{ "Event": { "published": true, "date": "2025-12-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-12-13", "timestamp": 1765670581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "067a632a-30e3-4834-8ac4-ffcea963b72f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b825328-d87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668558, "uuid": "11aa9cd4-1d52-4e88-a49f-3415d69f0c96", "comment": "Malware payload (Mirai)", "value": "ec1b837d289036a7e1c5399a7067ddd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668558, "uuid": "05c69763-c2bd-4b68-a281-e90bbd5d60ba", "comment": "Malware payload (Mirai)", "value": "0018ea0fe99888c067c33f6fafdfa784cb534fe5cc1f5ad71407132129ad965f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668558, "uuid": "54977a4e-e94b-4d00-8194-bc3cad69b927", "comment": "Malware payload (Mirai)", "value": "2870a6fbf319716f4aa01e599427c10a0cc3e165", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668558, "uuid": "0a66d611-bc72-43af-9067-45ce460d4a2a", "comment": "Malware payload (Mirai)", "value": "9de8455677b3b12844ce726f01356bab9a7e61718054469ea437b84e6606e601c52e707ba036864fb0d8d4eff006b435", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668558, "uuid": "e7918b12-a152-463c-b195-0bebac7ff650", "value": "T1F734D90E6E228F3DFBA9C77457B78E24975923D626E1D584D1ACD2101E2028E741FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668558, "uuid": "e77dd8f2-4a79-4af2-8db2-d50318a3ac21", "value": "6144:IkbloDCXQ9yAl5fqr+qx3J5RUP9rM0gulN:IAocwHlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668558, "uuid": "180b69b2-aac1-4687-b011-a3e90568aafe", "value": 252812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668558, "uuid": "5cb3cc3a-a411-4705-811a-a178cf2f602e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668558, "uuid": "198ccedc-b7a2-455f-b61e-f55428165b7c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86571b72-d815-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765624740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765624740, "uuid": "1758df11-c6fa-45bc-b309-e1e78e2f820f", "comment": "Malware payload", "value": "e942515cfaaa747c3e5cbf74e431b4ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765624740, "uuid": "0fb8558e-cc03-4bd0-b1ed-07fa2f13ca73", "comment": "Malware payload", "value": "00949bc1410a9bd508bfb5fa6723e64292a79557531745247bc9c72359a7d1c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765624740, "uuid": "81d1c421-4763-48f0-bdba-8f12cb4ad2b5", "comment": "Malware payload", "value": "2e4213a12b220345c09c08e45a695569aff49bfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765624740, "uuid": "4a19c387-1bf4-409d-9503-93aa80c210e4", "comment": "Malware payload", "value": "ac88f32694be50cdbb21d5973a789c700e3f3dda22bf875f1ef6830246cf81de3ac6f77503f87d2de42623939f3e72f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765624740, "uuid": "3705f60c-2f4c-4db4-994a-7a72898955d5", "value": "T1F854F9CBF92CC19BC956A971151749B1A362B80CC93146B3BFE01E549EDF7A88C257C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765624740, "uuid": "a3be59f1-8fae-4c21-8616-2d773733c5c9", "value": "30d4a2296427a3e9e9a32d027a29f41f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765624740, "uuid": "b9a9a7f7-eff4-42b4-815e-ea319b486112", "value": "6144:YYFh4jZd3XVVvUGMgQ+Y8uL3DPYsbzihSC:D4jvVRBt2DYsbKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765624740, "uuid": "01b56c6d-bc34-4781-a1af-626bde251cab", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765624740, "uuid": "2f4acb8c-6882-4d9c-9423-894095acd400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765624740, "uuid": "9ffa2a67-594d-4588-a3d2-86454c81eccf", "value": "2 0 2 5 \u5e74 \u7b2c \u4e8c \u5b63 \u5ea6 \u8fdd \u89c4 \u5185 \u804c \u4eba \u5458 \u540d \u5355 \u4fe1 \u606f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945febcb-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613167, "uuid": "40fa2d26-a1bf-4153-acc6-27861a9a540c", "comment": "Malware payload (Mirai)", "value": "e45bf75b1bacc886016802f5c6c53633", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613167, "uuid": "a0886907-b786-484e-ac64-891055b3d8c2", "comment": "Malware payload (Mirai)", "value": "0126fd184fdc6c14b01076292603a003c278751147487050bb38c219f05a33e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613167, "uuid": "76cc75ce-d5ba-48a5-a89f-ce5d3ec57cb4", "comment": "Malware payload (Mirai)", "value": "4f62c59f7232ebb23b49c69c42e5e310cba9e2d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613167, "uuid": "738e2be4-acf8-4960-96b8-05aa2f6d48fb", "comment": "Malware payload (Mirai)", "value": "dad844ad01584b9b4cd82ad65dbbf1f4d7af0d8df9d98f10d62052dc26611f3e9097c3ad34a2c30af0aba0a1adf9ee02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613167, "uuid": "c8d9b3a3-9953-449c-b424-a4c252905c87", "value": "T1E7A2D01572A32D56F2ED1C3DCA6A8357EDA71BFC90F5327669406620C94D20A2E3CA4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613167, "uuid": "485a7205-8a94-46ea-8524-ae93b6e990f2", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjMghymdGUop5ht:vvQn4j+ZO5fKAlxds3UozP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613167, "uuid": "cccb9999-f8bd-43d8-b958-dab8b4842f24", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613167, "uuid": "a988eef0-81d8-429b-9538-9e776771b5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613167, "uuid": "ee16ce18-d813-4c30-af96-403069b1fa5b", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c21dd69-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615623, "uuid": "8dbc6cb7-6597-4bf8-9f8e-4832851b03eb", "comment": "Malware payload (Rhadamanthys)", "value": "721a724fc5694deb2c139b3536266b4b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615623, "uuid": "1c37ac06-07a9-4af7-b5e7-381396a0a593", "comment": "Malware payload (Rhadamanthys)", "value": "01c6bd2d73ea35aa4ae2481f13e6496677349de5c5a97e602c6e9f4f34aeab91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615623, "uuid": "65d96b94-fe21-407c-b8d1-c890829b7cac", "comment": "Malware payload (Rhadamanthys)", "value": "feb2b1769fbd13e48d86d0fba76a9cb494afcd98", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615623, "uuid": "3ebfcab7-121f-4175-b1c4-df842b684b47", "comment": "Malware payload (Rhadamanthys)", "value": "ff3325140967c6be7fd17c10b542617edd1cc49d4941e7f94b37c8d352c2ea19da55b8d4e64efd6ace8888f1fcf6afea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615623, "uuid": "f5cd61ab-b2cb-4761-b6b9-8138550039f3", "value": "T1D1A33AE78B00EFE00B969418EA987DE549AD6D5A5894F703600E7BCD8692B313F385C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615623, "uuid": "b7767fb9-be88-40d5-87bc-33552b206881", "value": "768:GDhd0i7J4sYKgY/CMNfWd1RrXO0rmy9NHcoA674pwDdSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20LrFrmy92oA6kk6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615623, "uuid": "d66d1e80-fe79-4d09-8909-867c3ea46107", "value": 100099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615623, "uuid": "487006a7-390d-45bb-9311-c544a9d7f180", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615623, "uuid": "91842a47-dcaa-490b-be4c-8ba1c5d184f9", "value": "invoice-1637482117.pdf (72).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c5a01b-d84b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765648013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648013, "uuid": "51199223-3827-472c-b366-669d1db85f2c", "comment": "Malware payload", "value": "60ce27c7ee2004f99611ecfb4e36347a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648013, "uuid": "0a707aea-7900-416f-b0ed-5d3ae85b0f12", "comment": "Malware payload", "value": "01dc573ef5281f437fc225ccb0b47e2b5a54802b6f43798137be90ca5ef3ca52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648013, "uuid": "2d6e8f60-49f6-4ddb-ad2b-b210053cfec7", "comment": "Malware payload", "value": "040a2d47a54e09e7dd6db1c9e37633f842de5075", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648013, "uuid": "7af0b3a5-66e9-48d5-8336-54ce3751e3cd", "comment": "Malware payload", "value": "9fa18bbca51db1ca8b0d88e96bc4d102fb2ba5f7e4f3a44c5ed342d41f5b0927888b426ad65a4c9cd97b0fc25a2030ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648013, "uuid": "ead382aa-19b8-4a04-a6bd-7b879ee07d4e", "value": "T1E8461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648013, "uuid": "782c7b2d-3f33-4e00-b930-1464ca020b18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648013, "uuid": "4d9389fa-bcce-40ba-9fab-c84520e70565", "value": "98304:hh/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:hh/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765648013, "uuid": "d031ce1c-ec1a-4d29-9366-e72f89957df5", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765648013, "uuid": "43bbc683-0968-4b46-8859-2014561db25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648013, "uuid": "8219e9de-d0d9-41b0-9b02-3e7a4106ebca", "value": "exodus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c981b25b-d851-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650623, "uuid": "918ebd19-0fe6-458c-a567-d7e9430b0693", "comment": "Malware payload (Mirai)", "value": "87da898052a9496d9962d8a62a35dfb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650623, "uuid": "99939637-ff3d-4b33-8226-7a32366a73e7", "comment": "Malware payload (Mirai)", "value": "03b445261e2863a4fc1b4aa3eaaf6ec454ac351a5f9d6fec809d7e51792eee6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650623, "uuid": "dd51d38b-b889-4d7a-b72e-bf387038a364", "comment": "Malware payload (Mirai)", "value": "374a684f72f53e9e71804cba698ca6a23ef92218", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650623, "uuid": "1e5ac230-7805-4463-b0c2-e2593f670981", "comment": "Malware payload (Mirai)", "value": "22f8a431f36a4f5028eca14027b122bcb50ff9e726b02bad4d4535b2c29901c9eefdf3700d399bc77c3fb91b652fada8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650623, "uuid": "7955f642-febb-4ef5-82d1-880c30e1300d", "value": "T191F39E33E4397A98C040D634B0F49E794B7264D041971EFB2AE5C6BA40CBDA9F60A7F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650623, "uuid": "532af402-72c9-4dc9-8a69-ad48c510381a", "value": "3072:B/SWh0nZCTZILmvgTB2vKJDI8EaEv7Aw7tGeq9UW3:BaWW0TZvvKJDIurCGeqqW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650623, "uuid": "fa25554e-b82b-4e32-9d73-eb847e7a2043", "value": 157512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650623, "uuid": "c98351f4-4218-45c7-bd50-5dc1bf2393a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650623, "uuid": "3b549c7d-b6f6-411e-a4c3-c1cdb4b8cc8a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6daf0b-d81b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765627356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627356, "uuid": "da74c062-08a4-471a-9cf7-04a207f614cf", "comment": "Malware payload (Mirai)", "value": "771f588fe8c73dbc1ca88c4aefccc3dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627356, "uuid": "0f0bda91-2287-4cf1-a00d-a1f34b1b99ce", "comment": "Malware payload (Mirai)", "value": "04ed4a545f9e8c61e51d0a24bb1ee4dea02832f546facf0e1ef045d13b566458", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627356, "uuid": "b399f120-1bb6-434e-b954-87d7124e6c52", "comment": "Malware payload (Mirai)", "value": "a2fe6730232a78ab813c4a458b39df0c138f06cb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627356, "uuid": "34745bbc-47a6-4d5d-880f-927918e34381", "comment": "Malware payload (Mirai)", "value": "99fa50879f47f76fb7280f43e21b154bad052ddd09cdce06194ac4693ef5cc6d6dacbfc153d9f9f09201d642701239c0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627356, "uuid": "7b5f94d9-2239-4996-a3cb-644aa240996d", "value": "T1B34144E9192092347C6A9F977A68441DF3A4B896F5D5AF03ECE528FCC4CFF243068942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627356, "uuid": "3d1769e3-54e5-460e-876f-ee2cdbb1dbf3", "value": "24:vKU2vKXAzvKqfVTK/vK83SLRvKlEvKkftgvKX8vK5+vKIGvKSg3u0:vqDHxKnroFVCHNgO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627356, "uuid": "c29beaee-795c-4029-8a0f-56e1d5ef2dfa", "value": 2003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627356, "uuid": "52010178-4d94-4b99-b2c0-75d6438e0fce", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627356, "uuid": "c1fd6c4c-b90c-41db-8543-f3818fcdbbc4", "value": "Mercury.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3660a92a-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615587, "uuid": "23cc266b-6cb5-4d7a-b74e-7b925bf24335", "comment": "Malware payload (Rhadamanthys)", "value": "8d183db5eb061258a8a0c97a77395a01", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615587, "uuid": "aa1076a4-43ae-42f5-9791-43912f5b7ee4", "comment": "Malware payload (Rhadamanthys)", "value": "053bea03bdaabeee83e33b4ad4888a5d4b6f8be21fc39d5a64873c011c2c3687", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615587, "uuid": "e2291f4e-1b9f-4d0b-b106-c1c44981a6aa", "comment": "Malware payload (Rhadamanthys)", "value": "4dd805400c3d9564335a9615a2b4fd313826c4d9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615587, "uuid": "f50eddf6-1486-4682-a908-65746aadcca8", "comment": "Malware payload (Rhadamanthys)", "value": "36f73e2bc770ddbe6d6f84c3dedfec99d5078ce0e293c0e2e752774e268b932e245fcdef794356e531b2930c9f5fb60b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615587, "uuid": "8fdb1421-7664-4974-b646-69129d62edb3", "value": "T1FBA32A4C3C75ADA359A7AFC9B91F49ED92598CF0E5CAD521130EE3F200FD4185CB898A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615587, "uuid": "1db5c448-a7ee-48bb-a91f-6f9d6ea29365", "value": "1536:GDB7eKg20ArPrwsaWaHlAzziI6BkQWJ+aY:GDB7b0iD7LaH2ziI6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615587, "uuid": "05ffcb5c-ef73-4e24-bcc7-bf045d7524fd", "value": 102642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615587, "uuid": "32174a0f-fd44-4d65-bbd9-d5d24dd21b74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615587, "uuid": "bea60058-7b1c-4e76-b3b7-7de15e2de73d", "value": "invoice-1637482117.pdf (81).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351088cc-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605277, "uuid": "9b38a1ea-6bfe-4c1d-b849-a0b4e7dabef6", "comment": "Malware payload", "value": "d9ee6dfaa1fbe70531f462c345681d37", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605277, "uuid": "a7d300d3-1e84-413e-8153-23217cec1a5f", "comment": "Malware payload", "value": "06304ec207779cc65e5c3dc82a1d1f5e84a1a3fe2a6545e489e8d15343846848", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605277, "uuid": "a3dea58b-b0b2-4f8a-a8c9-66d21bafa389", "comment": "Malware payload", "value": "f5f4f0917c8cd1905baccf9be0281f5718fc1cf0", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605277, "uuid": "1a40087a-8a30-4308-9696-9aded603f871", "comment": "Malware payload", "value": "35faced5f6bca78aeabc0cd26180571b48ba0ce3bc737a15529a774075455d6d607f904c46af4e5f7b103d60357d35e0", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605277, "uuid": "e776a7ac-1a19-4bf2-8e61-b67845aba9e9", "value": "T1CA942A63E3982804CBB886F58B599358BA35FB5C1370437B7B5062E6ADF63540E1BF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605277, "uuid": "53055a2a-29dc-4330-ac29-a2d050216347", "value": "6144:z4QZVhf5x8vGrq0x5XTQOJrnVpUtGixECiusL:c+hf5x8er39TQwTOGixECiusL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605277, "uuid": "023bb641-102c-4935-8962-7fa8b5f6defd", "value": 447280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605277, "uuid": "a3b4ddc7-bdd6-451c-b7dc-150905a84377", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605277, "uuid": "b343f967-8f8f-4579-80be-8755e7e7a852", "value": "06304ec207779cc65e5c3dc82a1d1f5e84a1a3fe2a6545e489e8d15343846848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a183bc-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615775, "uuid": "fb8d1bec-ca95-4fd0-8fad-970641ed04bc", "comment": "Malware payload (Rhadamanthys)", "value": "e9e0a3dd15eb1b3a9ce4e3a398eff04c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615775, "uuid": "7f88c5af-560e-4c42-b5e3-ccd7ef40a6f4", "comment": "Malware payload (Rhadamanthys)", "value": "063e94a6b4c335b242facfa72daa7093d1215052b116ac0f2ce3175a6f8e439d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615775, "uuid": "3412d90b-1e39-43de-a121-c95423f73ee7", "comment": "Malware payload (Rhadamanthys)", "value": "c726fa8a74c576623169527b486d97cca863e6d0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615775, "uuid": "ff2bdcbf-622e-4907-93bf-4acc6f31e526", "comment": "Malware payload (Rhadamanthys)", "value": "15dab7c131321eb2d98c685df2af7cd1ebab5037dad4f6d05859a88fbd074c6f5b8bd1101e80d70cc95e0d1b5c9e33ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615775, "uuid": "6902cbde-3416-4104-b339-dafc02b9660b", "value": "T15EA3190167370A6429A63BFF3E83A2B5C1AFC37E40C521755C1DA38061EEF967D2758A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615775, "uuid": "d1bfb5ee-588c-4677-a67b-07cfb70186ed", "value": "768:GDhd0i7J4sYKgY/CMNfWdDGMaXtwrXuIrOceeHYVAP1AoSLAuAAroQW+FF+Ec+0G:GDB7eKg20RrDrOceVVAPCo6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615775, "uuid": "55df1d58-659a-4b0e-af66-73f680a6da00", "value": 101351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615775, "uuid": "3bebddf7-f502-44df-a207-ec087ee29cbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615775, "uuid": "bf93d112-830c-42f8-9bd9-fbecc42a0cea", "value": "invoice-1637482117.pdf (44).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e269fa6d-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615875, "uuid": "0875b1c1-c14b-4e43-a641-7178c2c090e6", "comment": "Malware payload (Rhadamanthys)", "value": "78d0e2a4b93d895176b39f55123e4d4b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615875, "uuid": "f887912b-8ff2-4c8c-98b3-bd50041e584f", "comment": "Malware payload (Rhadamanthys)", "value": "06b1fc2c0af3304aed7ff6d179bca908d687e251a25965bd29fbf5c941220b9e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615875, "uuid": "1f093bfa-cea9-4f2d-9f2c-de1594618705", "comment": "Malware payload (Rhadamanthys)", "value": "6935ccfb92552cdfa60e31094508b9fd26c0d4e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615875, "uuid": "ab477930-68fc-4b02-9b78-ee34c9d641ee", "comment": "Malware payload (Rhadamanthys)", "value": "2c4d8f7b3e639e207571bb5b2cbf6c7de6b0d734347e354c5f2a5a77f16795d34d9be3e7aa07db610b553340441645e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615875, "uuid": "d01a43b3-370e-4924-9252-fd3f75306183", "value": "T1DFA31B810A62AD680C459561ACD0BE72ACDACC097047B1E479CFFB71A0F89EFD8D564B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615875, "uuid": "5995376e-4f63-469d-aeff-48f9712ae447", "value": "768:GDhd0i7J4sYKgY/CMNfWdKy5NrXeir64iIH6nAfZyBkSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20Jrjr64iDnAfg26BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615875, "uuid": "db47905e-ed58-439c-9c52-9134cfce28dc", "value": 98092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615875, "uuid": "1012b988-4b5b-4f80-b735-740f81c1e6c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615875, "uuid": "389e54a5-a59d-4d17-8795-0831430dbbfe", "value": "invoice-1637482117.pdf (19).