6", "value": "T17185E01873F84629F0FF4B359972501886B3B89BAA20C74E0D52594E1E71F81DDAAF73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371436, "uuid": "82740efc-b9a3-4771-84ac-184e293e9a24", "value": "49152:24OiH61lokNzDtEVgaRuGIlqhs+km8ir6xxHI:bKloSWVTR5Nhsm8A6xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371436, "uuid": "9bfe752c-b606-4848-bf91-dbc5aa46fd67", "value": 1861632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371436, "uuid": "3f56ac04-4f52-4a7d-b27f-a8081725e60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371436, "uuid": "00002850-1da5-4fec-83ce-e7d514421880", "value": "ee7dd8f8d0c12a3149b8c9767f408a1ab48485b80e3095bcada9ea2302efe69e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0701766-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413962, "uuid": "263e7e4a-a855-44b8-9182-af40ce9f3956", "comment": "Malware payload", "value": "41389a28b5c94c9f02905db58ee816d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413962, "uuid": "2971fe2e-37b7-409c-8c7f-e8c28f29aed7", "comment": "Malware payload", "value": "ee8bf6fa81fb62b84369864ab99f8d3868e8a76b633897459aa74226347b68bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413962, "uuid": "1d6e01d4-3573-4c94-a76d-d51063d9fc0d", "comment": "Malware payload", "value": "90e15f9c59e88a8bbb09613ab75b935a24550ef7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413962, "uuid": "c8052543-84eb-40f7-b1c0-e1db5f12d8a5", "comment": "Malware payload", "value": "920dc52b6dd73a6a71d4a13e1c68a46418f80f652b107b9656c02821b511bc01514638788aa5969a6d7333bfad70c64e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413962, "uuid": "6e05104c-eb19-4b76-8b9a-cdd17ab7deca", "value": "T1D686F6527B98DE0FD79531358AB6C23473D53D0082A120378752FB192EBF2B5992BDE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413962, "uuid": "76317f78-abe3-4962-b0dd-8af5d6324a6a", "value": "49152:PHi856XjVsmqEInV8Ab/W9N1Y/O0QFNOMG2jrWXHHEt5E2:P1Rb/WDlZGiWXnEjE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413962, "uuid": "aa4e9651-c56f-4e31-974e-4676b4953143", "value": 8388792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413962, "uuid": "f9c03b49-9acd-4a70-8b12-1365f6fc7fb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413962, "uuid": "a75bb16e-b4c5-4a18-9477-e0a6792c5562", "value": "vulcan_mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc9cefe-4ca3-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778440182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440182, "uuid": "860476cb-d15b-4fdf-ade9-02e739b88d31", "comment": "Malware payload (AsyncRAT)", "value": "8c962a7dadd6ee047c86ea37f95d334c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440182, "uuid": "2ec0bfb8-925f-4381-a798-1afd58d7ab8c", "comment": "Malware payload (AsyncRAT)", "value": "f07e85c6e9a94e0502a927410135314b878c395a273e49ab414868149f71d04d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440182, "uuid": "a918b02d-9a9d-466a-bb32-3e8b962ed7e0", "comment": "Malware payload (AsyncRAT)", "value": "5bd20f0243a95e1397b95c859d07f10da51ecb93", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440182, "uuid": "b4b0b994-9c13-48be-b6cd-262f1bfbcfd7", "comment": "Malware payload (AsyncRAT)", "value": "0dfe691e581675fa049ef6c52d1f7d865fdf44f0d38f12946fe29bb8aeba69f8cbf204da88cd17222035d7d3a4d308a2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "windows", "colour": "#2DEF59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440182, "uuid": "2d87d9a3-89c0-498c-8825-cbfdd4d67990", "value": "T126B390073B944322E5AE0AF478B225FCC52FAD237AD7FB4A1C44715603336EA5A115EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440182, "uuid": "fb346761-c47d-4ede-9968-03c949f13d8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440182, "uuid": "56a9ad4a-a618-4605-8dd0-8e1209893a70", "value": "768:auANNTR4ydbWUnrGJmo2q7vLDpPPI8zjbKgX3iT3c+WM6F7gBS2BDZALj8mqOp:auANNTRZ22mdI83bdXSTNCeBSYdA9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778440182, "uuid": "84beb4a5-0739-4064-85b6-0fce5afa8c8e", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778440182, "uuid": "32dc2a24-54d5-4db5-8ae5-c1c9ad3d30d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440182, "uuid": "e20a733f-fd1a-44e6-8b1b-33ca9d9bd3e8", "value": "Discord (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a206af3e-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371391, "uuid": "64eceefb-0e66-46e4-b44a-070995330179", "comment": "Malware payload", "value": "8a89e031ddec23f378e2e9c364da5521", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371391, "uuid": "2c1ab1c6-3725-4c0d-b7dd-7a518df92709", "comment": "Malware payload", "value": "f08f724e1ca8f4a662bcc90d8169717637e6aca9c8915c412f3cda3e8ee15a0d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371391, "uuid": "713fda8c-4df2-47d3-8816-131ba21ca061", "comment": "Malware payload", "value": "0b8a7f837bf52390275dcf3a5de331b14b0e6495", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371391, "uuid": "9ae89a02-faaa-4691-9010-be1302814805", "comment": "Malware