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23802a7-d869-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765660945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660945, "uuid": "2562ef5d-464c-478b-b88e-6bc338ea44db", "comment": "Malware payload (Mirai)", "value": "e906b6b1c8a6e1f78d8b43cdcaec4b60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660945, "uuid": "0364ec95-4522-4f1c-b00e-6bfa7030862c", "comment": "Malware payload (Mirai)", "value": "06bf95ec99d819c1269bf4475ade88aae8329b85767bd6bf3d70a5e7fc45288b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660945, "uuid": "30b5bfca-7b61-45ad-af03-79b1a4d447fa", "comment": "Malware payload (Mirai)", "value": "373913b577384dfdd65c73f6edb85e594bd59e98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660945, "uuid": "f593ddcc-e787-4c48-81a2-c32a192621fd", "comment": "Malware payload (Mirai)", "value": "273eb707755468e99a94de6a40cbcfb174cf201a3ff31bd06123184697b110fd646322c05f2fa53cff3fe021b5031647", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660945, "uuid": "647f6eb5-a79d-4a6f-b606-280d6d166fbd", "value": "T1C2A3F80A7B640FF7DC5FCC3B49B94B4525CD560B22A82B763934E818F25B25F1AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660945, "uuid": "bd3a5e45-dee3-47bc-bea6-b3e3d97ed0f4", "value": "1536:bPs5S3ve94Py/w2I7dR7nFA+c9cFNoYel9P+tgGLzogjMBcGPnv8VR:bkuveSPyyvBpDIlcOnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765660945, "uuid": "9905cf4d-fc2e-4ab6-aa9b-3bb291ccc622", "value": 105336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765660945, "uuid": "750e9b0b-4619-426d-b29e-e0d63557f29b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660945, "uuid": "cdf096b0-7627-479f-9e61-c682499a7bb3", "value": "jklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1815f20b-d824-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765630998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630998, "uuid": "f29bbb73-25cd-4993-b362-04dc0f0a175d", "comment": "Malware payload", "value": "759c31a8e6d8b3b6e4567c0da2cf9237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630998, "uuid": "c743e8b6-0a40-489d-8f25-57a7071d8367", "comment": "Malware payload", "value": "06cc5e667fba4e39dfd4ca71661273a4506d3c268a7e6ab0e8c122a7151244ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630998, "uuid": "385dbc4a-0380-4c15-99e3-15e70550d887", "comment": "Malware payload", "value": "a484b801b1893fb12267ef4a8756a5869be99618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630998, "uuid": "3b3877b7-e7d4-4c1d-bc40-d5c1f040c094", "comment": "Malware payload", "value": "bd5d0fd692020d2d400cc06c5e33b6071896dc11f9e7a2ca89518e8f45bc2d9b765d890855e7c3a2dd85cad39f193f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630998, "uuid": "6d8886d0-fa8b-462b-8147-460cd0072f6b", "value": "T15016339A4485352DB6113D31E36EFAD069223863AB9274B44C0BC9E58373DE3D6E3B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630998, "uuid": "7ef57e87-2e1f-49df-acfa-b235d6e240c2", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630998, "uuid": "05b11caf-465c-467d-9cba-6b1b3680745b", "value": "98304:Fpyd3KuO+HhttcPHWasq9EBrdydAqDJu6iqtQ1N8U6q2+Q92sQQ159kCCUdJRTIN:Fpq3j33QWyEBQdAUJuOa1yUV2F92sv1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765630998, "uuid": "035c7463-e48d-4ff0-b760-58fff13cfeb6", "value": 4134912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765630998, "uuid": "343fb5dc-548c-4a70-8005-f48e7d551a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630998, "uuid": "2c440bdd-fba4-48fd-940f-a46c4285a3ff", "value": "SecuriteInfo.com.Trojan.Siggen31.32766.7260.16738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c109cf46-d87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669077, "uuid": "f5ee90e7-96e9-4940-bbe4-65d6f377bc6d", "comment": "Malware payload (Mirai)", "value": "e8327b3a571bffb421ecb971b9a315f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669077, "uuid": "f7b777ce-795f-4502-bf2f-5de12d0dcd1f", "comment": "Malware payload (Mirai)", "value": "070d543bc5792f1f1d3831269640d2c2ff8e2c50ecd59b3de01160fde3c23dd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669077, "uuid": "2829eae3-1bbc-4a5e-aab9-d50c925ccbba", "comment": "Malware payload (Mirai)", "value": "cb02d34c60fb9e3f6962ffeb74a4092ccfe67501", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669077, "uuid": "c1058770-651c-4373-a31e-e482010beb4b", "comment": "Malware payload (Mirai)", "value": "1101a05c928eb55799c8ed3955fc39ba4e2a6ede71b4adca57a0012018ffcff4ee07e2206dc8ae888b5d611df2adac6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669077, "uuid": "0f75c824-3abd-4a25-ac68-f1955af738d8", "value": "T111146E96F801DD7DF80AE6BB44674E1DFA30D39121831B2A6297FDA3AD311960D17EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669077, "uuid": "d4b9ede3-9384-49c1-a0b6-0b722b255c72", "value": "3072:IwBuY2IpxLArxM37VOvJTg4PTgOpkbPPyfFKTpnMCs2WRI9NtnUHeuX:ZB9/LArxeBO+4vyTyfQTpnMbi9NtUHe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669077, "uuid": "5f14da45-2532-4d14-927d-399763ebbc8b", "value": 190912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669077, "uuid": "79c8198c-d302-4ac5-9a81-39fa10f16549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669077, "uuid": "d07ee631-fba3-476b-8e1c-13a53283a6ee", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d43b90-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615502, "uuid": "64e9a9af-d1d5-49c5-9130-b33ed9603263", "comment": "Malware payload (Rhadamanthys)", "value": "9a3cee52caf856f627aa5f92c14dd136", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615502, "uuid": "4a3acac2-7f51-4d79-bc45-dda4021bf0b9", "comment": "Malware payload (Rhadamanthys)", "value": "080c6f4999d14c56d71a74f8fca9c99d02ef77a6d335aea6703a824a4316d38a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615502, "uuid": "3f56d2d1-5e8c-4130-bf03-0a08e47f2958", "comment": "Malware payload (Rhadamanthys)", "value": "8b6e14e32f3d4273d15ecfa2e56f6700d12b306c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615502, "uuid": "b27c43ff-f513-43f5-88b3-8255ee2169a3", "comment": "Malware payload (Rhadamanthys)", "value": "c7a7f18d5b2b794132b61e81dd73bc08671a6260078cbdae9758f515bd8fd6e91e6942160a328ec8c89f6ee8b22bbd35", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615502, "uuid": "79c4dfd3-aa60-4019-a8f3-a50e789350fc", "value": "T1E2A3F7310F61B4D92B46E0F34FA4ADF8DCFE19E168D22029B50772365D6654E2F82AF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615502, "uuid": "f05e7e90-20e3-4667-b388-9ef9611f8b5a", "value": "1536:GDB7eKg20TqEQerDraDVlJAvDM6BkQWJ+aY:GDB7b0TqEQE/gPEDM6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615502, "uuid": "a1ad99cb-98df-4989-bcce-f9ea50802517", "value": 106032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615502, "uuid": "850e3ec4-f826-4158-bb1c-9f2eab7c87e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615502, "uuid": "d9fc6cfe-0ecc-4dcb-86df-467f2c13d81f", "value": "invoice-1637482117.pdf (98).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9990a9ac-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667293, "uuid": "fc381134-eb71-4fcc-b52a-cead065f9418", "comment": "Malware payload (Mirai)", "value": "87a3804d26fb10332955d3bf0ca5eaf9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667293, "uuid": "b7fb0f7b-1c01-490d-8958-3fc27b3d540b", "comment": "Malware payload (Mirai)", "value": "0862d6f685ef7a1f5a9df0ffd0e9e4581519a195951512e7b8b46a2e7aab7191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667293, "uuid": "9d6bc040-7fcb-4a99-9ba6-ef7e2941e8db", "comment": "Malware payload (Mirai)", "value": "83aee420bf500871a00d6ac6686d09c0894ff887", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667293, "uuid": "8ca5457c-ab1f-469a-a43f-5278364e384d", "comment": "Malware payload (Mirai)", "value": "2e39054e2cb8c267f923565a38a82c85de765cf453ea31792feac03dd196a6ebb14138e4e93d2e1d523e13a53caa2cf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667293, "uuid": "55f6ec83-d27c-48a0-8d3b-3046bc3bff6a", "value": "T10E93D61B6F62DF7DF769823587B78E31A78823823BE0D645D16CE9005E6034D642FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667293, "uuid": "7ad43aad-02ed-44c6-b854-9e379c11fbb7", "value": "1536:kXZ0YS6m6ZC1YpRNiRRXC0aCbCCiYCCC2pMLn4HQHPxnv8VRt:ZYXm6k9XCoMnrPxnv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667293, "uuid": "44fd2260-8059-4305-b77b-083139497b78", "value": 94084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667293, "uuid": "614f0900-00ca-4764-a6fd-db81308c1212", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667293, "uuid": "340688e9-0fe8-41ac-8946-7d7d5a8c4e00", "value": "nklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc507ead-d864-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765658761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658761, "uuid": "91d39661-3e87-4969-9d11-2f41f810c69a", "comment": "Malware payload (Mirai)", "value": "d6422289a257ece1411190a8e622006b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658761, "uuid": "326af4a5-cde1-4c49-a6d9-4d4af6a72bbe", "comment": "Malware payload (Mirai)", "value": "08b9f443dc2cc6fd6debceac1c235c5fc67219cbc908b5671cb0de0d593175e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658761, "uuid": "8f8979ae-06f7-45bb-bd04-6e4f5ab3a650", "comment": "Malware payload (Mirai)", "value": "eccf46013047ac4d1c46a5e2a98e72c8ae4122ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658761, "uuid": "aa071534-eb6e-4e86-ad47-3d23281aa769", "comment": "Malware payload (Mirai)", "value": "fe8ec072842ce21874b1cc54d3ca0d812a3d92c05f952497cce124735be5731ca87c5b638c2b14ebc898b44a1483d3cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765658761, "uuid": "b1dd7b0a-78fb-4a66-a267-e9a5e28de0d4", "value": "T19F734A22797A2E3BC4C5687F21B34734F1F6274A35A8C75ABD720E5DFB20A402117AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765658761, "uuid": "460b838b-06a7-432c-90d8-634c08f02c3a", "value": "1536:2jH2vSMX8M3nb2AghGlfgoZdVW1JUXqswkZE/21/YDUtH/Muhm:BqkXb24b/fy2hhH/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765658761, "uuid": "c7676827-f439-4720-8bb8-d45f7b59f9dd", "value": 76028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765658761, "uuid": "42d73306-d241-4a9e-b630-fd77b05398ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765658761, "uuid": "549d64a1-b903-49d1-81bf-eb92b8563b5c", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0745d062-d87e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669624, "uuid": "65830bcc-b2d8-4e24-b067-4398e29128c5", "comment": "Malware payload (Mirai)", "value": "bf2ee260c95591370a214dda50b4830d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669624, "uuid": "e657bb7d-38f3-4b26-a495-da489aa0d4e8", "comment": "Malware payload (Mirai)", "value": "096cdee18aa1a5f1d6f608993991dc96ec3014cfd89a85e3cb1e05be347de062", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669624, "uuid": "5b19e61b-14b4-4383-bd9b-ec94cce0e7b9", "comment": "Malware payload (Mirai)", "value": "8bdacd17318dfa4bab177c7cfc6f91b970b4d964", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669624, "uuid": "2412446d-ed6a-49ae-8ba0-c35b025c8669", "comment": "Malware payload (Mirai)", "value": "5a684ea6ca1023c91307d476746f5c1af62de6df6e799507d92994facd8d87a9ca234fa4a7b938301e2be83654208484", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669624, "uuid": "b7e289b8-e7b8-4a60-ba89-a82deb20125a", "value": "T129D35BC1F613D5F5DD460170213BF7379A32B4B6513BEA87D368AB32AC92A91C5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669624, "uuid": "7eb533f8-8c16-4ff9-882b-cb1a8132d374", "value": "3072:Wm/0JR/5zYH5YtOgXugV23+U+eLB+ed0+dVpBUf2+atR5gSU7y:1/0X/5UH5Yt3XHV23+UcIdQ2PX5g57y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669624, "uuid": "980667e0-8a03-41fa-9da5-aed6cd6128dd", "value": 137860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669624, "uuid": "32125e19-e3c3-4d80-be70-ae7d8e07498c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669624, "uuid": "d5b117b0-b7d1-4819-9b97-e723ddf9cbc9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040cff61-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639125, "uuid": "8a4ec169-0ff5-4ca6-b0e0-4dd46f697a9b", "comment": "Malware payload (Mirai)", "value": "6ad7a11c3e1647588a5b6fc73ca4b772", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639125, "uuid": "b7d62172-5af7-4009-a509-2261882266bf", "comment": "Malware payload (Mirai)", "value": "0a60f6e578b0aa87aa3bc546f026cb4572680f9d796a4f129e1f98e3e81e9e03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639125, "uuid": "48895353-8f17-4a7e-bcfe-03fe4dd14876", "comment": "Malware payload (Mirai)", "value": "83219da5b7819a8fa3cf59343748fa43652e3962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639125, "uuid": "5a89eac6-3be8-4e34-9983-4617833ac827", "comment": "Malware payload (Mirai)", "value": "512e1d168d3b5ba33e10fc05c9f0ab188e3673c6f674d20ed82f173bf41121541b269ca16bcf0768a84ef08e397847ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639125, "uuid": "9a64a1bc-217d-4227-90d7-daf3be520602", "value": "T1FBD33951B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639125, "uuid": "aa1add69-6849-4f3e-9996-dbb507ba2a48", "value": "3072:JuVeGJFWOgt9ctajH1I7s741o+YLyXzXgvo:JuVwt9cUH1I7s7MeLmLgvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639125, "uuid": "020c1c57-13e7-4c0e-b552-1a8c89a15bac", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639125, "uuid": "47f1aeb7-c2d0-4d1a-b46b-9fec7aacbba3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639125, "uuid": "54a2eac3-d444-4de8-9d3e-e38b498a29cb", "value": "frost.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4f0bab-d86e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765662954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662954, "uuid": "f8d61635-8e9b-4b53-ad46-ee789bbefb00", "comment": "Malware payload (Mirai)", "value": "4a947ff0ff793f7a7f7586d96edbfecb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662954, "uuid": "b2f2c6ad-03dc-423e-af92-f2129fd04df9", "comment": "Malware payload (Mirai)", "value": "0aa5ee09aacde092639f9851b468ce26b431e4950ce0014bb30eb0f1bd60f128", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662954, "uuid": "97e0623b-8b20-440f-a848-549099a69998", "comment": "Malware payload (Mirai)", "value": "f8f9e88f5fae80a2dc0ade9dccb6b177cf48b0c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662954, "uuid": "3fbe527c-0013-45b5-b733-df421db163bd", "comment": "Malware payload (Mirai)", "value": "1b22c469ba41828db8f9a608241945b98d765816eb8f4f6f3b3f504740ebae2f458a5c69da4901f1f6c4ad312d8a22d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662954, "uuid": "028c1cd3-6ec3-442f-8821-c8f18ecec852", "value": "T19663D509BF610FB7EC6BCD374AB91B0524CD550A31A93B397E30D918F25B26B19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662954, "uuid": "b4d854e5-58cf-4124-ad2c-d1f7127891c9", "value": "1536:7dQExOGZQEn7iGuz3sClzRSqYIqfv7un:7+FGZQ4toH+un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765662954, "uuid": "d0bb8672-b97b-4665-940b-07bfdd39f2a9", "value": 67648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765662954, "uuid": "e77d7b54-e271-428a-9589-bdbcc92510ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662954, "uuid": "95e4809c-d6f7-4f6c-bfbe-3c20e58b9b41", "value": "zermpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d63be77-d7e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765602284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602284, "uuid": "82bd991a-1254-4603-897e-f7abe50611ff", "comment": "Malware payload (Mirai)", "value": "b8dcbffa10a4168568cbee10c9ce7449", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602284, "uuid": "2a89e6f8-d986-425b-bb0e-2e15d1c6c2c5", "comment": "Malware payload (Mirai)", "value": "0b5332744acadf605a7ca8099019a770c3f389d06282b6a94a49106926bc3537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602284, "uuid": "018b30b7-7c3b-4e94-97ec-12041c41182b", "comment": "Malware payload (Mirai)", "value": "9fb2493f2089e8d0080277d89dd854ec23daa676", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602284, "uuid": "0ce9afe0-ca7e-495c-be35-e2ca15e9db77", "comment": "Malware payload (Mirai)", "value": "62c2bee8d1aec0affd6dff2153446051de05ee5b5666486f3e49e6a1058fd3fe2f1a0152226b80b5c10dfccd0e46ddeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602284, "uuid": "9fd93185-9662-4800-8550-ca8d1ef7eba9", "value": "T12EE32903F54084FEC589C134177FB63BE932B1AE1239B6A77BD4EB11294EE215E2D984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602284, "uuid": "b4594ef8-2acc-4df7-a811-208fe9cb97f9", "value": "3072:p590XqdKplt6nTRXu1MV9cPJ1vOdPkf2AURnyNfcR7W12RLz2GuacPxDIfs0dE2g:r90XqdKplt6nTRe1MV9cPJ1vOdPwFcYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765602284, "uuid": "5f5323cb-e0ce-4a23-82f8-8e3e3dc293ec", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765602284, "uuid": "1b013aaf-2109-4f9b-9e45-65d7e58e2222", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602284, "uuid": "16f06de0-c1b7-47b4-bfd1-4f517910e3a5", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7d697d-d877-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765666625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666625, "uuid": "3624c8d0-4916-4d73-b704-8fc7914dad91", "comment": "Malware payload", "value": "b0e6853cb1094abbaffda31e9924e406", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666625, "uuid": "9f2398ff-c443-4c3f-b811-2f17f5c62e35", "comment": "Malware payload", "value": "0b7ebbb6e65892ff7434ef2cca5f60a8d0df8a8d0250ebd2dcde0d5af596f954", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666625, "uuid": "b8eb92dd-56cd-455c-b708-e6abcde1dae0", "comment": "Malware payload", "value": "d2b822bcddaf8e7349a7f9e8b14854c65f03ee8c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666625, "uuid": "022f498a-b7d7-4553-a96f-03461baad272", "comment": "Malware payload", "value": "f15ec529f725916cf90a936e77c8fc831b0b0f4383ec41b4d13686a08eaef71e0a8042f93435b417d2a8d2d9777bfeb6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666625, "uuid": "79db1c2b-b3bc-4f63-b1ea-8e7dc86e7966", "value": "T1ADE533DB5C019748C469C935ABE0FAB9A9917DE2FCA6444022E3DC437F3905AF41EE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666625, "uuid": "259cd27c-278b-4c70-a1b8-8f09a868e012", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666625, "uuid": "05a85c04-d1d6-487e-a0d6-31bffd1173cb", "value": "49152:7mggV4hU6MD3osQYk8Q/PHahNq/+BEX3md0kcP/A0MQTibvABArSMnPC2dzZ0:7XgyS6MMmkj/f5+aGcGL0yP1z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666625, "uuid": "c6d994e1-6407-4c90-ae91-458763507bbb", "value": 3289600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666625, "uuid": "bdbd7657-f5fb-424c-bad2-0031bc485db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666625, "uuid": "7d4fcf6f-fade-486a-a439-937bf7cb2e33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abea294a-d870-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765663888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663888, "uuid": "0230c007-450e-43a2-8db9-c2d3af5ec5ec", "comment": "Malware payload (Mirai)", "value": "b81f9afd5e6be6a2358f73a3fbbeac20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663888, "uuid": "bce37be3-8238-4289-ad61-6a79b12e5a55", "comment": "Malware payload (Mirai)", "value": "0b83c706b6cd311f83cce72c0e533711a1477e03b6e89b9aece9313d5742c22f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663888, "uuid": "e2f748aa-27c8-4a66-ba98-2e4d8ac7eece", "comment": "Malware payload (Mirai)", "value": "cfc13c65e617e46f261c66cf3fb75962d0deec1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663888, "uuid": "623f740f-9036-4930-a0c3-538b810050c7", "comment": "Malware payload (Mirai)", "value": "0f8823107adc8f42159733a3081e94ba1cdecd64b15dd981b94e5271177cf50ed0e5e0428e4f37070917e0fbf02554cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663888, "uuid": "7e35e9f6-333e-4dc0-a5ee-0712b0e3c57a", "value": "T137539E66C8A99D54C54C42B5BC708E740F13B100E6A72FFB6E49D9AA4043DACFA0E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663888, "uuid": "378adb17-8d33-4eee-b05e-c67abfd9c6e7", "value": "1536:+azwtKDSI5dOSkfg6O8iQsHeeOtSUBGzvC+G1tNnv8VR:+wV5Tl37eXJBGzvjEbnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765663888, "uuid": "2d6d7bd7-dfb2-4c1a-998a-c9a9bf44f0ce", "value": 65364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765663888, "uuid": "8483c57b-1e85-42f5-aead-32dd5bd8269a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663888, "uuid": "1978eb42-83f3-4196-a4ca-8a18e0c2ee08", "value": "nklsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567c8408-d873-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765665033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665033, "uuid": "256747d0-cc1a-476d-9ab8-f5f8bb968c16", "comment": "Malware payload (Mirai)", "value": "01c3429333e18ce885e81cb195f2db43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665033, "uuid": "bd831062-4f6f-4be1-9e6f-ed996118f0f6", "comment": "Malware payload (Mirai)", "value": "0b9d396bec97510c21c1ee1873c9f1c3d34f9f2cddd6c53cdc2003a3d5267a60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665033, "uuid": "619b59b9-2451-4c94-8995-c7b51ca7ccc2", "comment": "Malware payload (Mirai)", "value": "145aa6d593d773114b5957fde004822191901115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665033, "uuid": "db0d3c1e-0315-4f26-af18-6a0b3af48607", "comment": "Malware payload (Mirai)", "value": "3ca9e61f9835aa72caa1ff4f86334b56b102b5cfb2e99ec6b90b6d6db2258cd4ca926a35ad46fe2ce54926d34756ee39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665033, "uuid": "2c9da22b-70f9-4d70-ad0e-21264950addc", "value": "T10143F886B851CA56C5C565BBFF0F83DC372613A8D1EB73039E14AB643A4B82B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665033, "uuid": "89e9922e-209c-4279-96a4-ccc962e71885", "value": "768:f2vt8Eym1anAW36MokrDbDO/AKeNurewqWXLvvR5iPlWLr8PjCdtcnv8VR:u18gk8krfDO/nr3nR0ZjKcnv8VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765665033, "uuid": "514857b4-47a8-4fe1-9dc3-e64e89a1d821", "value": 57036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765665033, "uuid": "f4dc6f31-494e-4ae0-bb9b-7ee861d9e711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665033, "uuid": "6c5c2ec6-29ad-47a2-9e57-cf2ea834169d", "value": "nabarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7750c46a-d7ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Rekoobe)", "timestamp": 1765607535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607535, "uuid": "26523551-6ddf-443e-a4ed-8dc142051da3", "comment": "Malware payload (Rekoobe)", "value": "e370c0a29ff9c917b63627e3f7b719d7", "object_relation": "md5", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607535, "uuid": "baaa0425-12a4-4f0f-8df9-e0f839de86bb", "comment": "Malware payload (Rekoobe)", "value": "0bc65a55a84d1b2e2a320d2b011186a14f9074d6d28ff9120cb24fcc03c3f696", "object_relation": "sha256", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607535, "uuid": "e1dda3d5-33b3-49fd-a2c2-0065f55715b8", "comment": "Malware payload (Rekoobe)", "value": "d97e8504b62caaea3611f423729ce88fc71b4f3d", "object_relation": "sha1", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607535, "uuid": "a8e67fe1-a7cd-4612-86f8-306d78bc894d", "comment": "Malware payload (Rekoobe)", "value": "a61ec97dae728ea151ee84e891dddfba82a15828da3c5e48eb0687088b825cae9e393fb746dcae44cb841f64d4129091", "object_relation": "sha3-384", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607535, "uuid": "3e8c32a7-299d-4ac8-877f-7c185c0a582d", "value": "T1FD836C43B6668DBFC859C2304F0FA436A873BD58EF66321B34405B64392FB192F29765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607535, "uuid": "394dfc74-b285-4932-a142-5c9fda72575c", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607535, "uuid": "76219959-2224-4f34-a8a5-55199b3ff03a", "value": 86176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607535, "uuid": "bd271d94-af6b-4519-ac3e-c4f6ea54164d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607535, "uuid": "f61d7de1-c8f2-4823-af7e-3508019fa3a1", "value": "0bc65a55a84d1b2e2a320d2b011186a14f9074d6d28ff9120cb24fcc03c3f696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59eaefa-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668172, "uuid": "ffd823da-e9c2-43cd-ab1a-efa42e90a519", "comment": "Malware payload (Mirai)", "value": "c565cb8c684e47af2e70bc20b689fe1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668172, "uuid": "f4c159a9-d7ee-4000-9749-5d5b87ccb984", "comment": "Malware payload (Mirai)", "value": "0c11459a3fadb0d3da1c3f26c9dd4e2bc70df873add118286316cb198f002991", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668172, "uuid": "8eba11ee-8b6d-48ef-8daa-23796c7318f8", "comment": "Malware payload (Mirai)", "value": "a39de3cf3aadc5d91cc6e50de2d35a1fb742d7e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668172, "uuid": "f9ac3e35-0ed7-446a-aedb-b2cc2ac5dec9", "comment": "Malware payload (Mirai)", "value": "12df030e33f077b5a715a026fa13b807321d66f02052797c6af4fe840025a405120022fa97f1d26f11eef05a67e1ea0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668172, "uuid": "2fea4658-f11f-4e04-8509-0a7f204211f8", "value": "T112339CA2C9799D25D12946F6B831CFB90B13A200B6472FF72916E1198443D9DFA4F3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668172, "uuid": "ae7fe81f-237f-4aa7-b1b6-4b62efab46b0", "value": "1536:ZG1q7ciX4rYvvt+U6rC52WzVtCjROprunv8VR:BP4UHhSY24VtGainv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668172, "uuid": "65a5c8e7-e54f-483b-afa9-833736cd11a2", "value": 52552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668172, "uuid": "658e1e97-117c-4095-b5ae-39c82d34c333", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668172, "uuid": "125ec13e-6036-46b1-9c67-9f7fa8a634e5", "value": "nabsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7a8532-d87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668720, "uuid": "9ea6ad1c-6db4-4d9c-8055-4a1775a8a99b", "comment": "Malware payload (Mirai)", "value": "a559cde98a413ed1e8a7798d5324b6f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668720, "uuid": "87ec72d0-5de7-44da-81b1-d8978d1c9fda", "comment": "Malware payload (Mirai)", "value": "0c320c61162313e4efd275111a193bbbc9929946eab40ad71c65a1e81f1f8cf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668720, "uuid": "42a4820e-9fc7-49f3-b491-ec9d5a170995", "comment": "Malware payload (Mirai)", "value": "0b26ef06253221b44519cbbcdb58aeb9e1b28680", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668720, "uuid": "5c964cc5-c9eb-4521-9fdd-0282de3dc3f2", "comment": "Malware payload (Mirai)", "value": "3fd7ce12561b2ced1ac8453ce2aef95ba2334bcd9a48ebfb1f0c2a3538ca08b9d8366d3959e314356de5439439685d81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668720, "uuid": "5d5b2d94-82fd-4f46-9f90-d1fd1f2aa4e7", "value": "T148A3D71A6E11CF6DFB68833687B7CF31975867D62BE0C685D12CE9006E6034D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668720, "uuid": "32563db2-49c1-4582-9596-ad848dea9ebe", "value": "1536:TClHiHbWdOiC4c2KBCifF4z9nCXK+4W+mcW++UmKXCnyeG4cLfRsnv8VR5:oi7MONzfWxnCtKX5rVRsnv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668720, "uuid": "338f76d8-2235-4669-bce6-c4fd7b93f8a0", "value": 105336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668720, "uuid": "d613a112-293d-4d7a-ae93-22ef2bd68a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668720, "uuid": "0e6452c0-c307-4a02-9c89-8bedf9ca2dad", "value": "splmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c019bd5d-d875-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765666069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666069, "uuid": "cbd17211-96e7-48ab-9ec9-ef2fc8f96b0c", "comment": "Malware payload", "value": "5e10bcf8cd6e6ecf3fb5ab4fd7f244f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666069, "uuid": "db215fc5-7c9d-4402-aaa6-8c70601f57e6", "comment": "Malware payload", "value": "0d840207c30e9a87abdc55767faed3f46f095ba196ec225c6b07ab7a03aee0c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666069, "uuid": "cd5b8618-4e2f-472e-841c-5c270d317552", "comment": "Malware payload", "value": "4fc5c48bb8928bf98873246fc8578de11317fcc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666069, "uuid": "dd6f6661-785c-4355-838e-ff43717f3179", "comment": "Malware payload", "value": "2974b5c5fdf1fc04d6362d24bbe04ab68d0453461ac9925b9afc956c57023b24224515b3e6881418d087ed75fc03d27e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666069, "uuid": "39be9450-d803-4dc4-9137-776a0a74326b", "value": "T15F334B217A792E17C4D6B9BE21F34724B6F61B0A35A8CB5D7C720E4EFF10A40A4136B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666069, "uuid": "ecd6c03c-50b5-49e0-ba5b-e0748d02c170", "value": "768:xGohq9rtOqmpi6YAz1C7GyfVWMO/gU+iO+MGUDPnH7J:xGQSrwqmpi6YAz8CyfVWMOgURMxHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666069, "uuid": "65f92710-0b9c-4270-8e79-bd7ed63bf07b", "value": 53328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666069, "uuid": "994f8cb1-c63d-448c-9cf9-28c5db53f5ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666069, "uuid": "f5f70760-daa5-4225-bb91-16faae267837", "value": "zerspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e59de0-d805-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765618051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618051, "uuid": "5aed6c5a-492a-4671-87fd-57321df7ae36", "comment": "Malware payload", "value": "2b59ca64451fd5ebeecf5582e9787286", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618051, "uuid": "eca8df3c-aa8a-42d3-8cb6-f0d05342898c", "comment": "Malware payload", "value": "0ea5410ee1bad238afb9ae196675bfe0e17d21795dad55860dc23384385ffc85", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618051, "uuid": "03c0d3d3-7735-44ab-a16c-a4f8e6105dbc", "comment": "Malware payload", "value": "8206997065a094e999498be87d2f68486a6be126", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618051, "uuid": "b786e730-9992-4402-bef0-876c66f7b7cf", "comment": "Malware payload", "value": "7e1cc7e6f9bcf087917ba1475e66d562e1a39a2e9a879679e0813a9d164c7d9e6068502118251371b03e6e73f64ee3d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618051, "uuid": "eb7bf83b-6330-44a9-82ee-4c0454688e20", "value": "T18D862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618051, "uuid": "c1411674-d15f-4b55-b853-29906d7d122f", "value": "49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPX6:glRJXp8L/KyZcCb7VEew+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765618051, "uuid": "75fb6daf-2673-46e8-9d13-5d04289ab492", "value": 7864320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765618051, "uuid": "ac745ef7-d5e1-4da0-ab20-834313b99fea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618051, "uuid": "152f6317-e07b-4bc2-9362-cbb6605f5507", "value": "shell3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b71f83-d7db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765600008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765600008, "uuid": "56221e9f-193f-47aa-b207-ce12ff75c9f7", "comment": "Malware payload (Mirai)", "value": "7682539eeaffac13fe74b6c9923223bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765600008, "uuid": "d35d73f3-e0a4-4b8f-be5f-8375801e2d8b", "comment": "Malware payload (Mirai)", "value": "0eb5f5d292121745a441ad3e62d54dac933bf2eb2e1120796756f5c53bdc3217", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765600008, "uuid": "cc75edfa-8aa4-453b-ae44-1b9f6bc2c4a9", "comment": "Malware payload (Mirai)", "value": "d7a3d3387036eb74c9205e1d3080e014c9b51403", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765600008, "uuid": "5c1c66bc-0183-47d0-b412-f70483390012", "comment": "Malware payload (Mirai)", "value": "95ee7393e72190bf62c33a7f2376f9adeba524297f620c1ce476299862ab5a5e86866fddbd176c9d9f32410ba89208f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765600008, "uuid": "815ac203-5488-47f6-b102-dc93da7ca0f4", "value": "T140044A46B8828A25C9D502BEF92D018E331367B8E3DF7212DD215F20778A96F0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765600008, "uuid": "12fcc25d-439f-41de-bdb1-98f7a293fe89", "value": "3072:4k2iXyA3fYJO2RIEjiw+r3urSKk1mJaep5Hfm7pNMx7gLx4pftu6NU2DC:4kLiif4OIIE2lr3kkiaezapNOgLxwNUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765600008, "uuid": "d06a7872-3da7-4e55-94a8-a2bc077cc106", "value": 173688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765600008, "uuid": "69c60ea4-8b53-4687-825b-78a58e4d6767", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765600008, "uuid": "d633ce63-b4ae-44bd-98ca-30830a542daa", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5644dcaa-d7cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765593306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593306, "uuid": "54990751-a6fb-4e92-b01f-6192a1da376e", "comment": "Malware payload (Gafgyt)", "value": "ca7daf40d28ffbb0bbcde562586892c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593306, "uuid": "94e884a4-8202-4111-ad7f-570880ebbbaa", "comment": "Malware payload (Gafgyt)", "value": "0f622b258be87d3f91224168c366b1c5de90af6fdcf941e2d8b72d0ad40cd4a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593306, "uuid": "e72d8b40-dc16-4b66-bd10-6d531c320512", "comment": "Malware payload (Gafgyt)", "value": "a1232dd1fbec1c7c45a7a1c4804875fa3c0c93d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593306, "uuid": "506558df-b58f-4275-9ef8-2877a260bf98", "comment": "Malware payload (Gafgyt)", "value": "e617621cfeb5180f37d2980f9fe57eecc8f9eb3413f05fa9065ffdf07adeeb19ad873e56137f696cd7b47fc239c8df50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593306, "uuid": "618256dd-4830-4d50-9af0-24ef97bd9ec0", "value": "T105C36B07D4A180BAC48722717ACFA6615823F4FA033971077BD1BFA82F555C9DE9E782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593306, "uuid": "974ab15a-558d-4d63-94db-10ea8a93db48", "value": "3072:f4Jl4sAQSn1dp0CEjXF4pha7dZefGVPNemqt4WthVW:ginErF4pha7bsmqt4OhVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765593306, "uuid": "8003aa48-1e28-4897-b7fc-eab02189ea9e", "value": 127634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765593306, "uuid": "a06cf43b-68a6-41dd-8e4e-49f1b81ff465", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593306, "uuid": "c26c296b-37f6-42c4-974c-4b5670d027b5", "value": "ionetworks.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d934db84-d87e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669977, "uuid": "84d2a4fc-4d19-441d-9e72-57d18ca87357", "comment": "Malware payload (Mirai)", "value": "db1afe805833d8f609d7b9881cb500c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669977, "uuid": "42f72912-16d5-4d36-bb18-278f36b3a470", "comment": "Malware payload (Mirai)", "value": "0fd0b290cda7bfb7024454bda5fdc71d17614f551ef02c6c8e82136e0c0a69a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669977, "uuid": "e738431c-1f2a-4e3b-9b21-70795bb3a8ef", "comment": "Malware payload (Mirai)", "value": "71d275e9b0fb0d6a2515a4516349e4d50336b440", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669977, "uuid": "902f160e-822c-4db6-be0b-e17c9e289e3b", "comment": "Malware payload (Mirai)", "value": "eb41ddb2d50aebf295893e0c7728abe48a1cb856d1e68eb3484170ea110a0a2c2298e943648561ad71588fbb036b5faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669977, "uuid": "8acbef33-e5b9-47c6-955a-b2b18b2a4ab1", "value": "T1DD831A85B8919A13C5D452BBFA5E42CC332527E8D2DF7207DD11AF253B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669977, "uuid": "c4d2d69e-44e7-456b-b391-a8ae3140b95a", "value": "1536:7tAtdiUuvB8m2kANibD/9ckECcMEBU+VjesWJE5vYnv8VR2:7tAtdxbmD9l8C+osJJYnvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669977, "uuid": "ee18b8ed-d77c-4f0f-9557-3f31cee58537", "value": 83136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669977, "uuid": "68bf0d5e-358f-4482-9637-2e6c0e041cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669977, "uuid": "726142d8-6c15-49a0-acf6-f092e1338ffe", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af631146-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615790, "uuid": "5a143c18-2030-4a46-a772-e6964ff65055", "comment": "Malware payload (Rhadamanthys)", "value": "8dca76f292aa4fe0754a22296399ec10", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615790, "uuid": "e28f78f0-8402-40c4-9278-288e97c3f2f6", "comment": "Malware payload (Rhadamanthys)", "value": "0fe1e767b74871a9d9e3a7fa55eb5c5297488d2c99957f960326b224a48d54a7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615790, "uuid": "0e73be6c-23d3-447f-9b3e-8ed886d79303", "comment": "Malware payload (Rhadamanthys)", "value": "9769ce332ab063b48a890e8da153ce48a60665fd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615790, "uuid": "dab24cd3-bd29-4cde-a8b3-6444b502989a", "comment": "Malware payload (Rhadamanthys)", "value": "6b2159d8cee3bfb90771c29294c7e405fb8aae85910e72c879ff29ee8d30f3b022df0b231c242b37cfbcfd8a9e2b890d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615790, "uuid": "64623d0d-49b7-4ce5-9d35-08307b83aa88", "value": "T1C3A3E724EDB3A9E65E0A74A13DDA29E0D60891429B6D502F2F0EF333681D734DC85BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615790, "uuid": "268e690d-0e75-4853-b45f-20ddac578672", "value": "768:GDhd0i7J4sYKgY/CMNfWdFYDzydy/W/+poctCYH4wyasyNKwYY2sjH+UgV7z689p:GDB7eKg20LMrwrw4lu1A+z56BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615790, "uuid": "7ae9c476-7279-4758-b360-af17b20e6b0f", "value": 98140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615790, "uuid": "404f4256-315b-4688-846a-52d22dc964fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615790, "uuid": "3c8c02b8-babc-4c43-8199-f4d0fddb9d3e", "value": "invoice-1637482117.pdf (37).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff692c8-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613160, "uuid": "8a41c659-f082-4f02-8691-a91493c57584", "comment": "Malware payload (Mirai)", "value": "57cd8d9a4c85c4552efb4535f87ba8a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613160, "uuid": "3331f86d-a353-4561-98d8-28629daca0f7", "comment": "Malware payload (Mirai)", "value": "101f1c5162277e2f8df1166a85c508255541f20afa49fbe1019080ebcffd43d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613160, "uuid": "58067304-f4d1-4fd1-9515-19bd714882a4", "comment": "Malware payload (Mirai)", "value": "7e81f264cf47142881983d9867a51b5f88385651", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613160, "uuid": "74052af1-6b17-400e-b53b-0420ddc4963e", "comment": "Malware payload (Mirai)", "value": "8b28c3b4b50b1c484b4492e41d3ec25580f7e2a25417d2e398d98adc9bd8b63e675b1a0ea58f9dc9aed49d162ae5c97e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613160, "uuid": "ef0dcf29-571d-4169-bbf0-6bf895e6afa2", "value": "T10C230261890E9EF524303C72DE95A393BAF116B1C6673113D6180B3C2F79B131E57E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613160, "uuid": "1bc5e8ed-2fd6-480c-8534-ab2231ecc4e8", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3U9q3UELbUXfi6nVMQHI4vcGpvw:DECFd+A6YHAx9LRQZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613160, "uuid": "fa87a694-18a4-4fe0-b171-9410ae92c51d", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613160, "uuid": "bd1c4521-f1bc-461f-81b1-8c836d2c5b75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613160, "uuid": "4a914092-a3f8-4b81-ae96-bf55a578665c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53817688-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613059, "uuid": "b00c37ce-62c1-4845-bc32-5cae70496681", "comment": "Malware payload", "value": "9e1d036df3064629b26e4715f0353cd5", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613059, "uuid": "0f69ca42-1855-4873-b13f-cde8010ccf6f", "comment": "Malware payload", "value": "10e9665be878b1d0936bbbdfe7a2b2c5bcc0539fbcbc02a871d1b4b533fe16a3", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613059, "uuid": "8ac2a48b-68db-4639-b7fe-fc923ec328bd", "comment": "Malware payload", "value": "bf17e5e2c3bdd306d773f75344599c97e83a6fea", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613059, "uuid": "f46be691-6958-474b-9218-8d3980ce1911", "comment": "Malware payload", "value": "76ea44fa8369a25a4e315f0c5d8fc27c66a28b6ab5f02d1dff054de97fba06403f324fc214e1bf0bc8504e921da4507c", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613059, "uuid": "02277414-ee38-4efb-a461-98d799f351ad", "value": "T16483E36EE30F0965DF55967B034B4A4A06FCB33DB28140B139AC977437ADD2E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613059, "uuid": "ccd5681f-7ebb-4dd2-bd06-2f510e8e2315", "value": "1536:QG76/wH7YIKn9xrAr/boI5jJFr4cW6MSz184us2klsAhnT8iYVR4tPFFiKQKCKX8:T76RIm9xkr/bN5jJFr4EMq8g28s2T8iW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613059, "uuid": "9a393f23-76de-46ea-af07-9650c2a41573", "value": 87680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613059, "uuid": "c6e7bac7-5691-4323-ac95-e3e52f3d51e1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613059, "uuid": "633e6597-40d2-4294-8b4f-7195e5b2378f", "value": "10e9665be878b1d0936bbbdfe7a2b2c5bcc0539fbcbc02a871d1b4b533fe16a3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec0e3204-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650251, "uuid": "6099870a-088f-48a0-ad91-70f3fce111a9", "comment": "Malware payload (Mirai)", "value": "95ff3499f2e0d08d280b0ab9c731edad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650251, "uuid": "65104c15-d251-4633-83fa-76bdbc34767d", "comment": "Malware payload (Mirai)", "value": "11a15ab2eadb563867530c9a6d2b3a9569bbe4cd1464389ae99b2b64cc633bc4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650251, "uuid": "ae43a563-e2b2-4b9e-acc7-1b13dca846d4", "comment": "Malware payload (Mirai)", "value": "46fea362c4be864c17338faccb35aedeb04140e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650251, "uuid": "785856d6-02f7-4e14-8ade-bda8b3747659", "comment": "Malware payload (Mirai)", "value": "92c842894aba53b187272bae7b3b9995f65a2a1aa1dfe79f6df50395d6ee4336f8b3967e42b70e2a26b8a2e6864de363", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650251, "uuid": "42701037-e77a-4f3c-8d01-d3e15f9b80a3", "value": "T1ED5191C912924F316CEED92F77B988887184E5FBB4C6DE24D9DE78EE448DE0DB040646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650251, "uuid": "bff2efda-c575-4cd2-b838-d677b1b4395d", "value": "48:iDO8DviDZGDtitGD8wD/qDpmDR7qDaMD5+lLD2uXJDbaDboJD/SDIMxDEIDjl3:ifOMB9+McDyLr6COHxdd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650251, "uuid": "fd823a4f-1f8b-4670-881e-e2a18fc29496", "value": 2927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650251, "uuid": "9fb40b40-4a3a-476b-94f8-b94457fbf20b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650251, "uuid": "c8983fda-c1cd-41cb-b908-0db44da05fca", "value": "syslogs.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6726db9d-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765613092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613092, "uuid": "ce5b7ab4-3aad-4847-8b93-f2cc422b1ac3", "comment": "Malware payload (XWorm)", "value": "3e41d97512af313464f27cf9d1d2aea5", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613092, "uuid": "59e83d58-0c12-45c7-89e2-35a9104d09c8", "comment": "Malware payload (XWorm)", "value": "125ae1365fe1c5f27482211b9b9418f64f2db572516b3f0a8f89d31e0a918077", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613092, "uuid": "61067e19-3b77-44db-b120-134f04a0f28b", "comment": "Malware payload (XWorm)", "value": "ca5fa883f0af516d01d964bdb103ccb789778061", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613092, "uuid": "8e5feec5-27fd-4389-9296-0842c6a29cf8", "comment": "Malware payload (XWorm)", "value": "e03232067cdd1d1b5774faef3d519ab7db744fcd6f959d17c7495febb2072c30b1ca2dd58ebf92cfde2a5bbfb8bba7fd", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613092, "uuid": "9d0c1076-d1ab-4796-bae0-056c49fcfb01", "value": "T15CC50943A9DB0DA9C9D277B8A2D31335B774FD348F2A1E3B6A58C23119536C4AD1BB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613092, "uuid": "0489b31c-98c5-40c8-a2ef-276728c49ddd", "value": "96ea0a05de9bd8786a471a32a5c6040a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613092, "uuid": "854734a3-a7e1-44b4-bcbf-f6727bc2800f", "value": "24576:GFwKGCI/nq6RSfjND0VyBIWRvBGk759AkkOKArm1EQJ6clMi81s3Adc+zM8f:GFwKGZnq6RSf5oVya0o43m4c+o8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613092, "uuid": "c30ec3dd-7813-46c4-b21e-7d96caf48367", "value": 2617202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613092, "uuid": "11e6b7a9-1693-471d-9329-66adb034f186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613092, "uuid": "ff7a2848-8dbc-4769-a5d2-c1b9a01615c8", "value": "125ae1365fe1c5f27482211b9b9418f64f2db572516b3f0a8f89d31e0a918077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556a5a55-d7cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765593305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593305, "uuid": "a0746208-74eb-41f9-9c54-faddca44647c", "comment": "Malware payload (Gafgyt)", "value": "fb765baa0546207256251312de8ed2eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593305, "uuid": "7d6825a0-8cb9-44a2-a191-69f1ef2c5ce0", "comment": "Malware payload (Gafgyt)", "value": "13f166bc0c57ed6f23acf5613c8366e0d4cfab1ca97b2689a841d48b9f237a14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593305, "uuid": "39cc505e-3f97-4c78-9fa6-eafe18ec2c76", "comment": "Malware payload (Gafgyt)", "value": "a94a9e0e90b7fdc248400367d8d7abefdcd866ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593305, "uuid": "04eccd11-e5d3-4b14-bb8a-f60ff89650ef", "comment": "Malware payload (Gafgyt)", "value": "da02cfba597ce87a23eb4c832475bdb1338fa4c1535a972dd682b3824ebf42adabee535ad137b082f2414bf1affec5f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593305, "uuid": "e983ea60-5d94-483f-8c0f-8ef37668918a", "value": "T152D30905D4508B23C2D2677AFF9E474F37225BA89B9B332256296EB02FC179D2E3D510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593305, "uuid": "8c2343d5-243d-4755-8fc6-04b5820f4c60", "value": "3072:A5upxw7bIfTzhm32x8E9laJE2thjq3BHoFdGP5hMH2A0DXfgwjWlmyhQaS+pg7J:ACeE9laJE2PNGP5hMH2EwqlmyhQaSGgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765593305, "uuid": "b6ae1167-4cb5-48c3-a00a-6e9f06461efb", "value": 138878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765593305, "uuid": "e51874ff-edff-4e4c-8e61-88940f02c5cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593305, "uuid": "245d1e9f-34f7-464a-8526-3ba5e0a895d6", "value": "ionetworks.