payload", "value": "8daedda701a4d082912e94630c6053439faf41ec5edd575eda83b1e6d738e1a6ee40753009f0c1c85dfb1337fa7ec57b", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371391, "uuid": "5c62694b-e374-4b8f-b3c9-7938c6ff2891", "value": "T1E0053A24B3FA661FD07F4775E5B24C5A13B2A093A291C34B8D47755E1F63B81EE022A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371391, "uuid": "529938fb-abfd-4844-881e-ad52e519a177", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371391, "uuid": "ad009dfd-142e-45db-889f-03989744bfa7", "value": "12288:sb6E+LoqfFltJTvJtPpEgTBpe+2qyTgBAAoBv8WroH/miRFltZm9Nyb:seDoq/jTkkH/milGOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371391, "uuid": "ffa7b010-4986-4a10-b86b-69cabad409c9", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371391, "uuid": "b8626eb7-8b24-4fa6-923f-a270113e4364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371391, "uuid": "60a4ac69-0832-41c6-85fa-31c7e2dca127", "value": "f08f724e1ca8f4a662bcc90d8169717637e6aca9c8915c412f3cda3e8ee15a0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b002ea-4ca1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778438996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438996, "uuid": "7a216d5c-6f15-40c3-8907-49fb86804a25", "comment": "Malware payload (Mirai)", "value": "347b476c527d49b947c98182e1b473ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438996, "uuid": "7030143f-e24c-4e95-8365-b743b2acb4f2", "comment": "Malware payload (Mirai)", "value": "f13b6630df7f22dd9991bf9c7ba6bc525dc40fd12de1ba9edfe1b3ffc3b1608e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438996, "uuid": "ac707d34-c7dc-4ecc-a99b-fa8fbf396629", "comment": "Malware payload (Mirai)", "value": "4b76aa4567cb8c85efaacb0556daee40092a23d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438996, "uuid": "ae756512-94c5-4d0d-8cfc-915f2b34d914", "comment": "Malware payload (Mirai)", "value": "72d690522d422c4ad4b72888f37dfacdf09746017a77dfd48eece8997c87208352c63b7b14d84f259779eca17433661c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438996, "uuid": "c53384c2-0d81-4ae7-8751-138da0d7205f", "value": "T16C7302586790D3548BC8B076F809224566F721B5BA3AA4E2B6D0423DB3D9C4B50FD3BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438996, "uuid": "0b7bab3e-dd23-4708-98dc-8afca773dcf4", "value": "1536:xHXS6Q6mXykzJMnlvV3+H65RRLKiBR9f2DIdAlQzCDJWbCtt:xi65Iyk8vdRv74lQSJOUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438996, "uuid": "68858374-d306-48b7-be16-aaaff52a33b7", "value": 74364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438996, "uuid": "e739593d-d033-44ec-95a5-73ee18430175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438996, "uuid": "f50f8c47-614a-4c60-9a6f-635f124f55c6", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e12632d-4c9f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778438278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438278, "uuid": "4d7224a3-500b-49ba-9853-1846c91ee8e5", "comment": "Malware payload (Mirai)", "value": "9ff5816810ce06a422fbff7829032cde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438278, "uuid": "4ab4218c-63c3-4d45-b65a-073a3ba484a7", "comment": "Malware payload (Mirai)", "value": "f162d3d4253b4e353f89fa11e57e565cd1a52ecddb4b3160d5a71c4b05ed17a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438278, "uuid": "ec8c2277-085a-41eb-9d5f-cc9c550a4483", "comment": "Malware payload (Mirai)", "value": "5e01759d551b76e05fccbb4cb8f0b82cea2e86de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438278, "uuid": "9af527e9-96f5-448a-88b5-48706aebf57a", "comment": "Malware payload (Mirai)", "value": "76585a6058f22a2e43f31e11f555e3d19e6e8f085d6696ba276d83fc9c6a2557d5b5f0065a380e5eef4c944c6a121471", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438278, "uuid": "4a4f6037-7799-4921-8dd2-0dc1aefae842", "value": "T17B262951FECB84BAD503193014ABE2AF27306D054F24EB83EA547F6AED7B6921D3614C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438278, "uuid": "405d070a-53ab-4d0d-bc3b-d82ff0746881", "value": "49152:pSwJhvL0fj6b3QqDOywjFSgOPndbBGUaDBz6yGosBjukRDxnOSOse7DZievmfw0N:pRr7RqywTBz6yGxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438278, "uuid": "13146890-6c04-4a10-bc56-c56bb48da757", "value": 4501504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438278, "uuid": "f07891aa-ce9e-4764-b6d2-6665f65a8cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438278, "uuid": "6f1f5d7f-4007-4acc-a2ef-bc028f320467", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115e0c0d-4c66-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778413668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413668, "uuid": "80643a71-d59e-4f51-a1fc-1ad28ca58b44", "comment": "Malware payload", "value": "de691dc81ac2f711bb8304d85c0d8600", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413668, "uuid": "7f3ef148-6d42-48f6-8db6-a36675ff12c0", "comment": "Malware payload", "value": "f2cee624b0dbf3c76a0d178fda993f8c9695df334e0a496591e67c9893199201", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413668, "uuid": "edf1b672-9714-44b6-ae30-26d7e398da35", "comment": "Malware payload", "value": "b163b6309a1822e6e6be9aecbf49a6b6a9a4ea3b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778413668, "uuid": "47b96316-59f4-4815-ab78-3b606689ac9b", "comment": "Malware payload", "value": "0677789540cf7e629b7da41488f68cef13d3d4b692fa84ceb851b180d3b1ccf7b9996ec23fd102bb23a334d9f0dbc1bb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413668, "uuid": "aeb99aad-8a12-4021-9572-0d7fbe3c4257", "value": "T15D953396D44644B3BAC8F42F351E87635668F424FBC489331017AF99A82F94CD2FA46F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413668, "uuid": "71d7d433-d657-433a-8641-0bd833b1a9e6", "value": "49152:yaAA18CZ6S8DBqh1J415zi9jmRv90ttzjY3PL:1f8dqh1J4rziRmn0XjYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778413668, "uuid": "fcc1fb3a-d2c5-4a40-800b-2921231dc524", "value": 1994744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778413668, "uuid": "bfea9cdb-77b1-449a-b9ee-227ee91bbf85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778413668, "uuid": "29ca57bb-44e6-4d81-8237-ec45afe80e33", "value": "kworker_u8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8774e9e-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371428, "uuid": "07e466d1-0b69-4551-8034-90be3ec58bfb", "comment": "Malware