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73591f0-d7f5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765611105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611105, "uuid": "ac79f710-a11e-4e40-9ca1-478aa555d10f", "comment": "Malware payload (Mirai)", "value": "6e8861e60afc71af0c397a7699d03456", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611105, "uuid": "4987952d-61ee-4b4a-b354-63630394c41f", "comment": "Malware payload (Mirai)", "value": "140298d0dc4bd4871139227db8994e62bb6d0fc7d520ac05c5c4fe9c2218ac6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611105, "uuid": "b65eca1b-5b5d-43b6-91df-7bb112ec1e18", "comment": "Malware payload (Mirai)", "value": "b34aeb1c7d33f9146a99f083c909bd8d052df7dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611105, "uuid": "8ae74d18-c52b-408f-9a34-ba7498716737", "comment": "Malware payload (Mirai)", "value": "a7b3b7868ca5a5bfdaef8cd0d17e161af8cfc46ccaeb93d13473db062c240c396bddd02f56555e3329dec088e9341177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611105, "uuid": "b7e8b774-addb-4485-ac58-72e33fec3b08", "value": "T13514F70F6E258F7CF3A5C63447B79E31926823C726E1C586E1ACD7005E6428E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611105, "uuid": "96439eb4-412a-468a-9785-c32818270a41", "value": "6144:LX/xFutUeGgaoTxN0PEyu+dQUcEnwzBxwNU2//:Tju+PTkC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765611105, "uuid": "cd82207b-922f-4292-b8dc-57001ee37b7d", "value": 198580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765611105, "uuid": "69612e59-2bea-4898-9f96-df1f9dba25aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611105, "uuid": "9dd39ec8-dc8c-47f9-b227-eda26daf7091", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05df4d7-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650259, "uuid": "b47cbcee-7975-4a39-9c9a-cd548af44c44", "comment": "Malware payload (Mirai)", "value": "ac61f591217b1ac1c34065650308d127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650259, "uuid": "a693e295-4d76-4478-8fbc-cebbe6a5afb1", "comment": "Malware payload (Mirai)", "value": "151d38b0a14a92f8531cd3062302d813c8e2876b74e1469cbadd8e8938ded657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650259, "uuid": "f9e98810-2ce0-4255-8f78-2fe90c560d9f", "comment": "Malware payload (Mirai)", "value": "218c42b9e33f468b6d0a69293cf7d72f57128d97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650259, "uuid": "77a88828-ae56-4da5-9145-42296e7812a7", "comment": "Malware payload (Mirai)", "value": "d941604de5bcf3d00ba0e7f610dba9a8adfded63327c7f66def0ecbea9dc6356b77f0613cf6c9d9299b9c191338a99d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650259, "uuid": "3819d45f-6a99-446b-b492-95faf0d48c7d", "value": "T133A4B08B33467E3EF0F3593E84D54F16A63AF3510583270B3169B9566A239B92F316C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650259, "uuid": "a8439f39-c266-4b69-bae6-66a5a1da7327", "value": "12288:ZCq08tXG05rf3AzpDYRVsYMNBScLhVIdY:fZD7Q1DDYsV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650259, "uuid": "e5ea7c4c-6fb8-4387-a2a6-bcabfebc5aac", "value": 493360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650259, "uuid": "9fb912f2-766b-483b-a812-e5aa9d297a5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650259, "uuid": "cd1a1260-1ac9-4358-adc9-2e1048968e1d", "value": "shadow.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b170422c-d87f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765670339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670339, "uuid": "7872441f-ed49-4997-b905-843f87e21f34", "comment": "Malware payload", "value": "5d134a198d15fc55c1e2ecfa54804505", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670339, "uuid": "3e4cf3b7-423e-4e87-b1ca-9b47ac76ae40", "comment": "Malware payload", "value": "1575096110b0f6b5b92965447db22ca7add4f7cc93e4c7baf64e8f80455ebb20", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670339, "uuid": "9fdf3d5b-d932-485b-8947-135127a93712", "comment": "Malware payload", "value": "317652ccbdd7e8f9377790c47b6a2f343ef7e4d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670339, "uuid": "4c926513-13d0-48b8-a656-3c01cae3ec12", "comment": "Malware payload", "value": "4a6eac85062f22a3c005109b00d8ad47a514fd98efc278c06361b9a8fe38cf4dcec3ce55b1c91ee0a4370c0af5659cfd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765670339, "uuid": "8fee1d89-c687-4218-8cff-8c9dbe303cf9", "value": "T1D061A6E5B431637031C88D7C711598986AABDDB9B0782B19B9E52C7280DCD1D331AB3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765670339, "uuid": "a11c3454-2ec4-4365-9c75-f031aa9b3d1e", "value": "96:qijmjByiaV6WB20InUXxTAPCI7ITC/h/L:qijW0NtNXzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765670339, "uuid": "cf821505-58ae-4df2-8d8e-dbf6d2f5f0f4", "value": 3378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765670339, "uuid": "1fb26b82-9ddb-4fc8-b328-fb9e9206519a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765670339, "uuid": "8374d276-6e6d-4ece-a376-3fc24cb39c7b", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8e56b7-d847-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765646306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646306, "uuid": "f596614a-5d2f-4d9c-a36a-35183d6177bb", "comment": "Malware payload (Mirai)", "value": "1406280e4ddd56ad786bb4e997efdfdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646306, "uuid": "2d2c838d-a2b5-4a0b-910f-9dea0c22e1a2", "comment": "Malware payload (Mirai)", "value": "15aa0a56d3632566d611d7bf458262514ecd9451dcc255ba7aa68ce4777df317", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646306, "uuid": "c4e58bbc-141f-41da-a671-7da231dfdca8", "comment": "Malware payload (Mirai)", "value": "6d759feea59b720634dbbf2e30d804ca7be43fdf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646306, "uuid": "e7c69674-9ca9-46e5-b28a-7c7553e91d9c", "comment": "Malware payload (Mirai)", "value": "620a168dfdd29399306d85f8a5675918f036df40d87c5a76c75272bb99cc3e431bc46f1617598ea470d5ad78df982fae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646306, "uuid": "9fad5bbf-69ec-48ae-a7fa-4849ce88987f", "value": "T17253029BC473AB15F22711B1F4A33BA601826DFDC040C56BCE44E3A774C79AA1321B87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646306, "uuid": "10ed279e-c789-4a1d-9b33-afe3e8b5cc1c", "value": "1536:TCJETAvba2GkW+Evf/1Qf17gLF2Nl82F8nouy8Gyw:TC6TcTDS3dQf17Ckbxcoutc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765646306, "uuid": "29bb80d4-8755-43a5-9da3-c3ac9984c06e", "value": 61608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765646306, "uuid": "9c666129-bfe1-4839-9273-13a1606d8ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646306, "uuid": "1768510f-87f7-49bb-8d00-f724658a049c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8910fa30-d825-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765631617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765631617, "uuid": "e631f1a6-9237-47e8-a4f3-df23b8d12d2e", "comment": "Malware payload (Mirai)", "value": "db762a0bb28e43b7c4345feaab0d29d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765631617, "uuid": "05961669-34b8-4565-a776-06b525fbbd32", "comment": "Malware payload (Mirai)", "value": "16d4d6476b69fb3b13ae8b0512c03fa97eee7e2aa4d0f3f54362dc3735733159", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765631617, "uuid": "9e50bfc1-af4f-4696-8109-ce71e0746d86", "comment": "Malware payload (Mirai)", "value": "73e4ed36ae20db8b959e0071bf726dd4eb0bca63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765631617, "uuid": "4d9d022f-7ccf-411f-8527-e8f2aae5b85b", "comment": "Malware payload (Mirai)", "value": "af398dbb39d220abefe05e5d249203efb7342f2e213100d492916cd5e5b1ebcaa1071e6f348feeb6e6ea3cb414058d82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765631617, "uuid": "43c1b3c5-7ede-42c7-96f7-b7654e4f9d85", "value": "T15CE3AE33E9796984C0418538F0F8DE754BA2A49852521DFB6BF2C1B6408BDF8F61E7B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765631617, "uuid": "02bf1918-5dbf-426d-b92b-dd7df3bd028b", "value": "3072:Q19WFB7P6k/wD8HzmOQnautHAS2hemaajBx4pftu6NU2DP:Q7Wzuk/vmwutHLrajBxwNU2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765631617, "uuid": "72b9ee33-39f6-46cf-b7f3-8d261354bdf1", "value": 149012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765631617, "uuid": "073e6bcf-47f2-4392-ac82-042b3eddd210", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765631617, "uuid": "7b4c8c00-be75-496d-9060-b19d319ab7fb", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7cea57-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607031, "uuid": "d4a001c5-9cb1-4e6b-a21e-62d4bc4a1c98", "comment": "Malware payload", "value": "4b9adcc4da45ea1a456c5019878aa9c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607031, "uuid": "6382ccdc-a1bf-4346-8246-3c16af478642", "comment": "Malware payload", "value": "17459c034361380629176150283732d8298f92ec79d16f7f9a3d8426adf0e04d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607031, "uuid": "86f079b7-9847-430b-80d0-fb2c1a1def8c", "comment": "Malware payload", "value": "d096e8f4fb7c8b5487fb9301f82a7626f63c2c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607031, "uuid": "67b78410-0b8a-42b7-a9c2-56ae939e1e07", "comment": "Malware payload", "value": "a57e29e6bc7e36baf265f65a26375ffa849cbf942862f4c12a5f7538d4a6933c2ce90e58f84141a8c0d62744b3fb4727", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607031, "uuid": "6304f1dc-ef62-4210-9da4-f568de31f359", "value": "T1B8954C25F7F2005AD2AEE138F8CE4909E2A3B946476EC6DF025E13253567BD2267D703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607031, "uuid": "43d2158d-a9b7-4cc8-ba4b-82a15fa76470", "value": "86962b2ddbf99fb8355cda2d124ba099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607031, "uuid": "d8ffd974-0ac6-454c-9b8d-6883e8ce9b0b", "value": "24576:227nIqKO8jh3Wm8iQsN9ibyTYB20GQj8kUFexJxLqyS6+if:DUVljh3SsjibyTW20GQj8M9uV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607031, "uuid": "6957448a-d754-44de-94c0-ef9fe0000a91", "value": 1966592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607031, "uuid": "487b1be8-46f6-4bb3-bb6d-70cc99b8ee7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607031, "uuid": "770672eb-95bc-4f32-89d2-3c2f8b00a5bb", "value": "17459c034361380629176150283732d8298f92ec79d16f7f9a3d8426adf0e04d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf36288-d845-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765645314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645314, "uuid": "71b75219-0836-4f1f-bbb2-0e1dd4ffd9bc", "comment": "Malware payload (Mirai)", "value": "131fcd0ca1071a3b90c49e68acbaca8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645314, "uuid": "b0456682-5d3e-4693-8964-4cbfff37eb52", "comment": "Malware payload (Mirai)", "value": "179c751dd3a6c608622f7217a5c3451a0a52a265176f545431cd6f165d253324", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645314, "uuid": "fe969a66-5350-4659-a3fb-a6bb6963e11f", "comment": "Malware payload (Mirai)", "value": "f33733d9815c0bc4e9e94f2305180b28b9aab111", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645314, "uuid": "6bc2f4dc-9ac1-46f6-938a-011dc7d57c9c", "comment": "Malware payload (Mirai)", "value": "644f1fe15aac7cce586bcf5cea39cbf6cda298ec3cb0d1c280241752304fd46469abd8bcc01ed0bb76c39cfb64ab7c24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645314, "uuid": "8ef4ab14-8272-4427-b4ce-02a83b252247", "value": "T1AD6302A8D91071D1E7E75D326B18A7FB12AE0F573B06DDDA390BFE1502C9E5224A04EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645314, "uuid": "44fefe10-2bd1-4b84-94bc-3cf93f1a1f09", "value": "1536:Uf0Poxd+xyzonB2us7X4q2r4IIL00zW6ahY4u+qgw09B:UcPoCxy82z4Lr9x0DahY4u+qgwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765645314, "uuid": "077aec59-8347-4b00-b1a8-2c48ea45f964", "value": 68260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765645314, "uuid": "9e3c7553-46dd-404a-9be2-7ce76376c8f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645314, "uuid": "a7ca45bf-9a72-405a-b4ef-f23ece3e3d55", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c265a0b9-d7ef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765608520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608520, "uuid": "8d0f0c0d-3e97-4c72-89de-bd8a6d8de5e2", "comment": "Malware payload", "value": "ff4835e9d9a16eb3ad3bff4ab199cfae", "object_relation": "md5", "Tag": [ { "name": "115-42-60-57", "colour": "#93FAAC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608520, "uuid": "45a1a4cc-6789-413e-8259-e9c8d61e91d8", "comment": "Malware payload", "value": "17acdef55bdc663b66840c2d8b18c0f052fab9f307e2f7889e5e2296ce807691", "object_relation": "sha256", "Tag": [ { "name": "115-42-60-57", "colour": "#93FAAC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608520, "uuid": "1c3dff60-e6fc-48f2-91f3-30d92b5e7205", "comment": "Malware payload", "value": "80242c9afc38b3f8c3a47557126ca26078a8294f", "object_relation": "sha1", "Tag": [ { "name": "115-42-60-57", "colour": "#93FAAC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608520, "uuid": "518ec5e0-dea9-4448-a51e-bb15ac079587", "comment": "Malware payload", "value": "55229c3fb5d4ca3162a9d23a27d5e9156ea9f1be08d1ae0a7b003e7c6348333b3df88f813a0c145b86f1c8110ecdc852", "object_relation": "sha3-384", "Tag": [ { "name": "115-42-60-57", "colour": "#93FAAC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608520, "uuid": "6a137f79-7b21-4f72-8d20-61586abb754c", "value": "T166123047A2D0CE3FC8D953384467122472B794BEDF629713064915B63F427E81E6EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608520, "uuid": "49f0f4a1-6ed1-4653-864e-86b5486ddd10", "value": "96:GqTVJWWGXzS6hH5ML09V1J9G8Ymu+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWH+ZMWT1YmjhrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765608520, "uuid": "5944e6b1-4065-4723-81d8-80db7dcdb341", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765608520, "uuid": "6a976001-1bd0-4a7e-abf5-ec10099f6359", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608520, "uuid": "6f94dec3-d7aa-4319-9d52-37e47f34b672", "value": "17acdef55bdc663b66840c2d8b18c0f052fab9f307e2f7889e5e2296ce807691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd63f27-d83a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765640671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765640671, "uuid": "a15dec78-fe53-4d9a-866f-36cf6d30bbe0", "comment": "Malware payload", "value": "aba631c60047f5eb879ab03efe919cc9", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765640671, "uuid": "e4f00c52-ab26-4084-b6e4-8f4d0bd0db80", "comment": "Malware payload", "value": "188808a6a78bf2db176bc6a818b515f17d7cb288b6873c48e80d8f576b53f6ed", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765640671, "uuid": "2c826d68-6426-4cbb-9e27-de2f6b93a22b", "comment": "Malware payload", "value": "20f332aa19cd7f3dd668725d2196bcca3c05bb51", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765640671, "uuid": "ae08c8db-8dbf-40bc-ad0a-ab1c6647a06e", "comment": "Malware payload", "value": "3cacbba6ff54499e89bce600e6581aaa8dcc35ec31639999aab58546eebf4988eaff8761f8b0f7eab03996f28ef2fe1d", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765640671, "uuid": "ef0131e1-1552-4acc-b415-35a6b2e5d973", "value": "T141154B23B24E673EE46A5A3649739A50543FBA60651E8CA3D6F40E4CEF2D0601D7FE07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765640671, "uuid": "2d1b1fe5-3466-48de-a627-9ec177cd827a", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765640671, "uuid": "4d22c3d3-894d-45e4-a779-2a2d4fc971c5", "value": "6144:pXXk2jGlbIotc5ATsrZYdriUE/f+AEDq30w6YW3lHDh+wryZhgs+/7P8aXKFEFFy:ZXkwmRiUW7kiYHD9XKaOEjkR7nSx7UWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765640671, "uuid": "611c491f-7870-41f6-b691-fe83353a8b47", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765640671, "uuid": "da1c2d7f-c6cc-4b8b-ba56-5a9695dce541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765640671, "uuid": "a08a65ec-6666-4f92-8b5a-373f98ecda3a", "value": "No Other Choice (2025) [1080p] [WEBRip] [5.1].scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3cdd76-d87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669101, "uuid": "1664d754-792c-4b70-9a4d-942ef9ed7a96", "comment": "Malware payload (Mirai)", "value": "ddf7943b2b91ee4d8ac816d578325496", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669101, "uuid": "91fb7456-19b8-435e-81e4-36d20377388f", "comment": "Malware payload (Mirai)", "value": "189a46a4d8c31bcc64477d08f01dd82e3f7701905afa748b52d87714d8b74d86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669101, "uuid": "834e6eae-9608-4e42-bbf2-92d061891732", "comment": "Malware payload (Mirai)", "value": "ba5641371b1bcb85bc3216b28f663182af6e83ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669101, "uuid": "33ddee21-8004-4908-bf65-9248b73ee33c", "comment": "Malware payload (Mirai)", "value": "b1a36ec20a7e515a2cefc6307c8033bfa1efc784382d5d6172e35995434f8c074bacd588b438c36f81e0b9743d3dd0be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669101, "uuid": "0e9c9f0a-824e-4456-963d-59b1d7f9f6cb", "value": "T1B9144B02771C0947D2672EF0263F27E1C3EFD9A225E4F645650F9A8982B2E371589ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669101, "uuid": "f082cd4e-22a5-4e43-a8f4-ae8972cd25fa", "value": "3072:TC9tmmNWWp8xapRdVW0MapRpXSZbJ6hh1JfLo:TC9trQ/xazdVW0MapRxSAfLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669101, "uuid": "24790b7a-4a80-4793-bea8-6bdf12657398", "value": 193208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669101, "uuid": "7421cbf7-307d-4885-b658-f1da4cf527f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669101, "uuid": "a1408c81-9bef-4732-ac91-d6c1a6ca75e4", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c640ad2d-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607238, "uuid": "4fd60db4-cef1-4028-b63b-1badd3c333ee", "comment": "Malware payload", "value": "06e9c0ead1a06714568b5383f3ba3233", "object_relation": "md5", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607238, "uuid": "83be3c4a-cfe2-4cba-b7d0-68da0275697f", "comment": "Malware payload", "value": "18dfb07ec9871d4117992cf736a4de96833197c8776e29c3737f3d83a226b0ce", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607238, "uuid": "30dc5316-ce85-42a7-ba20-23bf1f47300a", "comment": "Malware payload", "value": "242bf0b4ece5d555db5848e935cbed539aa717a5", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607238, "uuid": "34df6903-5131-4e6d-a74a-3507c7b2e0b0", "comment": "Malware payload", "value": "9f1d1bab63a267099a4d2bd8a98deefbbe6a0e7d1482cbdb2287b0525e67c761189b458af60a5932226c6132363943aa", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607238, "uuid": "e1c9f00e-b571-469d-a21c-1f1f6a320fbc", "value": "T14D72864A5ABBA23056E3A0AD0B2BA115751BF0637345ECD87FBC83142F0661487F2BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607238, "uuid": "5f3f6cfc-e1a2-4026-9f69-66016e490558", "value": "192:yWfyA5P8swNI4AXiiHTJ6S6suSCDV4kqBIWxp5BEnW6IKLduYyDVC5hBBKxaKZ+X:7yoUOz6S61m9DEWjydBjI0MF9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607238, "uuid": "834ba938-57cb-4a9e-a1c8-c5b01e3e85c7", "value": 16976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607238, "uuid": "bed1703f-1473-4863-9aa2-6ab7e41585d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607238, "uuid": "b5f08540-1968-482b-b33a-e49d9abd09a6", "value": "18dfb07ec9871d4117992cf736a4de96833197c8776e29c3737f3d83a226b0ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac44d2ac-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615785, "uuid": "a9a85358-bc2a-40d1-b7a3-4b1c67c4c77d", "comment": "Malware payload (Rhadamanthys)", "value": "b38af0dd38aad4f372f345e8a063fd41", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615785, "uuid": "6f675fd7-bcc1-4cad-ac73-dce3700665ad", "comment": "Malware payload (Rhadamanthys)", "value": "1942d66c0f89b438a944313fc7d4ae65ceb8dc49f0a0a556fbe7c677aba6a63c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615785, "uuid": "f1a8fb22-c2a2-46c2-b0ee-273d76b5c2a3", "comment": "Malware payload (Rhadamanthys)", "value": "5fdbbdfabf83439d684c03006b2c313ee1c675d3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615785, "uuid": "1d9e87cc-26d4-492e-be24-a281adc55bea", "comment": "Malware payload (Rhadamanthys)", "value": "382f74efe472884a7b3ea8cf18fb058f1e2dad614108f554cef1f78a92001edd680ce4fcbe2b6c38f49d694ce75db335", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615785, "uuid": "f5f71a09-b820-4b71-b739-1f8a40e5d26e", "value": "T11FA3F8512F21BEB510BA5257A8DAB0F705299802678DDE29005B7B3921DD3F78F6E3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615785, "uuid": "8cd3655c-89cb-47cb-9b01-3e441d5257cf", "value": "1536:GDB7eKg209PMThpqR2mjTp5Sq5/uDcAI00Brocmfimq4q+tHMBrMqG7Gr9+XFbnF:GDB7b0zpUFJmH6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615785, "uuid": "43e45995-c16d-4227-b7c1-d8d4b56ecd0f", "value": 103334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615785, "uuid": "6be8b8dd-9866-48ed-a590-4e9e54e9592f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615785, "uuid": "54787eb1-fdec-47b6-8267-ceff19db3aad", "value": "invoice-1637482117.pdf (41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd2c89f-d844-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765644830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644830, "uuid": "4a2e108b-d999-4687-b995-e6224693e898", "comment": "Malware payload (Mirai)", "value": "a39c63895d45e130562cca8d2567b34a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644830, "uuid": "7eafebaa-fb01-4589-bea7-17954f16e9ac", "comment": "Malware payload (Mirai)", "value": "19caed3f5ccfad4c6a546ef382e0b6e563226004db6cd02fb64d12ba2419f7b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644830, "uuid": "6ccee4e9-65ad-4966-8c13-f209af37753d", "comment": "Malware payload (Mirai)", "value": "b1b5a7d61c0ed39f3e11ff15881459b1ed40ba8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644830, "uuid": "f1073748-be96-48ff-b548-c1bfece9927c", "comment": "Malware payload (Mirai)", "value": "d7a3fe0d9d19dcfd11a3289b0c409f051096a9b16f8f7fe2dbc6a90baf6bce93e7333910a8dee89c161f06f910592b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644830, "uuid": "9a9cabf9-852d-49d5-b589-65ff1843a922", "value": "T1486302226588AC97CF345CF16A7E02A7D6915FB2D97031132CE089D92F9EDA9053F1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644830, "uuid": "8a74a9f5-186c-4b94-a934-55dfff79c641", "value": "1536:AoeRUOm0u/8ed1pKJEIItbo5c9lRJOB2gS/DlOd2zBaUGKqqp1LOl:DepL7erpK2IIloB0+2zzqqPLOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765644830, "uuid": "93e346bf-b0dd-4cc3-84f5-dd1fb5b8d7b5", "value": 71440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765644830, "uuid": "42eea04b-b9f8-4a07-8a14-beded445c590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644830, "uuid": "eb0e3fbd-2ebe-4a6f-b657-7288e255ffad", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc4542a-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613156, "uuid": "7d675d50-5056-4d59-80cc-593ac6537764", "comment": "Malware payload (Mirai)", "value": "d633a56f3c682c3a6051e35c4a044338", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613156, "uuid": "8001aac3-0962-449b-aeb7-3fc0e3523ea0", "comment": "Malware payload (Mirai)", "value": "1a1e0e5e0031d87098129c83dd9de17ab521bb8d179145d377d670d3557cdae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613156, "uuid": "20873004-4457-4ff0-834a-61561f16d596", "comment": "Malware payload (Mirai)", "value": "df264737c48a660586f4c1c82070d9ca094d379e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613156, "uuid": "77dbe68f-14e0-4cf8-83e4-907270521cfc", "comment": "Malware payload (Mirai)", "value": "6c966b46376aa06225ebb63dfb15580dc286ca58ac5076310f4f59162840e3ee5d1fbe6127512b7ed1924f8caa0c4b0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613156, "uuid": "5b2ef46c-9c2a-436d-b343-6ba9f1ea67ac", "value": "T10CB2D03C1B151B98DE1EC0BE839D0B613CB81F2591829D8B6207ECD79F968747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613156, "uuid": "f3843944-7fd5-4da5-ad77-bf437584b80c", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiKBuWHmdtJgGlzDpH7uNjl:YeD8ZSWvZHZbs1row697qohQvg9suAiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613156, "uuid": "04562b4f-dd1e-44e1-9b2f-8e6ce93f22bf", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613156, "uuid": "7a2ab943-55a2-48d2-9e9d-614586611533", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613156, "uuid": "826a890d-29dd-41eb-9845-72c06d08ed69", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a935bada-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613202, "uuid": "9238ec7f-5c66-4b87-be8a-2be520d72dea", "comment": "Malware payload (Mirai)", "value": "223efecabc072dc3a5bb38543a7e6d99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613202, "uuid": "aa27de99-f700-4d92-8331-d839850362a7", "comment": "Malware payload (Mirai)", "value": "1ac95a1ef6faa565e3255ac191121613a37a237ac51bcf2e495f5f7d0968a94f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613202, "uuid": "32839e4d-2e5e-4b34-b512-a3b82f4a6f93", "comment": "Malware payload (Mirai)", "value": "c3d096486e1111d1ccc5baf634aaee90b79335a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613202, "uuid": "3298a41c-0c83-4b2c-8f3a-4350fd02d84c", "comment": "Malware payload (Mirai)", "value": "84714f3159c20ddb85d1b911fbe0f9684db1edd4bd55b85eecf3569f9eec9590cd0a61777089123710aa24f7548b7787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613202, "uuid": "e7674a9d-af8a-4278-98cd-409fa55a2bdc", "value": "T19B63951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613202, "uuid": "5f91f53d-4c4d-4347-bb5d-f96c6a849fd2", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAQ:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzLL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613202, "uuid": "e6151533-9ed6-4b3d-93e4-7f3795063353", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613202, "uuid": "cda8163f-afc4-475a-af68-7a5eebb81bee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613202, "uuid": "712b23f2-36ad-4dc5-8eb0-f4ad9eef8398", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f685c1-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667122, "uuid": "da2e4237-a5e3-4906-9263-0a65134c33c2", "comment": "Malware payload (Mirai)", "value": "c5db1cb37485342ac20c8a8a7ee11766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667122, "uuid": "c3949204-f1cb-4fd3-b404-d103237cc471", "comment": "Malware payload (Mirai)", "value": "1c2f16524fd6a2934eadb72cfbb75a802058d27d500117bd00011cb348da22fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667122, "uuid": "994595fd-31bb-45e4-b4e5-212b4d2c41af", "comment": "Malware payload (Mirai)", "value": "1d6d91122ba8064653c880eaf697650661b73995", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667122, "uuid": "8e37e117-a84e-4a74-b45b-73eac803a59e", "comment": "Malware payload (Mirai)", "value": "823cb37c00c4d15e8f32260a1a0a15ee6c8a9240c0b7704006dd706904bbdfb46550f39d56ba010ec2a72901745e9904", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667122, "uuid": "cd6aea14-cc3f-4022-842b-20bc63095d7a", "value": "T1B57301CE74852FC7CFCD4C3E55CE26DA54F890A51B6F27A9931AC6D8D82880B361E830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667122, "uuid": "5cf78c62-6ec0-461b-b0a0-89deb12fe425", "value": "1536:ymXpJU8I17A6kv8VT1vtu6Z/+s1NSONNjqJLS/EiUpp9naUGi:fF76kvCTjZ/+2NGJ+9Upznag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667122, "uuid": "d1a07974-f017-4b2e-92ab-f05325e8b300", "value": 76736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667122, "uuid": "8b730136-17c4-4ed6-a0ca-c7834535a5df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667122, "uuid": "ef1dc623-6256-4adc-8218-d6425479e895", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5a605f-d83b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765641068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765641068, "uuid": "afec3e5d-90c7-4e96-a89a-6e6e81134784", "comment": "Malware payload", "value": "a865dc78f10aaf231ffd35b9c1dfe437", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765641068, "uuid": "0cd20136-f418-4944-b88b-25ba4e2d174d", "comment": "Malware payload", "value": "1c99acdbfc75df463296d609ff801a9000ecdb80c19df2db246d0ac1c76aecc9", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765641068, "uuid": "48e8f5aa-0fee-42e8-8123-812b8fbe4715", "comment": "Malware payload", "value": "898137727d65ad17d937b0515372a0844fdc4da2", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765641068, "uuid": "03db8a00-a5d0-41b3-9d4d-a27a72c66cd0", "comment": "Malware payload", "value": "de7b2b5ad011ece9303f45c2ff499c0a232dc7bddad617b6f4c5edb7fe3452bfca4f1c92bc6e79377108b4890c56b40c", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765641068, "uuid": "8c46158d-ef95-4b41-94c1-7210879cdfe3", "value": "T15DF4E9F0FF02E4D1D16A4A77F1A92A146234E633D6C85E6B1064A7680EF1751FC2EEC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765641068, "uuid": "98f89426-66b8-42bf-b3a6-bc76eb7dfbde", "value": "97eb29bd3befb7cb1297d3015ad11d2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765641068, "uuid": "c1c496fb-20a8-40ef-bb8f-b07bfdf6b348", "value": "6144:XR7AyNLmQuqtYJoNkuhIjMPhnJ9Eyb3IkSYYCykSlVd61axxdsZK:h72aYGCuhA2/ZykSo1axxdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765641068, "uuid": "33747ebc-617d-415e-9288-0cf6d7efe9b6", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765641068, "uuid": "a05e7255-3340-4d68-b05d-934af5eb832f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765641068, "uuid": "fd81729e-a4b6-4500-ab31-57a406a5dde9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7fce37-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613208, "uuid": "babee518-5df0-4564-bc1a-3dfa050a7cc1", "comment": "Malware payload (Mirai)", "value": "2e5b84f2e6cd23402442e20bce3843dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613208, "uuid": "b47fd8ca-be60-46f9-bd79-2a9e47572a70", "comment": "Malware payload (Mirai)", "value": "1cbee5b7b1de3ae6b5f760ab78e9f143601bcbe76ae78435c58fd253793bbcb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613208, "uuid": "bc94470d-a12a-41f8-8675-a67664e50ef6", "comment": "Malware payload (Mirai)", "value": "e3959471c6920db517c777fa4a1ea5fa4388c1f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613208, "uuid": "65e76dda-744a-4718-a298-d54530a13e22", "comment": "Malware payload (Mirai)", "value": "1813215a14e050453d393e1513773fa5abdb9a953f7bb0aa1b05844c0b3101ea1fd8e13b50ed0957fc2589ddb8c25c3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613208, "uuid": "baaaad63-863e-4fc3-8e18-ba44e34367bc", "value": "T183C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613208, "uuid": "f9efd3ae-9ae4-4c50-b79c-3180821e4d63", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHoKrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuIKrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613208, "uuid": "b1b26cf0-3d83-4311-9d2d-f58702cb99dd", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613208, "uuid": "53a13d8b-6529-4060-aa19-83fd26fc829e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613208, "uuid": "ca5d299a-9fa7-4bcf-9d33-7a37e1323b4d", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8d0335-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667461, "uuid": "051e90f1-4442-4176-b137-a4022d90ca49", "comment": "Malware payload (Mirai)", "value": "c904bb6d5aec316ec57594325b31a428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667461, "uuid": "e90f6c1e-4933-4db1-ba74-6f8baa74d778", "comment": "Malware payload (Mirai)", "value": "1cc05901110280c30598599f62cea3af7a39f8cd920c2cce4fb40082c3e70314", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667461, "uuid": "d5eba103-465c-4caa-b4a1-7800227eda09", "comment": "Malware payload (Mirai)", "value": "8aea16b96f461d761a82169d8c61fa0cb6693e3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667461, "uuid": "0e2327ed-f011-43c0-875c-ed14e50a97cb", "comment": "Malware payload (Mirai)", "value": "d35a4bab865aa436e06aaff8d73958a7ec80501d5fe6b94fc7a0c33e58ca7556a7d1cdee5e39b6cf940c6f9a9532e826", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667461, "uuid": "5b4a3ede-872a-4a7e-a3eb-59f5abcbad90", "value": "T1F0934A22BA761D27C0C0A47A21F34721F6F287DA25AC8A1B7D710E8DBF256503657EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667461, "uuid": "aca340b9-f039-4ffc-a555-b86c09eb50c0", "value": "1536:LaUeSW1MzR2OQOT878JEC9WnB3mzhHIhzttIqxN+b5Yzy2E4JYt4Fw6G:LaSwMF4oEzzh7xNOYz9z2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667461, "uuid": "53058e6f-d9c5-42be-8eaf-4502e1a37ffc", "value": 96672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667461, "uuid": "6f3a2ca7-1f93-4122-be7c-b861059e84c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667461, "uuid": "4db09d0c-64c1-4e48-a15c-a27b5825c86b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d212e268-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765627015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627015, "uuid": "142dae36-3d01-4f28-a8a5-c95e220c3ca8", "comment": "Malware payload (Mirai)", "value": "86bd934232e02854854c18dfa4441209", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627015, "uuid": "d7edcc5c-7d62-4854-913b-52df6004660e", "comment": "Malware payload (Mirai)", "value": "1d1952332ecd562f7a9b436531b7d903fde67e45c5e3fc3c4c8a26069fbd4812", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627015, "uuid": "d5f74119-c865-4be4-8227-81e1e930a156", "comment": "Malware payload (Mirai)", "value": "d5a04e3244fbfcff0537e91a53594e71d9e5a35c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627015, "uuid": "790bedcf-c412-44fa-90b3-a1d945401ecd", "comment": "Malware payload (Mirai)", "value": "e7a982fb6a4ef52fa258f35854e147246305919fdaa571d815297dfa2ba878edce00c2863709c56625b12e29856be96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627015, "uuid": "3f0cc409-536d-4e77-8b9d-ad69168e9e3b", "value": "T1CF334931B97A2E17C0D9A57E62F34724B2F1524E35A8CB2E7C320E4EFF14944A6536B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627015, "uuid": "4d4ef6b7-aec5-4e5b-afc8-b43e0a00f2f9", "value": "768:wYHoeEiq9ppBV3lfAmuCaLeBb9fVI7VOCGN5FDxstO+NhIxy2:wYHaiSppBV1fARfLeBbfULhdJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627015, "uuid": "edf32194-47aa-45ae-984d-8cdbe690419e", "value": 50372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627015, "uuid": "48ca82d6-8af6-4521-8eff-7c157a3a64a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627015, "uuid": "b1314a85-b2f8-466f-9eed-8aa158bb602c", "value": "Mercury.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43830b22-d804-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765617327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617327, "uuid": "7952fac0-ee10-4824-939b-5e76a952129c", "comment": "Malware payload", "value": "5e2e42d82e23556c134e1c895359fab3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617327, "uuid": "0da2f8b0-4c01-4002-b014-bdbab836ac4b", "comment": "Malware payload", "value": "1dd4039f737b824e838aea6d13126b18377fda239777e5c38c1bc3b409ad07a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617327, "uuid": "daa7ba70-86ba-4837-9aa3-d3ab0bc6e4fb", "comment": "Malware payload", "value": "c9b11a01752bcdca459f7c73142883f156c793b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617327, "uuid": "42a9b3c5-09bb-43cc-bbdf-b0368218addd", "comment": "Malware payload", "value": "3c59d12bfb5a2206422fcb7ab75c74090a55d87d3cefa18827ca2c549848962376f9c7eb4db9e6a5c58ff8db1585c336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617327, "uuid": "00e5ff2d-653a-4701-9cda-b7153a7f8214", "value": "T10BE73323E55D2A7EE4BE953115A6A940483FBE90650BCC67DAFC3D48CE3E0501C2EE97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617327, "uuid": "500508ab-426d-4048-93f1-315a1e74bed5", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617327, "uuid": "22981ded-5e3c-4a6b-a9c7-98fc25509a14", "value": "1572864:Uw8NIzglOpkMx3v6GFkmKW8RsPy/2xdRX1uf:Uzazgl01x3v6rmKWIfeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765617327, "uuid": "1b4ce930-a473-441d-9116-5b0ec085d48e", "value": 64974912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765617327, "uuid": "d691f60d-75ed-4acf-8b0c-a9c4e23b46f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617327, "uuid": "0cdfe5fc-8860-4201-954d-20c6e8736172", "value": "1dd4039f737b824e838aea6d13126b18377fda239777e5c38c1bc3b409ad07a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88516c59-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615724, "uuid": "0b27eb8a-0e0e-491d-b33d-e5b4b358d022", "comment": "Malware payload (Rhadamanthys)", "value": "824d34fa9d341d5699e43db0028e9076", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615724, "uuid": "6756307e-76a4-44f2-b685-5758a63fdd56", "comment": "Malware payload (Rhadamanthys)", "value": "1e269f5fa2116c0f3705ba3c0b441d96ae61f34af0d6193636d577453aba3aca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615724, "uuid": "b83cbf9a-3e95-4dbb-b7eb-d2a63d3a8eb7", "comment": "Malware payload (Rhadamanthys)", "value": "c6412c9e4f3cb34094c862631892a3dae56bf3a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615724, "uuid": "74c601a7-026e-4bc8-8c47-d6c11938be5e", "comment": "Malware payload (Rhadamanthys)", "value": "b358c57138a20458ebadf69717ee632966277f44f7c12c60078965a5fb293b252c0b57835fd96f0af28644ca4d455872", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615724, "uuid": "5f9f21d2-e7b0-407f-a839-6dff2e8b876d", "value": "T13BA30B352B71E8B1A1C11141AEC64A75FC1606D50B02A6FD889FBBB705C922DFEA1FD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615724, "uuid": "d84595bc-6e57-4b7d-8c2a-fa84aaaf0f4f", "value": "768:GDhd0i7J4sYKgY/CMNfWdp1/WtgQrXa+rvzjRHZ2AFyqvSLAuAAroQW+FF+Ec+0G:GDB7eKg20kr7rvzjX2AFLv6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615724, "uuid": "e7443e34-a28d-4b27-b8fa-a4500617b184", "value": 104026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615724, "uuid": "9bc32152-5483-4318-b4df-6046afbb4656", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615724, "uuid": "e9863911-6d87-44aa-9e03-1ed8b105f4ef", "value": "invoice-1637482117.pdf (55).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07378695-d85a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765654162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654162, "uuid": "8a1bb4b2-b5f1-476f-a20a-f10eb05cb1ee", "comment": "Malware payload (Mirai)", "value": "8bc8b2e5c55bf6d6745a931b59b12a3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654162, "uuid": "18eb4944-5bd2-4611-a445-87b9ab65e5a9", "comment": "Malware payload (Mirai)", "value": "210eea53825c4361c3584b15d0bac3cc9913b8f811bd5ea52f298609fa327bc0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654162, "uuid": "40088cbc-6655-408e-ae96-5f8d2efa0b0b", "comment": "Malware payload (Mirai)", "value": "09b595486642a087d8eb12b961f2216dc38300cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654162, "uuid": "df6b1805-9cc4-4bc0-a9b1-a86f5acffa27", "comment": "Malware payload (Mirai)", "value": "0964762e772c7b955ed1d907774347dcbfb80108ebd392740ea90952cf4b8607a2786e325fe21bb289aa3241f064084a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654162, "uuid": "d686789e-8a2a-4b4c-89f2-db5163751072", "value": "T175A3084AF8819B61D5D926BEFA1E018D335357B8E3EE7202DD109F15378A82F0E7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654162, "uuid": "10ecb01c-2052-4fe4-8897-09270653fb5f", "value": "3072:IFdnwFaQ7Kyr0fYHNQw/Qav/y9E7incW6nv:IFdW37KtYtQw/Qavq9E7ic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765654162, "uuid": "11b71731-f89e-4535-8e50-ed2d5d177d43", "value": 102572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765654162, "uuid": "82e07996-1362-4fd6-be32-7fc1aa00b26f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654162, "uuid": "6737b5ca-2105-427c-9e8b-f30f7e8e91c4", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40206ab3-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607872, "uuid": "9a4db137-44b5-4b62-9cea-6efaba4b90e8", "comment": "Malware payload", "value": "3aa7e3f2d727343ead5e07148313b1ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607872, "uuid": "66d4b6ac-2c7f-4b1d-9d58-4898148e0c7f", "comment": "Malware payload", "value": "21363ec0ba00ab823489e791656d52fdcb8e3ae560b02d93fe05925a1ed65924", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607872, "uuid": "ad3d0e18-d83c-466d-9c14-e58227395299", "comment": "Malware payload", "value": "b3fb9cf22e1de9a97daef45dabfaaa31dcfedcf7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607872, "uuid": "87879e70-ef77-4e07-99d1-e42a06f2e7cf", "comment": "Malware payload", "value": "93442a309a3328973bedb9b3855336a77ae502b292d94a8dee06a5f0da8f01c06c26040799e3ddfdf96a0abde03d35da", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607872, "uuid": "454eb6e8-283b-40bc-85c0-4294b7c2bc69", "value": "T1EED4F110B482C5B3D57E15311934D6BB9A2E39240B70E9E7BB889E7F5E302C09A35E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607872, "uuid": "63854b65-2678-42a6-bc71-43e9e2cef467", "value": "d00eb0eb1e27d24881873cc3269d3f4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607872, "uuid": "240b819c-ca12-4905-bd8d-15daab73b04b", "value": "12288:4urul1FzhoAzc38xGzDt89DbG0qcPfwRi3uY5CarR6bUUWRvlx44C:vuHFGc28MVqnjqcP4suY55WkvDPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607872, "uuid": "14935778-a281-4541-8075-af339ec1f6cc", "value": 627024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607872, "uuid": "4de8bdd3-ad30-421a-a216-31d7f7fa33bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607872, "uuid": "200d19bb-d292-47ce-b80b-3888d839ce6f", "value": "21363ec0ba00ab823489e791656d52fdcb8e3ae560b02d93fe05925a1ed65924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13a4f195-d848-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765646452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646452, "uuid": "5a2450b3-6953-45fb-900e-317517d909e3", "comment": "Malware payload (Mirai)", "value": "35d0ea2ba3742a14eb8176fa4ff23717", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646452, "uuid": "f7c4440e-5f06-44b2-8404-5ff63b42c33e", "comment": "Malware payload (Mirai)", "value": "213f91481eaf3747c1db2bc1229542b69f42335262e3cb435db1dd9cd0f86dbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646452, "uuid": "1710d283-6bad-4367-b51c-91833a90bfdd", "comment": "Malware payload (Mirai)", "value": "b2fc58d1e89e532750ab8df0cb321b1100576263", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646452, "uuid": "eaf86216-2933-43b2-a292-f539f559429d", "comment": "Malware payload (Mirai)", "value": "e200696c6b7cfa16e5cbf02530c116f79b6cc5c42bb12450946e6d031feebbcdb2b26018fd9cefa267fef2b2c96e2d62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646452, "uuid": "c0ce6f78-8b62-43a1-8e5e-6a5e22b942c5", "value": "T1F1138DB2C56EAE98C11986BCA8648F7C1B63A10097736EF94B4546939047FECF20D3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646452, "uuid": "2a1c0463-aae0-4ed5-866f-93a0421949ca", "value": "768:Jajh/wtaR26zX1JeVnN3hJ7Dv/v/qwCENo4g5UYkCz1:Ja1/wtakgM7DvX/qw6VKYkCz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765646452, "uuid": "48c613d0-9090-40f6-ba98-513dc30537cb", "value": 42388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765646452, "uuid": "324d5c93-c929-4511-bb71-3e96daea1ca3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646452, "uuid": "944b734d-bced-46ef-96ca-5f480db9dd36", "value": "Mercury.