payload", "value": "53b7c80606d28f7c389bd66d249cb057", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371428, "uuid": "4a696921-224c-4ade-9b89-6d4ba3b08112", "comment": "Malware payload", "value": "f30b5d1d45a03b5d7402134d28d6e484278fe80c8dbdf44dcde50c6d11bc21ea", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371428, "uuid": "db974ca0-759f-4003-82d2-df915a33db06", "comment": "Malware payload", "value": "e5c533eeb476f0ade1a015263ebf80d14e6428ea", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371428, "uuid": "86b07621-9482-4a42-8848-0f92f7e47679", "comment": "Malware payload", "value": "406b1abe36efcfca80d8312b6c7dd8c6eef4bf782679d7f801a10b18b59bfb5279270b436cb02ae0763afa8bb7535977", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371428, "uuid": "82aca407-e480-4a95-832f-834cf83d1d2f", "value": "T1E605592077FA660FE17E4775E5720CAA17B2A4937621C34B4E02605E1F77B92DE132A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371428, "uuid": "cc4fa58d-f74f-4889-b8b6-4db9806ee1f0", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371428, "uuid": "c95b3399-2663-43e3-9a83-c59752458cb9", "value": "6144:g1ZCcAx4umi9US2aG4Rrz4395Fcwcmk75ucQqMoqJUxOn4bY5M/eEPIVPbAiPe4d:Zrl0D7FtwDdErXoF/3EnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371428, "uuid": "70b04e6b-9658-4cfe-86ca-3cc6d7be3953", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371428, "uuid": "fc18831e-b654-4128-a1fd-d18b08598926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371428, "uuid": "5336331f-4dcb-41a9-b7b4-e8b4b267f647", "value": "f30b5d1d45a03b5d7402134d28d6e484278fe80c8dbdf44dcde50c6d11bc21ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8b75e0-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436132, "uuid": "b2ea0534-371a-4c39-9680-0dbd9738b05e", "comment": "Malware payload (Mirai)", "value": "32665ec7ea40367d1928b71a024cb2f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436132, "uuid": "a10847fe-c779-44f9-a6a7-39b41baa1855", "comment": "Malware payload (Mirai)", "value": "f4b5f934a80555cfa8541a10a9b09e9e4ce827cf00cbd67b1bfccd3c2e205e0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436132, "uuid": "4398e78a-ea4e-4272-b988-d21562133b3e", "comment": "Malware payload (Mirai)", "value": "3f55ba0a21bb96511db3c24268d1230f7ec120e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436132, "uuid": "b5ece48a-3e30-4135-8b8e-87441965a6a7", "comment": "Malware payload (Mirai)", "value": "4bb7f6fa5ad82bcff3e4380fe8640346c3bef09fac2b15743f3ffa085e73247a40146206e536f76ce87915a6cea2219f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436132, "uuid": "3cb535be-ebc2-48be-b90e-ea6b027c1fd1", "value": "T1D013E1B92D4E6FDAC5FC94B00DA78F711EA80D11FE1AB49E5FB044A91C41AFC246CB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436132, "uuid": "f8251fee-c913-42cd-94f5-7fec9a5a247a", "value": "768:G6/jZfcIpzKgxirQHTDnEjVOWhfuyKQRyNGlcPyTLdx7+Mip073LkJgGlzDpbuRP:9jZ3OxGRWhfTKe6fPylcMip00VJul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436132, "uuid": "a0e2ac07-ee77-4dab-a28d-35b7177b8a67", "value": 43264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436132, "uuid": "75b97511-c1e1-48fb-890e-1df23e65089e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436132, "uuid": "4323fcbd-db71-4a43-82ec-9c095d8378b6", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee6ac0b-4c3f-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1778396994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778396994, "uuid": "db6243fa-05b5-48f8-a5cf-3cc3c9882a30", "comment": "Malware payload (NanoCore)", "value": "7a860771edef1b60596ce32399c4c592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778396994, "uuid": "55cbdd83-379f-41d0-b57b-d0eef91f4e32", "comment": "Malware payload (NanoCore)", "value": "f633f6a552f200bdf75a3769d7d92e7c6604e01895777f99233e1c049962c6d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778396994, "uuid": "6540e529-1fff-4954-90bc-7d24abf6aff4", "comment": "Malware payload (NanoCore)", "value": "ddfcaabe77c32e1e97742d39209d280bc8cf0ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778396994, "uuid": "065081c9-ee96-46ff-88c2-ae2f290a42fe", "comment": "Malware payload (NanoCore)", "value": "87a05aafe96f6bd742914d156fbb1b3c6d95f0bcc4d7434fb053e99f3b4ec7da73826c84c3dc44a925f57016a112cdd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778396994, "uuid": "ca8c8913-13ea-4689-8ece-276bedddd0dc", "value": "T12B14CF567BA88A3FE2DE8679611242528379C2E3A9C3F3EF18D450B64F527F10A471D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778396994, "uuid": "8718356c-2351-4c22-bc7e-c47bb54c6546", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778396994, "uuid": "e3d08188-d8f7-4907-a667-08c86f24e381", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIASjIpeigkayvTSci879ZZINO1:gLV6Bta6dtJmakIM5eIpFDNxZZINOR5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778396994, "uuid": "ca26e0b8-4971-4cf4-9960-60f96a8bbb1a", "value": 208384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778396994, "uuid": "352b7f09-4a67-4c1f-9194-b584e07cd7ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778396994, "uuid": "9f9ad237-6221-4217-be33-3342b7231a44", "value": "gadalkaretail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bcab1d-4c67-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778414211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414211, "uuid": "c95b8cd1-f9c6-496f-8889-d991cbba518e", "comment": "Malware payload (Mirai)", "value": "9598604cce5058238763dec02e9d6ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414211, "uuid": "5f0805d3-457d-46b8-aaf0-d35ea321b58c", "comment": "Malware