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa75a43-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605313, "uuid": "4eeb70eb-15f9-4163-b5c1-75646eb45326", "comment": "Malware payload", "value": "c8a65b325a63c88295d04724bb1f37d1", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605313, "uuid": "caa3d944-98c5-4d19-b886-d50192ddcea6", "comment": "Malware payload", "value": "217a2b99079ab08a6e67a98729032cf1c499ba4a6e423ef1017581bfdfac747c", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605313, "uuid": "635a300c-94f1-421f-a171-21ea3496678a", "comment": "Malware payload", "value": "583cbab3f62022a93565f8498616d7726ff7b024", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605313, "uuid": "b3d76362-35e3-4e36-9c99-f3f7c855cb9d", "comment": "Malware payload", "value": "b0f93410a101d85bd109a8a6d6b9706797da55a30626df6c3222a12bc8248df904e61121cf6ac4ffdaa0b19bf1118ad8", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605313, "uuid": "9ba66dcf-009a-4acd-b029-4f2be698f1a8", "value": "T1D3D4C52BDB181C03C98971BE5E384314763BF66167F4C3B32C2CE5385EAB9496E19B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605313, "uuid": "6cbd3ffc-cb78-4884-9b08-c289836d46b5", "value": "6144:2UeB+cwZbo/dm72SVU/l2BI2TMz8te3/Ns/+m6PdB0qe3/Ns/+Ps:2UfM1AsUO2Qz8SP05s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605313, "uuid": "9e84a764-75e0-4932-afa5-b3f1c63d20aa", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605313, "uuid": "6fa1d268-472b-456e-a91c-9d012f20a262", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605313, "uuid": "a873c58f-abc9-4c08-acab-d09119b087ad", "value": "217a2b99079ab08a6e67a98729032cf1c499ba4a6e423ef1017581bfdfac747c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0b47b0-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613159, "uuid": "788b4d0f-a826-4da5-a9ac-aa9871b8f8f5", "comment": "Malware payload (Mirai)", "value": "f1fbb5516903ddae0831f318fa77c1fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613159, "uuid": "e72cab2f-8760-4613-af32-e89328564170", "comment": "Malware payload (Mirai)", "value": "21c00793030cf9a1f8c7f18b45d5265c5c9bc565c116edb5d392711b3c9dd73f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613159, "uuid": "9e7dd694-c5e2-4cfa-891a-51467f78abe7", "comment": "Malware payload (Mirai)", "value": "bf6b9c65c93a7482c7227dda6df2c6e1b212f1e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613159, "uuid": "ed952e14-6e4a-4171-bd29-905f275f1a71", "comment": "Malware payload (Mirai)", "value": "b8876ba47bf50b129c222adbd229f9ec7d59a7c0e7429b0ada3861d80ecfed4acb7467e9fe1ecdf518c3260cd7b3105b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613159, "uuid": "2916034d-0834-41b5-8e50-ff7151a53e9e", "value": "T1A6A2E055BF1886CBC832693451E9EAD212A3FC71F2DDCC092540C16FF4A33A96474F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613159, "uuid": "dbbc06ab-fea4-4ad8-94ce-a7c13fb0d3d5", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKH:798o08kxofBE+ZkXaqGbp2F2TWul0c52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613159, "uuid": "bffbf016-f783-4ffe-bb05-11a0d5d612ae", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613159, "uuid": "522cda65-65cc-4afd-8b96-5077d330893c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613159, "uuid": "306ba537-791b-4245-bc5a-da11cdbc862b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e34954-d7e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765602886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602886, "uuid": "aacf3f11-0649-4532-badf-d98871f11491", "comment": "Malware payload (Mirai)", "value": "24e5d1844fc5a3c3b4f79f90f0a1bd36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602886, "uuid": "15190c2d-0d39-4479-b5af-6df166b051e1", "comment": "Malware payload (Mirai)", "value": "228ef3d313653dfcbd5a9eb4c9fcfe7c262e3628d91999e9e9da736594c7733b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602886, "uuid": "2a8777de-9b65-4f68-9764-33904ec7a1c4", "comment": "Malware payload (Mirai)", "value": "02fa68883ec52e7a10c26b9d6431311b0fdfcdb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602886, "uuid": "1c7191fa-1b8a-4513-a66a-2eb9c5d72920", "comment": "Malware payload (Mirai)", "value": "cc900a98014992b5a602c859d1c372ca3d6df55b32e7148f8df6a38eaf3bf3852b7b5a9d45548e542cfae64eab030565", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602886, "uuid": "f948b737-4c56-4f20-be89-bd1fdf38c437", "value": "T183D3920E2E318F7DF769C33587FB4E21A75863D622D1C685D2ACE9011E6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602886, "uuid": "a1e7522e-a516-4ee2-b6c5-3d9703baac6f", "value": "3072:EQUEsP/8V3tfFzqy46DaNMSRpl/KOQF3IFaVrkJgiDZ79YIsM8kOMGloWct07ftl:EQUEsP/I9f4y1SRXExJ2fENf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765602886, "uuid": "2b6a6b06-4d4b-4160-96cd-1beb83892265", "value": 142732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765602886, "uuid": "d8e1b181-9135-4492-90ff-49f850d6866c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602886, "uuid": "8eabfa8d-ab42-4984-ab04-25a88faa252e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61d2a20-d809-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765619640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619640, "uuid": "135a3433-f322-4d7c-9632-5b9968ca6d22", "comment": "Malware payload", "value": "67cce6c13fbad9953b6cd09caba70eb6", "object_relation": "md5", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619640, "uuid": "ca982bbe-0d9c-46e4-9d80-95ddb3f1be80", "comment": "Malware payload", "value": "234e071a5ffe41cc17622b9a3d7af148e7ef3794f110150746e61a994ff6045f", "object_relation": "sha256", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619640, "uuid": "6ee8a145-45a4-4e77-ac28-08d7df2150f9", "comment": "Malware payload", "value": "e59825526eb38a9635416caa7c032c097f9dad5e", "object_relation": "sha1", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619640, "uuid": "41366447-a942-4bc0-a14a-b7f15fae942f", "comment": "Malware payload", "value": "d5e745d8aea284699fdde1d7a823bd63ef63ef722e1de4dc390c4f254e04c415e0945569af34861b9fc08da0b2eff2f6", "object_relation": "sha3-384", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619640, "uuid": "0ffe559d-13cd-49a6-99dd-5a30cddc20ed", "value": "T1ADB423B18DB36EF1BD54C55BB14F8E2C0E6589E0C38AFC8255D635E282D3F9206E7069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619640, "uuid": "8a42bc6b-7bcd-4fe3-a89f-9c5bf842834e", "value": "12288:otaO5bqxvAcYC235S8r2q7Jrn4d8btxFk:2aO5eGtlJvjr68bf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765619640, "uuid": "56e60403-6915-4da8-9565-314f7658e16d", "value": 538125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765619640, "uuid": "9d0c0bdb-6872-4d68-9e4e-e33ba040d917", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619640, "uuid": "b20f030e-c427-4597-9b8e-c6fd4bde402c", "value": "234e071a5ffe41cc17622b9a3d7af148e7ef3794f110150746e61a994ff6045f.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62c898c-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650268, "uuid": "7c2eb18f-cc16-419c-9ac2-91d868fa4f7a", "comment": "Malware payload (Mirai)", "value": "d6188eeafd647fc077d437fe9954a86e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650268, "uuid": "b1d82c10-e329-40f2-8191-c9eca784b78d", "comment": "Malware payload (Mirai)", "value": "23bf25a29ffbf9aa0443a78d6eb541d47a382743fb9f64cb8aa6e7e313938db9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650268, "uuid": "5ae1145a-8565-472d-866d-1687ef03a581", "comment": "Malware payload (Mirai)", "value": "2757e3bea333b17e4e0168a193140a4aad66fc26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650268, "uuid": "89ef6e60-7ed7-47b5-8d7a-a38be241c21a", "comment": "Malware payload (Mirai)", "value": "93b1ca3be3d51e59da6f83d33a5cd435a28c2c96927a1cff2bd4955fe5c6bd0986678ad6d713e9631e7fb9fb330c4352", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650268, "uuid": "b806c791-e638-4a65-b7f8-ab1c3dfe9263", "value": "T1A4D45B02EF481FEBC4AFCD30866E831B15ED999703C1A77461BC895CBA8966A4FD744C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650268, "uuid": "6254c60b-847c-41da-8c30-61408c32f792", "value": "12288:U0MJpWEcRXHDVDKL//G4OmD3HDsZwHw9hjQcvRCDKyruZX72B1EFPMXG5CqJhBBE:sUipd9CSe4XbrjeOMghFb1JJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650268, "uuid": "42f5563b-b5b0-4672-972e-9dcd94518421", "value": 646096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650268, "uuid": "5456da6c-5fe2-472b-bd92-9ec50f52e5ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650268, "uuid": "51e29899-0bc1-431d-89e8-6b605f89d35f", "value": "shadow.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f865f651-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650272, "uuid": "97d7774c-fc85-49b0-b17a-210a794008d3", "comment": "Malware payload (Mirai)", "value": "63bc1693eb99fb47a4296b08c51f0761", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650272, "uuid": "3a5a8bf8-3bc3-4b5e-9f81-3f966ddff5e6", "comment": "Malware payload (Mirai)", "value": "245523525322fa76f77c85ea92485de4a7258a9ef84ee88bf6cb9ad698073bbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650272, "uuid": "5fc4b986-4ae5-4a42-a87d-2b80e76e61ad", "comment": "Malware payload (Mirai)", "value": "f49870e2e222a8e1dd0fa28d6ba15e5be1e69313", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650272, "uuid": "b927db88-191c-408b-b4c0-2e18b8be1f90", "comment": "Malware payload (Mirai)", "value": "9da572575994577a336a7f0ff0e150b0427a7c8e4f4c2445230965be32b39d3b4c78062b5a83a60e3f1bceaf81c110aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650272, "uuid": "2f3f30fd-2c20-4cdc-b254-4321c0dc7404", "value": "T165D46C6377228F94E364E17105F38B659A9521A30EF294C2937CD210BA50B6D6C7FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650272, "uuid": "0bbcdbd6-eed3-4ffa-b411-6e537a5bc772", "value": "12288:Nrsia4I4YquaF7/H/qde7d/rNm6PuGbmP8p8/4BXp:Kia4IauaFDfqdex/rvPuGCb43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650272, "uuid": "1171bc5c-6c2e-4a74-9258-fbb30729325f", "value": 646544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650272, "uuid": "04b94920-9e74-46b0-9b06-535f3f04b54a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650272, "uuid": "376021ce-385a-40ae-8370-b73702bcf19e", "value": "shadow.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b10895-d879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667845, "uuid": "9723b64e-22e8-4304-91d2-c751f0bdb2b4", "comment": "Malware payload (Mirai)", "value": "3810157558089769353cfa9d9bd72762", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667845, "uuid": "b559e29f-daae-4fc1-b283-29f06e560a00", "comment": "Malware payload (Mirai)", "value": "24e181b593519b727fe1ceb85d0a83f050c8ce20b4575c026fff4ece1df1db2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667845, "uuid": "a123e7d7-1f85-451a-bbce-3133ce29dce1", "comment": "Malware payload (Mirai)", "value": "b6f99e022a7dd804eba4fb3774b76c77e3ad80fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667845, "uuid": "e0510041-40d7-4de7-b791-f55ceb0188d9", "comment": "Malware payload (Mirai)", "value": "a9bdda74c111901606ad17068dc96a45e2caeb04eae6c0411f999e6186ef8d87d44281595890a21866c43c66fab0e1e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667845, "uuid": "b99d7d87-8bd8-4d32-b3c2-5c352ae08d2f", "value": "T1B2F36CC5E683C4F6EC17057110B7AB36DE73E13F202FDA82D3B99A22ED51641C61A66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667845, "uuid": "16a34560-d0eb-4a9f-98ee-e171da8701ff", "value": "3072:zCb5I7AAKJ9O+ueeYZC6HEKMWsNf9ZoH0iIdyrh5KK6JhIB1oprz:Gb5GtKJ9OAE6kJWHtIY/KK67prz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667845, "uuid": "eae1b970-97c3-43c7-8bbb-cb79c76a5446", "value": 158216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667845, "uuid": "1f774e9a-5f00-48de-aacf-77818f1d564a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667845, "uuid": "4bf96a5f-4660-4924-8319-a1c1fcaeb2b5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0a3190-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667458, "uuid": "206977f4-f97f-45d7-9eb6-b1a9a4977769", "comment": "Malware payload (Mirai)", "value": "1276396a5ac02e45538f5ceed54c8e69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667458, "uuid": "6912b51e-d45c-4b9e-a8a0-1dc586e6814c", "comment": "Malware payload (Mirai)", "value": "256f781d6ee2f2f367bad65c5a2936977afb66458af4f4454db48f657a67c77c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667458, "uuid": "f0d6e07a-624c-413e-8e33-a29019e71556", "comment": "Malware payload (Mirai)", "value": "45419c6d38241d331d362b06f24e5adc38bc9953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667458, "uuid": "b65bd5c7-88d4-4ee3-86f0-4a99ce2e3434", "comment": "Malware payload (Mirai)", "value": "f4407e283580caae21a3fb9069218b158a5a164cd52632d20df8ff43024687ed379427e3194a27365c6fc6e61920de0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667458, "uuid": "18b03bb2-0b27-4195-a1cb-702f285a1899", "value": "T1DAF2E130D3FA39638BB190B6F1B80A40627205F1C4D63435AAF72B61F1CC5952AF46DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667458, "uuid": "acd766b2-d153-498b-96a8-2c3cc49ce325", "value": "768:1XLq8n6b1Slbwfu2AIsuXnkk70t83BjJfdN5HRZO8s3UozI:1R6xSamSXnv7tVJ2zI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667458, "uuid": "c636c7d7-2a9a-45eb-b913-5d32e6f1d1fa", "value": 34760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667458, "uuid": "b70ab82e-c054-4cc9-992e-e5e7f8499f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667458, "uuid": "0f33f55c-88bc-46f5-b5a0-ad310a109079", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78315fd7-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615697, "uuid": "91fef359-7176-4ec5-a492-0c353c87d848", "comment": "Malware payload (Rhadamanthys)", "value": "0cd65722d628d57f97a3b8d8ffcc2511", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615697, "uuid": "16d2ab12-371c-4a8e-b663-bb1ff3adec85", "comment": "Malware payload (Rhadamanthys)", "value": "25a12e36ccee1c15d917199044eced5f585314b41d6988dd3f69992209be8838", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615697, "uuid": "b52f7328-c175-41e6-8aff-ff22b1518b7a", "comment": "Malware payload (Rhadamanthys)", "value": "f84f3a643a50f03502787d32201e66a835667d64", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615697, "uuid": "42eefb1a-0902-441a-874a-362e9de07a04", "comment": "Malware payload (Rhadamanthys)", "value": "e3eb4a73e6988ccd7d03f1d791b8d6d73ee689b3e9d4a6819f13f23062146dfe44708df30065c1ac3ffafd3c44b9e8a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615697, "uuid": "4e75bd14-a5ab-4090-b767-da052dc4def2", "value": "T1B3A32C4859D3EEF904037B8E6E40AD986413692542C111BB3ABEFB87421E739ADD77C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615697, "uuid": "533ea8e6-b585-49c3-bd86-8101677ae7ad", "value": "3072:GDB7b0xj88NqP0CnXFKeHwp1RuaUgY9JIl8DlxLeqRP0KCrO1pa+jEeMqd0tsw8r:0oj88NqP0CnXFKeHwp1RuaUgY9JIl8Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615697, "uuid": "09004b35-8e28-4b8e-97af-f50bfc876007", "value": 98766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615697, "uuid": "5c49c046-02b5-4e9f-97b2-dcaee0af79b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615697, "uuid": "4cf1f5b5-2f21-431f-826c-706b821a44ad", "value": "invoice-1637482117.pdf (56).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814adf27-d81c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765627738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627738, "uuid": "a777caf5-7331-4f62-bfd7-83862b6d9947", "comment": "Malware payload", "value": "9b2f8f45a825e11f209fb4711068d1c1", "object_relation": "md5", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627738, "uuid": "84f9db6e-518d-4afa-bafa-4c9127083251", "comment": "Malware payload", "value": "26140fc16a31e3ea9b548ff80d9076d9877d8d94f06faec9764a33d93a847eb4", "object_relation": "sha256", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627738, "uuid": "85845134-af72-43b5-b3b9-0c38f09cb163", "comment": "Malware payload", "value": "ed84f4f3af2da28a8bab3114a6cd101cd0ec3ecb", "object_relation": "sha1", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627738, "uuid": "04a8de0b-00f5-4702-a562-95e1239ba0f6", "comment": "Malware payload", "value": "8ebdfb5a93a8d403ec37f450ec4166510502d2e94e51d67daae97cc2e59335f69a46e36bec5236074cb06ae702461fc4", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627738, "uuid": "66caa884-4b98-432e-8410-d5b7e296b457", "value": "T1A4E6335C4D3EACE7C11BFBBA1AB40755F299430593E19A021F364F91ECB5E460B9B388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627738, "uuid": "a8ceab04-3710-4ac1-997a-1233a8aff1c1", "value": "393216:2Ei12Blozu85lNGZT0ZpxXQ1FOiVDWLsEXJEfjj3iv:2L12BlC5lNGoZpdqYLsEEv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627738, "uuid": "00ef7bb3-87c1-4c19-a633-415f7c8eadf7", "value": 15091734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627738, "uuid": "a4d956f3-923c-4d45-9a19-989a345dfc4f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627738, "uuid": "c583ad7d-e142-4391-bd88-2205302d4e25", "value": "26140fc16a31e3ea9b548ff80d9076d9877d8d94f06faec9764a33d93a847eb4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3873719e-d81c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765627616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627616, "uuid": "38016483-6e47-4758-a8ec-a2511e3eb4ba", "comment": "Malware payload", "value": "b4942e4125221b2be0916048d2d566d7", "object_relation": "md5", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmtravel-it", "colour": "#F291B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627616, "uuid": "1f8cdcea-b917-41e2-9321-5744d011dc36", "comment": "Malware payload", "value": "266457d2d50ad7ac7d59105f441a718fa01f196140bf847de28a94cce66de50d", "object_relation": "sha256", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmtravel-it", "colour": "#F291B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627616, "uuid": "2681d0a3-beaa-4349-b6e9-868e56725e50", "comment": "Malware payload", "value": "69bdab267632c30e58b911d109c88c18a8cecd9d", "object_relation": "sha1", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmtravel-it", "colour": "#F291B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627616, "uuid": "085639d0-ff72-44f7-8e3e-5a36b92258ed", "comment": "Malware payload", "value": "542b62d6a88840a38edd8ddcceada3b95bb0e833e2fefa866b0dc736fcbc3a80725474ffa7b90ed51d60b7a43f846229", "object_relation": "sha3-384", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hmtravel-it", "colour": "#F291B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627616, "uuid": "d5099c27-f1d5-49e5-a9e9-db2e1a72a116", "value": "T1DAB62982E0B5E3D5E8A0C030E3E6D55B96622CF96F520A88D51AB2803D77DEB1FD517C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627616, "uuid": "01356e83-63bb-425c-b41b-68c6edec1c02", "value": "3f1060acde5de8c0d407d6695c4ab56e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627616, "uuid": "f306f254-59b4-400b-9f8e-9651f7ebc788", "value": "98304:yu47E+PDZsennJ1qIDI6ZBkpB9H6o1Rax:yPJDZhnDq8H8J6o1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627616, "uuid": "9165cf60-dac9-44b9-a225-cfe36b27f6e4", "value": 10836480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627616, "uuid": "f9377a69-2822-4046-bb76-577328834b96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627616, "uuid": "e6f4fe6c-3bd6-4a80-a244-bf3bbfa8e902", "value": "266457d2d50ad7ac7d59105f441a718fa01f196140bf847de28a94cce66de50d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d12f46-d87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668357, "uuid": "7b13221f-6c46-4731-b79a-00a3cba82a79", "comment": "Malware payload (Mirai)", "value": "3074c137e76d619af6b04c0655c9948e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668357, "uuid": "842f179c-af64-45c3-aec6-75fd6aa9b246", "comment": "Malware payload (Mirai)", "value": "2680d8bba3109e1c1bd0d77b9aafb81d41b9f5117d609895c453bbae58b0a451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668357, "uuid": "6c87b876-993d-4518-bc9f-c45ce3bc34ad", "comment": "Malware payload (Mirai)", "value": "9b00516980f1329092a90cd27f27a658a685148a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668357, "uuid": "a23b7094-2617-4ada-8c7b-0fd15a88ad60", "comment": "Malware payload (Mirai)", "value": "cfe853bbe7f6664a7c1060ef7d52773a4d1461df5acc5ea2f9ae3c5701239143dfab8ca9d68741c2cd0013ebc24f2510", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668357, "uuid": "ca75e8bd-e73c-45a1-a8ca-bc15b9d3cfa6", "value": "T1A7A3074AB8819B51D5D522FEFE1E418C335357B8E3EE7212DD10AB19778A82F0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668357, "uuid": "fe55ec1a-fefc-48fc-ae41-71e85cb19e30", "value": "3072:ewl5gP2huk36Is+qMjUuDwy9D7intpW6nv:ewl5u2hvKI1qMjUuDL9D7itp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668357, "uuid": "2501ad28-329a-4f72-8195-c124fa79ea9c", "value": 