payload (Mirai)", "value": "f8170da05ab4446ba4fa9ffd392591da1abf508de1b6dbbf22d943f680df29cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414211, "uuid": "07b225fb-494a-402c-9d3b-d656d8b182f2", "comment": "Malware payload (Mirai)", "value": "cd6181272eb3f22f221d9225a9c874f6cda3e235", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778414211, "uuid": "e1acf6ee-68e0-4d21-930f-f865a2c2a89e", "comment": "Malware payload (Mirai)", "value": "28958f53942a9c8dda68a0f99f0c467de21d5123fff1bf4af4b155ea509d85ac033575e23a30774be04e0175b307fae3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414211, "uuid": "9ca2ba56-d8ac-427f-a006-3e21f9f2c5a7", "value": "T18D831A9EF4E24A1DC6C00BF6763E934A33A15374C3DB7653DD005EA9A68B50E4F36A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414211, "uuid": "fce412ea-07cc-45d5-b490-7a2065b5b6ec", "value": "1536:jub6gjBL7kRlioym3AfYveAtdGwEKo2AvrXDwM:O7tL7oo/fYFugc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778414211, "uuid": "43a755f8-74dd-4769-a433-958810a623d8", "value": 88204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778414211, "uuid": "00c276fa-e176-48c5-85c5-a85d66af9e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778414211, "uuid": "9da831c6-3288-48bd-b0aa-e6b4218972bf", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d05963-4c2d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778389537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389537, "uuid": "88602bd3-90bc-4614-ad18-415e835ca112", "comment": "Malware payload", "value": "dfb0f899668d468ae88ba18128d4dce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389537, "uuid": "d8afbe29-a4b9-4013-ab05-e7f4760b09d6", "comment": "Malware payload", "value": "f844e950371247abcc1c67fc77e5e601ab1318ecd6c9f628b6d5d12a9fd3492a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389537, "uuid": "28840120-ef27-4e96-abd5-fa5c8c0eb2bf", "comment": "Malware payload", "value": "f52e1fbeb1887e3ef693fa2cf58216b24d43d528", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778389537, "uuid": "efc1bf27-dffa-4a71-8a01-d555c8b5ccc2", "comment": "Malware payload", "value": "0df737f3ab7f608264cc98dff0eda0ad758247484fd3fc15a6a1812577816804737500548a2adc890f6d45552691691f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389537, "uuid": "91e727f2-fb66-404b-aa4d-b7bf0b2c5c0f", "value": "T12D062950FECB10B6D9031D3054ABA23F27325D494F39EB97EA147F16E937AA2193225C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389537, "uuid": "1a01238c-8a6a-490d-904d-94521b467893", "value": "49152:Z7Q/d0riMnZusIBLSyzgN3+BLxyYdYF0kk8KUfPPPwPPP3PPPrXnD1:Z8lTMnZCL1zgEqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778389537, "uuid": "acc3b1ea-8f13-4245-9a91-4148607691c4", "value": 3985408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778389537, "uuid": "dfce7271-4e17-4b91-a3aa-b87df29865d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778389537, "uuid": "38b6882f-22e2-40b3-a44e-89de7311ec34", "value": "linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9194b4a9-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371363, "uuid": "4a291dd0-c97b-4cfd-9275-f3cb140deba6", "comment": "Malware payload", "value": "7bd550bc18faac64ad256d165d90cfed", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371363, "uuid": "f4d58c89-5dce-4abf-b1ff-ebe2d1b75551", "comment": "Malware payload", "value": "f865641c22e75cbb9ee5fe3c37470ce0e127a98aab6f54fc3cf8753e5187b0ac", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371363, "uuid": "b01a9b44-178b-463d-b4d8-e9e61d1906c1", "comment": "Malware payload", "value": "372eab0ae478805297aa0b9fffcd8109366c3a58", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371363, "uuid": "1e3320f5-ee82-49a5-97e6-3233db699279", "comment": "Malware payload", "value": "984a864f3a6c1517c617773ac26d4f9ef3d48a65e19b027b69853fba32ec918bf7f103be7f7946de72b11c444a0b6411", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371363, "uuid": "a234e1f2-6dd6-4fe4-9690-d7e3d14db71e", "value": "T1B6245A0CBFDDF85BE93D167186A3086B13F0806316F58B0DAE860D9E9F1A3C2BD56561", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371363, "uuid": "ec5a18b0-2bb1-464b-ab0b-5d77f6f4822a", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371363, "uuid": "d3876652-0390-4095-9dd5-9d5befb7c0ae", "value": "6144:JBvo9HFocum+VobvaGzOx4c4l9HFocum+w:EFvqkagOxEFvqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371363, "uuid": "70b0833b-26b0-4994-be83-e3d467638814", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371363, "uuid": "04d837b9-15c8-4073-be4c-29242bd7542a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371363, "uuid": "ba3bb09e-bb8d-48f9-adce-02f3a8561893", "value": "f865641c22e75cbb9ee5fe3c37470ce0e127a98aab6f54fc3cf8753e5187b0ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5735321e-4c9a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778436119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436119, "uuid": "fa7cc4d6-3e3e-4778-876d-96ee39450de3", "comment": "Malware payload (Mirai)", "value": "cf5decd585e4260fdb978f98bfd4ab64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436119, "uuid": "6e1c8a14-8353-4803-afdd-53dcc7b2922e", "comment": "Malware payload (Mirai)", "value": "f8cb31e456c1b94eadb442fc9adefb09af4fe3ed3ec7c0e47b875a6068763709", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436119, "uuid": "8bc04a05-0d43-40a0-9911-cff6f563e7a2", "comment": "Malware payload (Mirai)", "value": "5d332445d22a7dda08a2c8f22f716674804cebb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778436119, "uuid": "db778bd0-ab0f-4058-972a-e81c896a45ff", "comment": "Malware payload (Mirai)", "value": "3388beb2f1e47c1d8b1a1cb051a9e27741d13acdef353e14e721be5c112ee122401a69b15fe45fdd8d9e92f6390a71e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436119, "uuid": "98575459-feb8-4881-9d89-2dbc4a81168f", "value": "T16203F150E5023AE1F73DFDB44918E68D1EF0ABC6B4B10EE3E6C0EF646913A2675085A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436119, "uuid": "0c597d2f-7741-4ab9-9c76-9a96fa9a45d7", "value": "768:i0R6QVu+Mrck4GDNva2QcZuCgZvJosmIJDg870FeMZrhHQ4uVcqgw09Z:LVswgva2PgjhFmMRExrhw4u+qgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778436119, "uuid": "6867715e-3e55-4cff-bd5a-919027cc4456", "value": 40148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778436119, "uuid": "18b03b56-bcda-4d90-a8dc-7e947253f9c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778436119, "uuid": "83e28645-3d97-4418-b7ac-fbb30de4506d", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503706f4-4c8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778430954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430954, "uuid": "8d682abb-21e2-4ac6-a509-65fdf57b4944", "comment": "Malware payload", "value": "8633bd57239c8155eb5b8cb98c07047c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430954, "uuid": "2c2efeb8-b0a8-47e6-a16b-d893ff5a4140", "comment": "Malware payload", "value": "fa4080b2baa6a69aa996036ceada40d6e264805dc08ae8cafd36031a1e58e51e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430954, "uuid": "189974b7-ddb7-44e7-b24b-cd1408b2655b", "comment": "Malware payload", "value": "8d1155d87d3c9decf6be6120643907a1c409dfef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778430954, "uuid": "190b156a-98cd-4f0a-9122-aec9394a6d40", "comment": "Malware payload", "value": "5964fe4a0323aa219a3341492223f4f3d1f306293eeb8315821d83dea8aa40cf5ca5b679334f056150164e768de10458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430954, "uuid": "143a4d9f-f940-4e25-bd15-19cacb38f740", "value": "T14034E081D58A0BD3C3B645703E3511AAA76F0EF548DAECF8BA4A75A20F11FF9119F501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430954, "uuid": "cda74c8d-9a5f-4391-b828-50466c930da8", "value": "3072:8Kayqyf0Xt0/Go7trqBQRxs4LfQudrheyGvJPcx2699sIRAC7VA5d:8KadQoqvJqBQgEQvyGvL6VnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778430954, "uuid": "d24d22c1-4b89-4364-978b-b5fc8cc77b43", "value": 245142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778430954, "uuid": "ef85d14c-bae3-49d4-bd61-2a957ef4bb27", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778430954, "uuid": "b3609087-9948-4ffb-bf92-6f9b61800fc8", "value": "bot.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bff8872-4cc0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778452368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452368, "uuid": "5e77f326-29a1-4e18-b5ef-67ae25f0d68b", "comment": "Malware payload", "value": "4eba7749ab1c56d7a2b5007a5c75658e", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452368, "uuid": "bcf9d885-abe1-47cf-8cfd-02d645d113cc", "comment": "Malware payload", "value": "fb63c9cfcfad8a2e256fc76806a056b8a052f087cc83f5079abe5bdb35cfb99a", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452368, "uuid": "d2859c1d-5e66-44c0-bf33-c76f45e27cf8", "comment": "Malware payload", "value": "b69fcb007ec05dc04dcb13f609d627844b0a7546", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778452368, "uuid": "54971b4a-ad83-47de-afc2-06911e5d1956", "comment": "Malware payload", "value": "9a792c3213de34003107ff8f2c74f4a6981bd1bc059aa8cdba1f7f8b06fadafcb7a59202fc69b7a8d88a4ad5b8a623bc", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452368, "uuid": "c8ea9d53-e31b-460e-978d-ad558eca4b9b", "value": "T190E4E115E7A510F9E177C93CC9674A06EA727C5A07609ADF23900A9A1F3BBE40DFE311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452368, "uuid": "4d3cd678-304a-4c88-9da7-4921bf456663", "value": "4bfc91f3e74bbb889bcf3811fa31cc44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452368, "uuid": "59c5104a-9e2b-4d64-b473-46198e2d7bf1", "value": "12288:o9hZkC3z1s/5p4A32rAN4On1z/3sgxvCOmkr1FIo7ffTD:oz6Cj1OK7AN44/3sWCO71Ftjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778452368, "uuid": "503fe90d-afed-4c3b-a2f7-11031c011fdc", "value": 714752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778452368, "uuid": "b545e77a-ac8b-4319-a914-fd31ccee9d16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778452368, "uuid": "af666140-b7c6-4154-b5c6-0fc346912e4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cef660b-4c78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778421472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421472, "uuid": "8c8dcf28-333d-4412-bc38-ba5ceff5f5a0", "comment": "Malware payload", "value": "59d6c967e4f14e1207adad92e14718a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421472, "uuid": "18d3015f-d0e9-4807-a96a-dedd62a7e3bf", "comment": "Malware payload", "value": "fb6949d2a61e5cbd77922204d7341c3191f610d3fa7961312cedddf284d061e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421472, "uuid": "9ab05f19-2fdf-4ccc-a8a9-535b76216bb8", "comment": "Malware payload", "value": "8993ce66c4e1128936488aab7e2da0056304105a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778421472, "uuid": "13f67726-27c3-4c70-81c5-61094621d33a", "comment": "Malware payload", "value": "4c6c9d4696be93a86791bc6d36f313a4a7df1ccd6d54bd2a17142fd32c7017d2c2b708305294fce40a39540ba66d0199", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421472, "uuid": "9c81f4fe-acf1-4fa2-9236-318d16d5e43e", "value": "T125762A97B8924542C4E43677BCBE81C432630EBA9BC7565B6D05EE383EBE0D90E39744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421472, "uuid": "b608b77e-52fb-4323-8f20-c5aaef343f62", "value": "49152:/1J2CglCuEUBEj+MGd9hjhp5dCf0+qb7mOqLS0P4GFsbm5zvuLq5EmE:90EUBEivd9hjhp5dA4GFsKEgE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778421472, "uuid": "30b02277-c1c6-4c88-8024-45660f6779f5", "value": 