102620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668357, "uuid": "770b1b7c-f9ef-4bc3-9ed2-54d052755c42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668357, "uuid": "ee230307-1f25-4046-b473-44f64ef0bcee", "value": "splarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98407617-d878-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765667291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667291, "uuid": "a308dab7-26b4-43a5-912b-dde21f24d2b3", "comment": "Malware payload", "value": "070145865023c81a5bb636cf39b2b88f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667291, "uuid": "7dd7bf5c-f9fe-4d67-bbf1-b42d88627b2e", "comment": "Malware payload", "value": "26e9a888accc59d766b101af19534f1fc92f1007c82cd0fc2833c369344eb2e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667291, "uuid": "99ba521b-070b-44a0-919c-ac16dc1453e6", "comment": "Malware payload", "value": "69573dc5d4598b5ad4c2947fa472236cecb96f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667291, "uuid": "f082aed5-de8a-4e4a-a953-e5f7383716ca", "comment": "Malware payload", "value": "47dd1f8ab48c1841172952cca299f9fca36908d45dea7710df34640a7353ad8f89c195be076e02836d84ddde5c23fa3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667291, "uuid": "4f909204-7caa-4fb4-b183-144a38bf4da0", "value": "T18C333C89B411AD7DF88BE77F84230F0CF521375520920F2B66AAFEA35C723945D56E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667291, "uuid": "64ddee79-935f-4389-a376-bd7bf8c179f1", "value": "1536:2R7kJv5iroEU6yBWsV8ueZqBoN/KfoUozy:2R7kJ7EUBHOw+K5+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667291, "uuid": "20ee2005-9edb-4e0a-8e84-d0c924b0e673", "value": 50996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667291, "uuid": "8c432da7-eb76-463e-8dea-4de406708bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667291, "uuid": "c431538c-dd84-4843-8c67-9433143aa6d1", "value": "zerm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4a3352-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615756, "uuid": "c90f68c7-82c1-41f7-b57b-3783a813f02a", "comment": "Malware payload (Rhadamanthys)", "value": "d55be24d0624c9515b96aa0a780270ad", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615756, "uuid": "ef2c244b-3161-4d0b-99f1-bd25bb8703ca", "comment": "Malware payload (Rhadamanthys)", "value": "281a466b24bd1ecdd1390b34527d85d652b3b41fbf31f9a8e7951e9afc5ba94c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615756, "uuid": "b329d4f6-0709-4a46-b07b-3fde74582b70", "comment": "Malware payload (Rhadamanthys)", "value": "e70c59376a89c35a5032ce9ce494912c605fe0a6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615756, "uuid": "9078040e-92e6-4e9a-a09b-72cc70951c12", "comment": "Malware payload (Rhadamanthys)", "value": "e78e7decd0d01d1de126b21e0fa32b6ad1365ec3d28f47ff3979298d66cf272345f19f0646fa48929ebb78ff1a35213e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615756, "uuid": "4fe6ba83-9bd6-4910-8698-a7c9c5467180", "value": "T1D6A3FAC48FF1A0ED101AB7492EDB46E1DD0FA8430A176069256FF3212054A7F69FBADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615756, "uuid": "720adfb1-9b03-4452-8c6f-b3041aa92b67", "value": "1536:GDB7eKg200xex3Va29UUP3G5Pn9v91qAy1XwlxYCDMcrGcwN2Zg4aKUN2gHjrll8:GDB7b0fnLUoQC6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615756, "uuid": "d7fee1c0-aaa9-4100-b3a1-ed1f73c378fe", "value": 98135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615756, "uuid": "09368c2f-6825-47dd-8544-6823c5c8f4d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615756, "uuid": "ded92218-4860-452a-91cc-6d8335cc088c", "value": "invoice-1637482117.pdf (47).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95cd59d-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605472, "uuid": "06ed18a0-d85a-420b-808a-5d385c2b3dc5", "comment": "Malware payload", "value": "85c2314b07948cf8e7bf2f800257408f", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605472, "uuid": "9da08b2e-46c1-4b46-88eb-7888d48b8bce", "comment": "Malware payload", "value": "28204f81586457f3f835a64aed3ec82eb8b100b4c3a6446bb2f9f50cf06cbe20", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605472, "uuid": "a78e820f-9c1b-4680-b8ad-905f7b4f8423", "comment": "Malware payload", "value": "48d41d6131ee66c6f598f61cf842826720435de8", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605472, "uuid": "b7b3620e-2265-454c-b10d-4e3304d5874b", "comment": "Malware payload", "value": "250795bbce2e46d965d6463dff7c7ce461078638ec021399bd89e7ac3711041b90326ca4144e631c05a127d836467102", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605472, "uuid": "66dfc407-30ee-414f-9895-05e697611acb", "value": "T1F186F80B3F9E943AF11FE2FC6672A117352678E1580C40E17571DB0789C6B2EAAD4C7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605472, "uuid": "a3dc3d42-91df-4d2b-b283-969f9ccf4cea", "value": "49152:JE6oVqSu3HfQ+v1CTc15xnUshL2W6+N9apbmXIEozjdjbvbmAj3fvd:aVqSu3H1hD6mXoz9bvbxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605472, "uuid": "22028cc6-a99e-446c-b666-93a535c8c929", "value": 8271456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605472, "uuid": "fcee8f03-27d4-4858-b33e-a9833e2d9010", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605472, "uuid": "5246d19a-17ef-4c45-ae6d-8b5936414b19", "value": "28204f81586457f3f835a64aed3ec82eb8b100b4c3a6446bb2f9f50cf06cbe20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1026e1b1-d81d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765627978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627978, "uuid": "ae187fb6-63f5-446d-8ce6-ea059b1e8415", "comment": "Malware payload", "value": "9411d097a378150c63f322cb1421e669", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627978, "uuid": "6305764b-5119-493e-9757-2fa3de5345e9", "comment": "Malware payload", "value": "28679adbb73055367ad300e93c840ae13846db9ee544118df45494d0253d18af", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627978, "uuid": "c7ec3928-bb95-4163-9ab0-5a5f84318d95", "comment": "Malware payload", "value": "97b712852a231c6408a896815c313c702d08fc15", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627978, "uuid": "e3bb0497-ee99-4942-a1eb-3257275497de", "comment": "Malware payload", "value": "b7acc74d9fd8b46081e030f6df8dfe7c54a9b6bfb14ffd39ea1f81b4eef4266f4223369b2674e4e79369cbddda1c9408", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627978, "uuid": "29f0ea2d-ec49-495f-95bc-7f3a3ecfaef7", "value": "T18D4290169C451CA9017B452CECD39490FA9A5627097C3A17B4FE82883FB4851ADB0FBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627978, "uuid": "0b3cccad-98e1-4901-bece-f1594e1999d6", "value": "192:kH7wPzuny7pghSlcq+At2aXIqMo/+weOKV5XTRxyvnwWsbEx+DgT7tEFUCHMxfhe:kbI7sFrO7kWjx3O31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627978, "uuid": "af452f3e-b461-40dc-98fd-ad0b436d31a5", "value": 13129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627978, "uuid": "7dc64998-3857-4033-b4b2-739f92ac0313", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627978, "uuid": "dc6218e9-85de-4e22-a425-4efb2244441b", "value": "28679adbb73055367ad300e93c840ae13846db9ee544118df45494d0253d18af.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5735a6ed-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615642, "uuid": "ddfce85f-cb71-45fe-93ae-3144fb1be9ea", "comment": "Malware payload (Rhadamanthys)", "value": "8cea9ee32c47da0764703cf63d0ddc5b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615642, "uuid": "7d4a6e82-0bf8-4dfc-bd59-b142bbc20088", "comment": "Malware payload (Rhadamanthys)", "value": "2893e666e4706d17d6beebc4cf4ed67cbc87de6f51039661864e828fa64de2e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615642, "uuid": "2b49c515-7bf4-4d8d-801b-367934b8c6fb", "comment": "Malware payload (Rhadamanthys)", "value": "aec63909723dff7a7c2cc59f2c96fe06e8e5c24f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615642, "uuid": "a8cf205a-d9b9-474c-ac32-e3de28841086", "comment": "Malware payload (Rhadamanthys)", "value": "b80cf5f3d4ee4e727fea38e47f22d33a7683d98d1278784130ce50c92b55adec44f90747aa18e4ff1276af520ebf670d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615642, "uuid": "2ed0b3df-93cf-4b09-b454-cc8e86d3b412", "value": "T148A31D003FA2DB7C976EE3E62C6B95C8A8EF563D41C78451F724BE346129B1460879CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615642, "uuid": "a452bf3c-d831-42a9-94d6-3f6dc9706c6b", "value": "1536:GDB7eKg20Vx6xkr/rC+ax4YxTbxqxpxeAyxAxNxGEp6BkQWJ+aY:GDB7b0VThuHEp6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615642, "uuid": "96ee130c-683e-40df-b729-6e17fe3151ff", "value": 100822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615642, "uuid": "eb9ca6a7-ec04-4d32-8d52-11972cdbf3f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615642, "uuid": "5e13b543-41a6-4455-a8f6-2cc42025432c", "value": "invoice-1637482117.pdf (69).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ab0d04-d81c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765627764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627764, "uuid": "f77d9f6d-9ed1-4c01-b0e0-3d5938adf12b", "comment": "Malware payload", "value": "7bb2021c2a7fb42c49c55181ebc1f7bb", "object_relation": "md5", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627764, "uuid": "db01e3ce-7751-4822-83e9-d64b5ac6eda2", "comment": "Malware payload", "value": "28e469874db76c29dc8486623c15da5cd5e7b12ebaeaa5f7227ff7094124997c", "object_relation": "sha256", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627764, "uuid": "b673e698-aacf-492c-a049-4d24a4316250", "comment": "Malware payload", "value": "cdbdfa3d5eab3b30a7c457e1de7ed5bcebd465c5", "object_relation": "sha1", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627764, "uuid": "2011a182-ef5f-43b6-b583-33f2824938a4", "comment": "Malware payload", "value": "147f8afe94f6602b70556cad966c2eb273fe3e3849f693081dd80cebed18fa7601c58679029e47d4841d6c64e2423866", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627764, "uuid": "74246466-225e-4fbe-a8dc-2f4feaf9ff3b", "value": "T13EE633984D2EACE3C11BFBBA1AA40755F599430593E19B071F324F91ECB5D820B9B3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627764, "uuid": "31ffad5c-3bf8-4755-b79a-0813d152fcb3", "value": "393216:cEi12Bloemm5lNrAv0QrFpOrFOiVDWLsEXJEfjj3Hq:cL12BlZ5lN0MQrbuYLsEEv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627764, "uuid": "3ebfe0c3-1388-41f1-9e46-2f6759cc1911", "value": 15084826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627764, "uuid": "940fde94-16a7-4a55-a7d9-5ba665eeb146", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627764, "uuid": "7940f74d-26fd-4b3c-ac73-ed66a39c368a", "value": "28e469874db76c29dc8486623c15da5cd5e7b12ebaeaa5f7227ff7094124997c.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e300ce-d7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765588585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765588585, "uuid": "b4457d1c-98a8-4009-8448-50f771addc6f", "comment": "Malware payload (AgentTesla)", "value": "f1adb42dfc33e1505a5fb74386043124", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765588585, "uuid": "0702bada-e30a-4fef-99c6-7c7457d82d7b", "comment": "Malware payload (AgentTesla)", "value": "29552c03c5b07cf68861afe9d1298b0fdcd1c5dd4894b7cd617b8a4e3093c57a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765588585, "uuid": "cd33c0a5-6507-41f2-b17c-e33e5a7904bb", "comment": "Malware payload (AgentTesla)", "value": "47344d199b679f9b09b57594433a66d3c45ba0fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765588585, "uuid": "e9861e51-948e-4471-8650-ae15be56ae34", "comment": "Malware payload (AgentTesla)", "value": "2d8e9779261fff4862e0ada7a891874c9af59c9416644629c3a593bcf856b611a2c95ca17414bd87adef4872d5154ebe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765588585, "uuid": "772eb6c3-f63d-4f8f-98d2-74d9c93dc7e2", "value": "T1D345CF0273C1C062FF9B91734F5AF6215ABC79260123A62F13981D7ABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765588585, "uuid": "f5420388-d8c1-41e9-80f1-2b0a597c5381", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765588585, "uuid": "80102aca-dd53-4c73-a226-b0aabb3d5e44", "value": "24576:15EmXFtKaL4/oFe5T9yyXYfP1ijXda7bbrJhovtl7QW3a:1PVt/LZeJbInQRa7/HsTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765588585, "uuid": "caf7b441-25be-4086-b5e2-2251685a7fd7", "value": 1260032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765588585, "uuid": "8329b007-f00c-4e0d-a6ca-b5a0e785321a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765588585, "uuid": "8f7b64b6-b4bd-47cb-9bef-668a36f962be", "value": "New purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099ff168-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639134, "uuid": "7d77182f-74c2-450f-9a53-f77c01f50350", "comment": "Malware payload (Mirai)", "value": "b14e7bdfa896c8f809219fd19e787e77", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639134, "uuid": "7cd07a3e-0a87-45d5-ba1c-737de82a3b90", "comment": "Malware payload (Mirai)", "value": "2a1b1f02a8d6ac7bba7809d396b297602963e6bc7a282c6835fe52e2a75ccf05", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639134, "uuid": "19b2afee-849c-4231-bed1-548d876d2abb", "comment": "Malware payload (Mirai)", "value": "ded156458db124aeae4649da21b9b89236ebf0f8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639134, "uuid": "22070284-255a-43f1-8659-4bf19b4501cb", "comment": "Malware payload (Mirai)", "value": "f810285e70cab1e993bf82aa95c6d253de4f2e6d5c46da28ee01e3f172075fa3c799d18b0f18fb452ed316dc3216bfa0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639134, "uuid": "3ebde97f-e0b1-44b9-8bf0-72b7348801f6", "value": "T1E92180CF22904122CB09CF983C67692C6D8487ECE4A14B8C188E687A63BCB18F143F1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639134, "uuid": "bf3e44a6-2582-4de1-99d5-7dd3163416b5", "value": "24:aqsObL6qsjIXO6qsxNI5nX6qs1rKDg6qsUp56qsd+46qsfsp56qsBCq56qstuklD:ueLOoOOAXOxygOk5OM4OfM5OIq5OQklD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639134, "uuid": "cc6aa48a-8ee1-4529-892b-753918a1a282", "value": 1140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639134, "uuid": "b3d9caf9-e09f-4a1f-b6e5-d82d2b1873d3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639134, "uuid": "bc857a42-8fec-454b-8f70-4ccec1b7aaed", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38013244-d7d0-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765594974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765594974, "uuid": "aecb246a-12a3-49da-9ee9-3393e52760ce", "comment": "Malware payload (AsyncRAT)", "value": "fa28d83dcc60dcc64d1027b632ed412a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765594974, "uuid": "598871bd-2c6f-4b38-a41c-9bd5ed454ab4", "comment": "Malware payload (AsyncRAT)", "value": "2aa399344360149d415ab25ef29eb0bec7d49a86cb3c0f719909ecf6465230da", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765594974, "uuid": "05e2a003-53e0-41b5-84e4-2aa1cff64870", "comment": "Malware payload (AsyncRAT)", "value": "6f62eecbc01b30215970dbf2ff0711b10220992d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765594974, "uuid": "edc0df23-1bfd-4c2d-9537-f9adf5781a7c", "comment": "Malware payload (AsyncRAT)", "value": "027a643fb3f7c7d5dac14e80a44ffbfd390239e67b7d48f2d3b25128aadd35fed413ab817287b812eee45ea63ff9d335", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765594974, "uuid": "d4bd035f-d245-4b3b-9729-ec8a8b46c856", "value": "T1B8535B003798C925E2AD8AB4ACF2550146B1D5772106DB5E7CC814DBAB9FFCA85233EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765594974, "uuid": "6b3d5844-d52f-4b7c-bfff-459ce8e026dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765594974, "uuid": "63737fa1-e5af-4188-8efa-6c88a7394bb7", "value": "1536:6ptUWyBQPOF96r2qCGbbEwNjkDG4snXxVclN:6MWyBQPOFEKlGbbEAjk9snXbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765594974, "uuid": "5d49961a-f0e9-4567-a936-92340255f373", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765594974, "uuid": "2f893072-4296-4c13-a8ac-57ced6b95934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765594974, "uuid": "55060377-ec75-4f95-a253-b0705c5c4b33", "value": "version3_update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721debda-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765613110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613110, "uuid": "37dda8b6-1147-4c23-b45b-b8b8beb5df9b", "comment": "Malware payload (XWorm)", "value": "f36d8a12f5d1c55f8cb9bcc4221be9a0", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613110, "uuid": "e7e41692-45c1-418f-b326-b8d6e03e6111", "comment": "Malware payload (XWorm)", "value": "2eb43100d5acf0a5abec58a512a1fc8d3888b52d78de380475e13f129608f022", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613110, "uuid": "b22df32e-0796-47cb-ac44-6d79e601dc61", "comment": "Malware payload (XWorm)", "value": "75ee8a7331e00ec08022758450515e33355f6951", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613110, "uuid": "9391215c-d735-4449-a1c8-8cd4d0de9cbf", "comment": "Malware payload (XWorm)", "value": "2eef3765b0bbf72025834dbc9aae9e7e8204e68c6c29bf62bdbeb760df34a0ef94aef540c393ec8233177b551b1c450c", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613110, "uuid": "9afa1458-68d4-49d9-ab0a-e7169d67aaf7", "value": "T1A7E24B4877E08712D9EEAFF129F271091374E11BD823EB5E0CD4DA9A3B639C146507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613110, "uuid": "6c4e2f87-29bf-4447-bc1b-921d1d4f4b48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613110, "uuid": "2c66ede8-2e28-4cda-bd51-93b76570c5a2", "value": "384:xYaJWq4Ava7Rm32oDuuw3Esd4T0JVaIgL5WwTh0duDCOQAoraR6pkFTBLTAOZwpE:7xC3fMbYwTGdf5AoeDFE9jSOjhKbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613110, "uuid": "3c07a59f-43c8-4174-b795-0fbd2e42614c", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613110, "uuid": "db03dd61-fc74-4251-8e88-bd2e419c9462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613110, "uuid": "53663ef6-087f-427e-afc0-b499a8d861b3", "value": "2eb43100d5acf0a5abec58a512a1fc8d3888b52d78de380475e13f129608f022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed858f0d-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765608163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608163, "uuid": "0dea0920-8ad5-402f-810a-aefa2fab3f88", "comment": "Malware payload", "value": "41f99920b685d5445acea6ebb56fc637", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608163, "uuid": "b440ea9e-5e66-4c40-bc71-869ce3498081", "comment": "Malware payload", "value": "2f0a86b63e0c3cbdcaef5e13e70569a8225467343866a05cb8caa81c6244118e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608163, "uuid": "0c1565fc-3c1c-43f5-8c73-318d65e64eb0", "comment": "Malware payload", "value": "4f7cd4c32f4b50f18462cd1bafe526a3a8869c81", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608163, "uuid": "f346dbed-608e-4a2d-8b90-1fd557878058", "comment": "Malware payload", "value": "e566c37427551ed41d99786603fd3f900ff7185d86cf7d853bfb7e7b606d56c3b6c6d2320142e97c0b0cc483b35dbbb8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608163, "uuid": "bd0042a2-44e0-4ccc-aa07-0699106379fd", "value": "T11E55E062B942C0B2E49A0030A5B9DBBB2D3D35B9072490D3F7D949796A301D3B739F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608163, "uuid": "c2b266d9-06e3-4281-a1e3-bd631187ddef", "value": "d15363fe7543b1a474001ec498c42e1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608163, "uuid": "26935cfb-85db-491d-8226-5a68f352ec46", "value": "24576:ND5JU5xVmm+6uzofz/jNCcF0kJLrpVIiEsXwteQelECCAYug:bJexInRofz/jt0opVcsgteQtNAFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765608163, "uuid": "d3ba8fd7-c546-4fcf-bc52-d880a078eaf6", "value": 1285232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765608163, "uuid": "fd1981eb-d5b5-4860-b558-8abaf79c7406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608163, "uuid": "e5a2d47c-6829-4218-9b7a-20637b5c34b5", "value": "2f0a86b63e0c3cbdcaef5e13e70569a8225467343866a05cb8caa81c6244118e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e72e829-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615761, "uuid": "30269ddc-6a40-4744-8cb0-b52f0d5e73b4", "comment": "Malware payload (Rhadamanthys)", "value": "1db3bf28290269316a45c30e4b4e8eba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615761, "uuid": "38219b87-84ca-4b38-8921-3b8047f5862a", "comment": "Malware payload (Rhadamanthys)", "value": "2fd1260fc0303a878dd485c2302684080606f6532b44efd1b9b9ed68507bd59e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615761, "uuid": "b8bac731-b3c5-4cc8-8b8d-06b7e5edcac8", "comment": "Malware payload (Rhadamanthys)", "value": "0e80aa9abaf5fc97dc78d10105094265f951743b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615761, "uuid": "37f862d8-edd5-4a88-b696-62c9dde1b126", "comment": "Malware payload (Rhadamanthys)", "value": "ca91f4c0d3f9cb6d35c2c58471df8dce9def0496c092f36872cadad91278f2796f3ca14817a2323031120db8ce610237", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615761, "uuid": "28d54aa6-60e4-46dd-a8b5-219cd037df31", "value": "T186A32922B8577CF1409E21797FDE66D9C89D80919384AA9FA867F755923EF03B8D00C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615761, "uuid": "89168286-24db-4317-8419-3af3f26f5101", "value": "3072:GDB7b0HakaqvBmaNaOmaXava0aEaraOq06BkQWkp:0wakaKBmaNaOmaXava0aEara7pWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615761, "uuid": "ff28a17a-3ddf-479e-b67a-774ba943791a", "value": 99403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615761, "uuid": "7be1f1d9-03a6-4edd-91bc-c0c9cbe57043", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615761, "uuid": "f99bc21b-f638-4452-9226-29000e3fd65d", "value": "invoice-1637482117.pdf (48).