7340216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778421472, "uuid": "9050047a-10b4-4d77-b475-11fbb2dc959c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778421472, "uuid": "b388a32c-f0ae-4734-a856-3abef48a285e", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8757ba82-4c2b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778388526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778388526, "uuid": "38567c52-da44-4bf6-8046-e567e28963bf", "comment": "Malware payload", "value": "9450becfb64a7d0fc24a49558f0096e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778388526, "uuid": "d8ee2097-2d65-4a7f-be4e-bf1333d91f0f", "comment": "Malware payload", "value": "fb8233d8b2da9c0cc6e7d08f8d663f679becdaa891a1aedd45dbda7255af0a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778388526, "uuid": "c5d67a8c-677d-4bb9-bbd8-4ec7b2e83a9d", "comment": "Malware payload", "value": "85b4f3a4afc389672a814f23c452fbc2b819030b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778388526, "uuid": "bc898639-668d-4fd2-85c5-ce1a07b2645e", "comment": "Malware payload", "value": "4c9ae6ce53597e74db261768e2ea4b3aefe08f60c3278fd2ba88e115dbb14e8c7108fe40d3ba218c6cfca70ade0666ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778388526, "uuid": "026d064e-282a-47a9-b7c1-18fef6586447", "value": "T12E675B00E9C741F5D9071831A0AB723F23305E068B28DAD7F75C7A6AFB37692193765A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778388526, "uuid": "1d455cb1-d1eb-46e4-9305-ef932c9196c4", "value": "b907ef9063c1389d0f4085822c1ba85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778388526, "uuid": "85257b4e-1d28-43b3-b5e8-c605c889e627", "value": "196608:99k1ANtpX6YP5LLdRK4rtf/V5ffXLnx8mkGO/rXavgfAjowNeHyI:99kKRK4rll8rGmo4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778388526, "uuid": "b79015b4-3dd8-4796-a5e2-335d4871eb40", "value": 31069968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778388526, "uuid": "1f5dbce6-4483-45c2-ada9-b01f4d7cef77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778388526, "uuid": "40c18195-1b67-49d5-b21a-29dd7e652203", "value": "psiphon3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53d7096-4ca2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778439793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439793, "uuid": "9e824b74-ba82-40b9-a4f8-d79126a43d2c", "comment": "Malware payload (Mirai)", "value": "72d205208d4218a4b89dc8b44d4b2663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439793, "uuid": "ede1a6e3-5036-4ca8-9bd4-ad75a52f2b00", "comment": "Malware payload (Mirai)", "value": "fbaf11b516c41262e45e1af198944bec3f6dafb0da426a3eac6cead4320d1113", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439793, "uuid": "bbee7fc5-4075-4f1a-8e3e-4612222351d2", "comment": "Malware payload (Mirai)", "value": "65669a2fb58e32ae13337604aa9c2e89e4fc5ab9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778439793, "uuid": "8a1ba934-22b5-47a6-abff-fe56d35cd19f", "comment": "Malware payload (Mirai)", "value": "b0796db2f33ecb601ce8bf7069605fc53b1e07fb2e0887f228fb8faa76db523d6d1427136950e02df788dc09a8a13594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439793, "uuid": "3d0b2142-6252-430c-b5b1-3b3a86f0ea2d", "value": "T1E69302C307A2F8B18F75FD30D7844716B1E120FD8EF5E0671914E66138892A67FA879A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439793, "uuid": "a47f4810-eb4d-46ad-a291-703a43c5a1ac", "value": "1536:eEoidAfJg5RfwsBu5vRhvwefgs+215V0IL5zbuhQ+VPrTc7QXkROBF0Mj25yKZXo:AJgfuNXvX715V0IL5sdrwcrH07PZXKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778439793, "uuid": "65c5dc61-e5ed-40ae-ab6b-bd80a6b58b02", "value": 97564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778439793, "uuid": "99e2ba76-6cf2-477a-922e-d495c730ecff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778439793, "uuid": "710c9d82-f9bf-4a69-8f69-27d8addae8ee", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d815d27-4c8b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778429687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429687, "uuid": "ab204e2f-2f2b-4d2d-9157-5f5ad21b804a", "comment": "Malware payload", "value": "402a1d2fec5d44955108d8bb97ffe808", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429687, "uuid": "eb4bea3c-c88a-4cc9-8076-bb3596c5481c", "comment": "Malware payload", "value": "fbe854326dc2f8ea5949148f100c75d81d5cf90576be0698ac6ce773f5879f19", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429687, "uuid": "8aa38225-cfc7-4e9e-ad76-69e8e9d96474", "comment": "Malware payload", "value": "4d0ce972c1a7194d8b6c4d9dc0bd272f7709038d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778429687, "uuid": "4bee8ddb-5527-43c8-a590-d1ff5628f20e", "comment": "Malware payload", "value": "553d01626b9d7f7e51b2402a3ed816627952035177d57fedb48dc9060702e100b34342c47452c2c9b1dee90db0395142", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429687, "uuid": "359fc779-fc6f-4085-a571-b0b40fa59764", "value": "T1E5966C0318A60CE4D1E6E235E1675295FB217C4887343BE76ED099A22F3A7D46FB8770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429687, "uuid": "824d85ee-78ad-4504-80d3-1dcfbc6e34e0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429687, "uuid": "b22bdad8-ae6a-49d0-8c63-7668f331d099", "value": "49152:SSQtJEI+18rNGO70UH6a7S5v/m097p68sy5KVp8r49c:Sr66aUbev/b16DuKVp8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778429687, "uuid": "aaeb43a2-7c0b-4c6e-af27-cbea7ec9f98d", "value": 9209472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778429687, "uuid": "2512d26c-f74f-46b4-864d-c7cf7881dca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778429687, "uuid": "4bb40224-0cb1-4269-a988-1749c299827b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d74c0e3-4c13-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778378067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778378067, "uuid": "d930d6bc-2c63-4542-91db-209f1d54a51f", "comment": "Malware payload", "value": "15bf66cc97f7ac13204fe4ff0c443b0a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778378067, "uuid": "e86182d5-edc3-4529-8256-79ae2dd81ee5", "comment": "Malware payload", "value": "fc5065fd93db1ea903ac75a2e383b147beb1234acab258494efbb84191ed872a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778378067, "uuid": "b0342484-dd32-4e51-aa56-971800ff80ec", "comment": "Malware payload", "value": "9c5c638f2196aca5a62d2fc1db4c410d6161fb6e", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778378067, "uuid": "e2d352e1-5ae8-4079-8d08-a5f7dce84313", "comment": "Malware payload", "value": "2fcc726d852e145ef31c0eef09f62589f732169a963b980c80c69abea59e69bf8e5407be5fd3afb6313a7cf400c71a6c", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778378067, "uuid": "ab9ecafa-d4e2-4c71-9990-eea3229a90bd", "value": "T1AAB39E41F2E242F7E6F1053200B6626F9B3662389764ACDBC74C3D529903AD5A73D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778378067, "uuid": "568934a0-942e-4c8d-ab7c-aadee0037c7a", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778378067, "uuid": "7e80973f-1cdb-4445-8365-eb5e46a925b9", "value": "3072:n7DhdC6kzWypvaQ0FxyNTBfV1cWZ8U2X3M3:nBlkZvaF4NTBt1n8Uaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778378067, "uuid": "f1a6dc66-347f-471a-ac9e-20bf7f2cdf89", "value": 114176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778378067, "uuid": "f7c538bd-3b44-4dd7-a9da-af5b1d542e18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778378067, "uuid": "24cb2815-834b-4ea6-8c8a-e6153cd67f48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660b5622-4c7b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1778422830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778422830, "uuid": "b5808b67-ed8c-4039-a2d6-7d8305f8c380", "comment": "Malware payload (QuasarRAT)", "value": "22e5416bce4c473184a53900d4e823ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778422830, "uuid": "232ecf22-0877-4476-bfc0-fff24bae8f79", "comment": "Malware payload (QuasarRAT)", "value": "fcb77ddb165e5b556ae0685e404391b47e510fa50260847c73e8a56e0bd07991", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778422830, "uuid": "8d97528e-d6a6-48d8-a2e4-24662294509d", "comment": "Malware payload (QuasarRAT)", "value": "25494cced94860eecab2f79d59e4f9fb4b5dcde0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778422830, "uuid": "e89eb4d0-8a6b-4e87-b1b5-6d0eeebf1435", "comment": "Malware payload (QuasarRAT)", "value": "55a876372fff1c53a79804464a93f358e87143726021ee41c854085e1c1a82ef4f718bc08c4b8b8faea3728a63c25dc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778422830, "uuid": "c9472e55-9de1-42eb-a799-0b4bc622e81b", "value": "T1D1F5071C27F44E27E1BAE27795B8402257B2E85AB763974F21C1676938F3B4088C3767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778422830, "uuid": "f7b1f239-9254-46ac-9fde-480642912058", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778422830, "uuid": "b1c6a029-ecb1-4be5-b0a8-52b5cd7b0120", "value": "49152:0v1Sd24NaqANxPXljY/7XcfUcOPwRJ6ybR3LoGdxTHHB72eh2NT:0vod24NaqANxPXljY/DcfUcOPwRJ6s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778422830, "uuid": "c2c54cf1-7399-40a3-af07-ad4f006ac557", "value": 3432960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778422830, "uuid": "d7298b54-8fb9-47ea-adc5-d37455666a80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778422830, "uuid": "66df6cd5-63bc-46f5-af24-326901cd772c", "value": "playgamesonline.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979cea49-4c03-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778371373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371373, "uuid": "19edaf60-95a5-4a6e-9eac-f5579e181fc9", "comment": "Malware payload", "value": "9947ad1fb6834b78d5f0069b2624ebde", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371373, "uuid": "cb56b755-2666-46b7-bc6e-71c5b46cad42", "comment": "Malware payload", "value": "fd825ce6bf03690d52a294eac73fa32d70d22bb61c50d03f5498dec18b87e8c5", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371373, "uuid": "35e187cd-204f-4256-baf6-dd685e0ecac2", "comment": "Malware payload", "value": "706fcd9d99fd2cbc5edd7f87910e2f6fc85f658b", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778371373, "uuid": "d40b4302-fa2a-4d5e-a311-6ec6d1f5d067", "comment": "Malware payload", "value": "50a4ce1a994a8656da1a94ee3abcc919d696c959c91e755ba2855d810ebb4fe28d5cefed13d80a3789618572e4edfc52", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "skywalker", "colour": "#5875F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371373, "uuid": "673afc5d-4b85-4a69-ba70-cec46ccc0d51", "value": "T114258D0477F8671BE17E8731C6624C2513F2A09356A1C74F4E86E94E2F67782EE067A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371373, "uuid": "c5413d20-2f86-4827-b7c8-e1c880e08084", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371373, "uuid": "1b5a552a-fff2-44da-b814-8dd1254a05b6", "value": "12288:+wv2qLGTFWgxL/zBVMiBSIQTwa+rHfswZ0uMiBSIQTwa+rHfJs4rLRFWgxLQzB:21zBBBSIQF+rHfI2BSIQF+rHfu4czB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778371373, "uuid": "466bd37c-249e-4873-8cc0-fbeaa1514901", "value": 