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac81033-d875-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765665926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665926, "uuid": "46e5becc-b3a3-436d-a632-32dd23240ed5", "comment": "Malware payload (Mirai)", "value": "414f220368038e679ca3c8d3ba3bb0e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665926, "uuid": "16f4963d-f978-4405-be55-92d0a9dbb2b7", "comment": "Malware payload (Mirai)", "value": "3097b1f6872985b988d4e0ccebb15a00300d32bce5899c3b47935d5b3b05032a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665926, "uuid": "fa8b24c0-cefe-4aa6-9f84-be6598bfc2a2", "comment": "Malware payload (Mirai)", "value": "2397987b0ae3ff5f792284e940e5fe059fa069e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665926, "uuid": "4d7e884c-4b2d-4574-8555-8bd7a8028201", "comment": "Malware payload (Mirai)", "value": "5359b90c87fb8b90f83c9da7382b79c42c2211d2e1b497c24011109103cae7f49d1afe15ff1e1eabea500297a42856eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665926, "uuid": "99ef8212-6bb9-48ee-867a-c466a4f75e4d", "value": "T124C3B71EAE219FBDF369823047B78F25975833C627E1D546E27CD6102E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665926, "uuid": "7913fd1b-6a79-429e-a0c5-a281826d536f", "value": "1536:mxkM/VMuMwEMZ5zCjpyKyhO5gWgIAacV8XcfpwbmxeepNzP9UvsafU:s/VtMBwO5gSjcV8Xtbmx7UvsUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765665926, "uuid": "26d7793e-08f7-4a74-bc72-e238474c07c4", "value": 118220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765665926, "uuid": "9c9071c6-4e59-42e8-9e38-ce7984b13ace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665926, "uuid": "66227f25-542e-4096-9f1e-a951b1a53f78", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce828b8-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613155, "uuid": "110a9bcc-1dea-431b-b7e6-a590cbe3acda", "comment": "Malware payload (Mirai)", "value": "2f4cde446299be814014da57036d4c94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613155, "uuid": "25951a6e-ba79-445b-a6d5-1a309623d133", "comment": "Malware payload (Mirai)", "value": "30e4d96ddedc3eddc083867a36cc5450b4f5b30cf0af9574ec00b0c696080508", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613155, "uuid": "74b8dee0-5dc2-4457-b2a7-1901f00b8eb7", "comment": "Malware payload (Mirai)", "value": "d63628deb6470074592cb04990771e2a436fa083", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613155, "uuid": "027d5847-6623-44a1-af60-2826c6aaf5fb", "comment": "Malware payload (Mirai)", "value": "a6a666ec2a8171567366cbc99f0dfd0a08b6831499e12b9e9f108122cd8c850707eaf1acc4ebb66b56bc35d030742b2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613155, "uuid": "aa672cfe-2cf8-45d1-b5c8-5f919b2716fb", "value": "T13CC2D0E07726FA31C4206C3DE52B4D863A51177C81FF353664259C359FC164B67A88BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613155, "uuid": "a564aed6-1fdb-4f7c-99ce-2d66556ed731", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwr3G9q3UELuq:OKy4qfqoeJdXWg3rL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613155, "uuid": "b31d64c9-feb3-44f6-99d0-d36162797ba0", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613155, "uuid": "4c2adae3-ae63-415e-beef-989ee6c6248c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613155, "uuid": "5a03961f-7365-4ef2-af35-55a9db31c401", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2095d1c5-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615550, "uuid": "53da1b67-80cf-43a5-af59-44f8de0f2554", "comment": "Malware payload (Rhadamanthys)", "value": "2308acae653e9e0771b0a6d0db20d401", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615550, "uuid": "6168dadd-fd57-4d7f-bb23-cb0cc1a6b4ef", "comment": "Malware payload (Rhadamanthys)", "value": "31401f9933d640d7186f69870a001440e490a2121f787de4d67b398f4e941019", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615550, "uuid": "bb2e737f-a7ac-4f7f-863f-0a3b6b73f358", "comment": "Malware payload (Rhadamanthys)", "value": "7f16cf4a3459a9f6373e7378c6a17589581123e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615550, "uuid": "b58cf892-aa00-47da-9f79-d55c91f6ddaa", "comment": "Malware payload (Rhadamanthys)", "value": "163d2ed023e838d243cbc678f0767d9e57bc640f9b6460489d012ecc35e9807106f4266cc825419d9674092ab92bd792", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615550, "uuid": "7d9fa4a4-a47a-49a3-9ad3-02e920159c1c", "value": "T1C593FAC87F921DD4014A5EBD2ECB37F5B46F9DB20B09A1119507FB4230BAB21269D2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615550, "uuid": "ce527618-a183-493c-afc5-4ba58559d177", "value": "1536:GDB7eKg202+ufr7re4qNqYEBI3AyvKNEO6BkQWJ+aY:GDB7b02+uTHvq8YEBIdvKNEO6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615550, "uuid": "3203c210-4bc6-483a-891d-093e66372bb6", "value": 92297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615550, "uuid": "6d1005f1-c856-4031-af46-f0bed6b3961b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615550, "uuid": "8910702d-5e9f-4b1e-99b0-c6e042b080d2", "value": "invoice-1637482117.pdf (87).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74805922-d86d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765662506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662506, "uuid": "8328adca-f5a1-439c-83db-3620de40b69c", "comment": "Malware payload (Mirai)", "value": "e694def760460a65f05c73545e1ced22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662506, "uuid": "143b11f7-d7de-4dec-84d6-cb013ef7dede", "comment": "Malware payload (Mirai)", "value": "31bd29797fa746bc32318a4fa8f7e05e9372efb0b9511c867ada3148d5d4db5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662506, "uuid": "f74bc9b2-b935-46f0-aa9c-0c06f8021427", "comment": "Malware payload (Mirai)", "value": "0917677b26bb747435d8c1fbeebef1dd1d11e007", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662506, "uuid": "29f697f0-3c9c-412d-a365-a8e2d1d7b430", "comment": "Malware payload (Mirai)", "value": "1669e68661c9a6218de4ad601edc10c51ae21cb7cd4be40d3fca2999b70416327b63347dca74d3ede5102117ce512941", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662506, "uuid": "6986f3aa-9940-474e-8bab-bb27605e973f", "value": "T16B13E1D4E1006976FFE67CB86E82A7D037E9CECEFAAC9441127CF6199C528475F04885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662506, "uuid": "9c1315c8-fd51-4b2c-87da-f8769850282b", "value": "768:AotH9p4hoCoTKMoKbhjD5urfLEXQq+eU43xj8oXHo62qdzuXP14vOSBEyX4uVcqv:7tH71CoTKMo6hjleLEgq+x43xguo62qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765662506, "uuid": "43f70644-cc4c-42d1-93cd-eb7bc48dc8ff", "value": 42356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765662506, "uuid": "eea9f568-1d50-4983-a9be-4336eb9d0ea8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662506, "uuid": "fa57d137-8d82-4deb-b78a-364bcf5df455", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183d83d1-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607805, "uuid": "8b5fd729-5771-4f72-91ab-e66f2e1eb56b", "comment": "Malware payload", "value": "6ed3a898aa85ab88819c4cfab7bdf6a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607805, "uuid": "04fb1c79-9460-454c-85c1-805a2cabf286", "comment": "Malware payload", "value": "32bdde75714fe13e5706f641fb705d932e52d12cd7298ec32580719e715c5b9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607805, "uuid": "b5a73f9b-caac-4636-af22-35061b69198b", "comment": "Malware payload", "value": "bfad9509e5823052f41e33fc382acc2e7573da34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607805, "uuid": "a4f0078a-c2a0-46e1-af68-8498a8b41398", "comment": "Malware payload", "value": "1d7e5c56babbc6ddd94a76df0b5cc34bfe0da6975b03320f06e67ccb25284505f4a18ced2f35fdeffb65518386b75e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607805, "uuid": "335f1873-7ee0-4f41-9c66-7932b128324c", "value": "T1E8D59E062658DD21E2BD073918E246E4C3EC4415DED2CB1FE2A87D261BDD3E5AB2D90F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607805, "uuid": "143b8c7c-f708-4cfe-b350-456e0d8c630c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607805, "uuid": "586600dc-9080-444f-9693-d33b9c4b4a0c", "value": "49152:+xDzlYRV6si5tuuFDfn+g8hWlOX4tMX8O:+zYRcswfF7+g8hWI2MF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607805, "uuid": "7902c5d2-41c5-4ec5-886d-f9a69c7d2bf9", "value": 3014376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607805, "uuid": "09f5bb67-1968-402d-ad71-9f19f1250f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607805, "uuid": "fa544092-eea5-4e29-8263-7e59e2a442a9", "value": "32bdde75714fe13e5706f641fb705d932e52d12cd7298ec32580719e715c5b9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6465948-d7f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765611077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611077, "uuid": "a280aa0e-4680-41b9-9e79-c37a73bff258", "comment": "Malware payload", "value": "54e5ece20ff7b37d5326161a2835b3f5", "object_relation": "md5", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611077, "uuid": "f7167780-7736-4838-95cc-f6af8c5c6886", "comment": "Malware payload", "value": "32fe5b201bf6a61fa6d2dc73b0a584fdd1c1935d8c02ec4a6fe40cf834f2c2a9", "object_relation": "sha256", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611077, "uuid": "5d7fbdf0-610e-449f-8446-daf350a0eced", "comment": "Malware payload", "value": "82153d27e295523ea2c40f9995be6cc876999759", "object_relation": "sha1", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611077, "uuid": "523dc502-d0fc-4d1a-862f-fe65043c4c68", "comment": "Malware payload", "value": "1873e577da503269f2713deb3ea36ff679f1099e6f98a735c69bde54b3379c17f1abc48430a81c757cba9799d93bd597", "object_relation": "sha3-384", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611077, "uuid": "d570b7ee-c15b-49ea-9f06-d5e423b64aad", "value": "T13AB5AA85ECE8DC629A986BEC374144377517F94DF0FA3087B76318D60AAD8D016ADBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611077, "uuid": "d8984931-0cd1-4329-a401-77eeab4348f4", "value": "12288:MW4f7wxgW4f7wxgW4f7wxgW4f7wxgW4f7wxwnPnS:MbXbXbXbXbDPnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765611077, "uuid": "5e1bce97-5b77-4bbf-9c69-66d95445cd9b", "value": 2296329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765611077, "uuid": "7e8bc196-6488-4714-adfe-88421483114e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611077, "uuid": "4f3c56d8-38c7-460a-b650-f9e20acd6d42", "value": "32fe5b201bf6a61fa6d2dc73b0a584fdd1c1935d8c02ec4a6fe40cf834f2c2a9.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3614129c-d856-11f0-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1765652523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652523, "uuid": "93293111-c84c-44b4-aaf4-c45c06b3c256", "comment": "Malware payload (Cobalt Strike)", "value": "53d56b94a54f454043605351b7aa4b34", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652523, "uuid": "dcea3000-92ed-4aae-a38d-0bd4f7e52fa5", "comment": "Malware payload (Cobalt Strike)", "value": "330cde21f8324b44a2ec6f0471b5a790f1216423f91bd67c8b2fe80ed0d4bcd5", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652523, "uuid": "a9bc41d5-9c0e-45a3-bdd6-11f4cc946906", "comment": "Malware payload (Cobalt Strike)", "value": "0cc3526531b5aa30fb54fb8040dabd3e4fb52c1d", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652523, "uuid": "9c2c1984-f3f7-45cd-9565-a49022a0132c", "comment": "Malware payload (Cobalt Strike)", "value": "11933e4f1bb7fd9ee8683f0a94e9007befeb0a60d422f0b05c9f1bcb891782d4cb053343a0f4861384cb01613c1f4061", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652523, "uuid": "8a8fa26a-e204-401c-8ab4-3e84a1cdf6ad", "value": "T1CB65BFA1ECDA04ECC857A5FE9BDA9D77DC7734520E205BAB83F017352A274E4CEA6101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652523, "uuid": "f4709bd8-e943-408e-94b1-0cfa2145f1c0", "value": "fc0268739c81f6e6f671d1b04dd27b7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652523, "uuid": "c94abb13-9518-494a-9f55-56ce2ccefa53", "value": "24576:2z6qeHTlILOanmjEM5ycZW6vjDE7wUFeRK:26SJMH/vjosUuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765652523, "uuid": "60b26027-4f33-4216-bda1-63fe1a235c2a", "value": 1455616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765652523, "uuid": "552e41aa-9b92-427b-a736-c19b9b1a727b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652523, "uuid": "2e76a8d0-3130-45b9-ac8b-428a274881d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b455be54-d84b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765648010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648010, "uuid": "e9899cd7-dcb8-4a14-8a28-4577c9adc375", "comment": "Malware payload (Mirai)", "value": "00a0a07026947cf27dc27b9b77030e54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648010, "uuid": "36d405ec-f749-439d-9424-4e293629fd64", "comment": "Malware payload (Mirai)", "value": "331fc15394ece51a2743f79a01fc89687d2d894e87359e7a94b0ca092bf27bd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648010, "uuid": "c934fb5f-9d2e-4bc3-9816-a3412c57ebdf", "comment": "Malware payload (Mirai)", "value": "1e72555e6667a42582210ef5834b1b9a31a542d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648010, "uuid": "9815b6d0-73d3-45fc-a935-6ae21f2cb308", "comment": "Malware payload (Mirai)", "value": "b10c1144f1afa7a48205d4cb8efdcbb01118c4b8f10c42edb33520f5de3630588aff82b03e11f8f4632fa9b569826785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648010, "uuid": "a1b5703d-b430-4b00-afaf-d1f687c1c4e9", "value": "T18B046E9AF402DD7DF80AE6BF44670E19F930E7A13183172962D7FD93AD311A60D16E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648010, "uuid": "41ea5b84-12e1-4ca3-8d18-52086fd5c840", "value": "3072:ngehTd/+IFpmT3JK33c8Q6OGNqYrcrtRoybN/iFge8k0yTpQtnUHg7:gehA8pmT3031QGNq53oybNrFk0yTStUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765648010, "uuid": "f44d6143-4b8e-45ba-a388-9524014facff", "value": 179836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765648010, "uuid": "5cfcae4e-11c9-4eb7-a762-6b7ecc279b5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648010, "uuid": "e03d4234-9889-48ea-8da6-f27049c15341", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0ce120-d84a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765647357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647357, "uuid": "af85592f-38fd-4c84-a706-8daeb817a75e", "comment": "Malware payload (Mirai)", "value": "c49a5c4862f6c1a786c582ab03bed384", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647357, "uuid": "4613a3c4-a728-42d1-8375-78a5f7b1da97", "comment": "Malware payload (Mirai)", "value": "33a4495a062abd16e33945d54b2f0b8ddfb3f6ba5665f785236da30a98cc0268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647357, "uuid": "a20203d0-4558-499e-8c1f-4a7c94e8f8b1", "comment": "Malware payload (Mirai)", "value": "0ead6d91fc5fe9cbbd57f1a531ab4a6e5e8547a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647357, "uuid": "72a32d27-b3c6-40b0-a2c0-8e8ce8b7338f", "comment": "Malware payload (Mirai)", "value": "73ddbefbafc3e03e3b5696aa0ac2ff661c364ab47f106d636fcd61643f79d4a08d4ccc3b1ac2e8543d302bc776c44d82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765647357, "uuid": "9a230bd5-99e6-4d87-9d1e-87ebe5071cf6", "value": "T13C53F1B9D2B2864BE6F642362CA73B8A45CC7148762D09E5B7CCBC70C650FE59F18291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765647357, "uuid": "47df16f6-4088-41aa-8bd7-6ba53647d06b", "value": "1536:kRdSu5l5EaNSOZ3zyoLsW6KahIvS7kIId+b8mGpnouy8HyW:kiu5/EaNSV66nhp7kbYBG5outF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765647357, "uuid": "ebbd4729-1d06-48ab-9374-a54628cd3e43", "value": 64384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765647357, "uuid": "4bf56301-d421-4fd9-a9bd-37e8632537aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765647357, "uuid": "47f779c1-a3bf-4b07-bd27-740455aa13e5", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e3073bb-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613130, "uuid": "cabcfff8-9d5d-4cc7-aa86-0c1337ccc70a", "comment": "Malware payload", "value": "0eadb7f9cde1ce87bb4378bc57b4dc16", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613130, "uuid": "ec1d8999-ad60-4b4b-9b26-147600767ad1", "comment": "Malware payload", "value": "340bca0bb31f183216a4ee97b409eb2c5ba4cb27cb49b79e2f2e385ba4ec99ca", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613130, "uuid": "0de97786-32a0-4f0e-8fd1-08bd61dfe460", "comment": "Malware payload", "value": "655484e69e61fde059fd53713df16ea0888657a6", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613130, "uuid": "9f1fedd4-8f48-41cb-a01f-bf1a97090fdd", "comment": "Malware payload", "value": "6dda4d5010ec22e4421346da50b9c7fe0bca6a4dd3b59514e6e71eb74661a40204047f4822730ddaaf12b13ccac16bf6", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613130, "uuid": "b0d23f10-6786-4caa-8ae4-6a3b30cab589", "value": "T14B25230AB9C5CB4DD0A350B659E6CB039A8DBD003BE6D55B3214B70EBD3933B0A9635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613130, "uuid": "c43c4cb1-9e94-4496-a34c-9cf4f010ac50", "value": "24576:Ua4ANTtt3aPML7/jsWRW2WTochUiS+WwPZx:a+nB3/QUWwL+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613130, "uuid": "aed01671-e0b6-44ec-b891-c84247cb27c1", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613130, "uuid": "9a255fa5-99b6-460d-859e-fd5bd166677c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613130, "uuid": "ebe660ff-f86d-46ed-9e59-fd343c88d862", "value": "340bca0bb31f183216a4ee97b409eb2c5ba4cb27cb49b79e2f2e385ba4ec99ca.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37dfc915-d846-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765645654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645654, "uuid": "a6517025-9898-4cf7-9cf4-5b0291f0b742", "comment": "Malware payload (Mirai)", "value": "0f7662d60361196f93279376d7e5a811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645654, "uuid": "c3d5ce99-ccbe-40c1-8979-9b76e54a6dbd", "comment": "Malware payload (Mirai)", "value": "3527cc56b0de4698317427fd0285fcaab71ca02b606ca4952fe655e9386f608b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645654, "uuid": "23709354-26f3-4575-a7db-08673324a7fe", "comment": "Malware payload (Mirai)", "value": "6fa5649e407b9c22f2ef8c8805c37f4bdc35912b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645654, "uuid": "49a2706f-6a6b-43c9-9117-6f3bf6edfa7a", "comment": "Malware payload (Mirai)", "value": "0b8f00fd05997dfe545b2b521dfb7cc59ef6ac7364fdede4c0ef07a1cbe7ec7f8e65909f20f495567bf6a99747c00555", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645654, "uuid": "4c57eb4c-4fb6-4021-89a9-65afa5044334", "value": "T1226302FB31A39B72D193A0715144A6D4BB86721FC78AEB7B0DC8A6714F53CD1C663620", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645654, "uuid": "86546243-7efe-49b7-9bb9-4a969a048b3b", "value": "1536:dBXKXFUBRJJGsRLoA5SsNNFGNjBZvynmGTgjzRMcObA4Yc:kFsZpaAcsNzAtlicJxyJYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765645654, "uuid": "0742c274-bb6c-49c4-bdc8-3c07e8d8b27c", "value": 71580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765645654, "uuid": "b8d07be0-978e-4287-b2c7-999feae7816a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645654, "uuid": "01c66df8-a828-4f7a-9af2-d74862f740f0", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4a1863-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615917, "uuid": "76d38561-cc74-4c28-b765-622ddf1b2ffe", "comment": "Malware payload (Rhadamanthys)", "value": "d1fcbe2d4e8dbb663fae882623d762f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615917, "uuid": "4584f937-d419-46e4-b547-e2654a8dbf1e", "comment": "Malware payload (Rhadamanthys)", "value": "35286b1a2a3f11cfe319b64e96ab2826939836781e8f90f0eeacfb912a065ac8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615917, "uuid": "8ed64259-d093-489b-8dec-d7607d906a46", "comment": "Malware payload (Rhadamanthys)", "value": "42d511db826d129a820c1cd7ac895f06a91d11e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615917, "uuid": "efd3e3f0-22ec-4c2c-ba1d-0a2c932927d4", "comment": "Malware payload (Rhadamanthys)", "value": "9e1a6e1a97b2ac7d2722b3e2da9509ae829d47b4c8e469e0c1cf36d09a5e8f2f27cf326ceb21d549072b425a13fd936e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615917, "uuid": "955ec1f9-ce2f-400d-9078-1b6beb95198c", "value": "T1BDA3084B5A72E9F4050A61D77BFE30B7D86B6A6C586A0002BD0F6F85817FF222D1E4C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615917, "uuid": "70f1abc4-aee0-43de-b079-2f4028a1ffc1", "value": "768:GDhd0i7J4sYKgY/CMNfWdhZrXq2rSgXXH2OA6dSobh/gSLAuAAroQW+FF+Ec+0FY:GDB7eKg20DrzrSgXGOA6Uoa6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615917, "uuid": "e13ec554-8878-4aa1-909d-d119356e7969", "value": 99480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615917, "uuid": "36792319-96b6-470f-b89e-9ac24a6dfab8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615917, "uuid": "c6231203-a1df-4fb0-a316-20cb25b8299d", "value": "invoice-1637482117.pdf (11).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9def492-d87e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669978, "uuid": "144b00cd-d033-4548-83b2-e14945233a5e", "comment": "Malware payload (Mirai)", "value": "0a7898e295fb86becb16369990bd22eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669978, "uuid": "c6abbdbc-2560-4a3c-b17f-675749fd0698", "comment": "Malware payload (Mirai)", "value": "352de6ef2915bba0f5d83b53835e0537f7234704d135bf629d5b6326eaa06a93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669978, "uuid": "635823f3-0486-4d50-b020-e9986aebdb31", "comment": "Malware payload (Mirai)", "value": "5a6a867d6e242b6c474e909e35e67f864385b426", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669978, "uuid": "839e9a50-5bb5-4373-b665-d771d98eb6d0", "comment": "Malware payload (