994816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778371373, "uuid": "d6f8cc72-848f-4f1c-8aa3-dba3cccfce19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778371373, "uuid": "9828f1bc-1524-4d59-8cb3-2f40450c6ed6", "value": "fd825ce6bf03690d52a294eac73fa32d70d22bb61c50d03f5498dec18b87e8c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a505d420-4ca5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1778440974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440974, "uuid": "395cf5d2-28fe-46a5-acfd-f900045122ba", "comment": "Malware payload", "value": "afe3336aa86ebef7e5d7ae3dda001880", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440974, "uuid": "d266c165-4e77-48d8-8087-618baaae0b85", "comment": "Malware payload", "value": "fdbfcfc5c14cacf2bd30a165643eaf36f7f020074c0dff21995e29c456ca7bd6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440974, "uuid": "c4f6983c-04a2-498d-be44-d14407ef5ad5", "comment": "Malware payload", "value": "d14496edb750d6460e92481fcc2f3fe598c0b888", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778440974, "uuid": "a12f3e15-2a3a-4027-90b1-ad0989ab801d", "comment": "Malware payload", "value": "fe8d90fd3968ecfb8f42d9de3700f2d4ab05deba7c73bae88e1620219196619a5583e13ab6ceb611d336d864bb7d92b3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440974, "uuid": "9a4eaff2-ebc7-4b05-8544-8c8216ede7d8", "value": "T126136D6526953C25AE99883B5D7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE218B18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440974, "uuid": "69412ec4-4438-4618-b0bd-9fbcb989a447", "value": "768:bcs9NyXsZztCt9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bZHusZrcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778440974, "uuid": "a7b37e8c-91ef-40c3-9a06-70a7f82d91b4", "value": 45433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778440974, "uuid": "c3adc6b9-458e-4bd9-ba5e-a8a78375a6e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778440974, "uuid": "0ce1e91a-a324-4128-b87f-1dcf74ccfe10", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8e6e8b-4ca0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1778438816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438816, "uuid": "d198ed70-bb66-4dcf-b018-a441c88c9fdd", "comment": "Malware payload (AsyncRAT)", "value": "bfea6226bd69fedd169b72aff4fef114", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438816, "uuid": "5b47ce59-fe5e-45dc-b88f-87b25e6aa785", "comment": "Malware payload (AsyncRAT)", "value": "fe57b1b7f4fa3b1f59eefcea180c45e1e1535b664107be15b40f0f1061f7f253", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438816, "uuid": "73525fb2-81b5-4dfe-a751-a07171cb0d28", "comment": "Malware payload (AsyncRAT)", "value": "0a8879eb2696933b3311dc3bff0d065d2ca4b21b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778438816, "uuid": "cd166f6a-97d1-4fd1-b173-bcf962995598", "comment": "Malware payload (AsyncRAT)", "value": "45f271bbedeae43dbce78f5f59e46bc34477bbfa9c6f1dab90525d2009b43c079c603a978f0897612a680d2878f61f41", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438816, "uuid": "8681cb19-878c-40dd-8e1f-c7da778604d6", "value": "T15C233C003BE9C12BF1BE4F74A9F26145467AF9633A03D94A2CC4619F1633BC696426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438816, "uuid": "aa15c434-5290-4723-bf31-a50a2c3828d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438816, "uuid": "da4f8226-1f0d-4d59-9ca2-d0ca7bb3f800", "value": "768:euG01THwoPNWUtmT1MHmo2qzf5h0tEjEPIgzjbagX3iEI0z1v2yF330ILdBDZ+Y:euG01THb01m2UZtg3bNXSP0hvVL/d+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778438816, "uuid": "4c0c3ff0-869e-48db-bc57-f9e8acd5345c", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778438816, "uuid": "1191e19f-f478-4ed9-8c19-cf46f1b84a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778438816, "uuid": "f97c6a8c-0a57-4df6-867a-73c3d90ece1d", "value": "7zip-ver2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14731767-4cb7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1778448463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448463, "uuid": "06078190-0146-482f-ac46-b2b8b8db8b1b", "comment": "Malware payload (Mirai)", "value": "47e539136e328702412853ad8d1ab794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448463, "uuid": "e6e38673-7156-4c75-8bbc-13efbbf6712f", "comment": "Malware payload (Mirai)", "value": "ff777b82850f6d21fcb1082dbcfed09f49d3c2f362eb0ac0272d0ba45a4c3de4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448463, "uuid": "7efbd582-c33f-4187-a84a-b79373c68dc2", "comment": "Malware payload (Mirai)", "value": "e2bc53182a7be1d6b9ab612d5d96a5b6eaa509f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1778448463, "uuid": "df6ec719-9c00-413d-a022-49e3767cd590", "comment": "Malware payload (Mirai)", "value": "15bc58bbb97afb0ce3af756a7616b63553ce6f05bdff3533b4b389046a4bc8112f976547b9471b09ed81e4b49aeb7446", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448463, "uuid": "70559c3f-edcb-4ac8-b0e3-c4e4b90242e8", "value": "T1F0F2E27350351C60DEF08836C62801C6F76B2B35D1FB363929780AD9D1DC9A772B985B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448463, "uuid": "9549e952-949c-4be2-bace-aaa2c1ec24f9", "value": "768:/ZAb2jdTWDPtuRl/NSeiMBI6CXkmSn/eWxNDPPLRs3UozC:/ZAKjBWDPtuTUuGmmSnWQN7z8zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1778448463, "uuid": "bd9d97ec-0de2-4eef-98b1-8c014c9e5a58", "value": 35556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1778448463, "uuid": "4cedb9bb-57ad-4100-9ad4-1a51c27a5bc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1778448463, "uuid": "aeb1e86d-03d1-4af8-aba5-4907d0bc268e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }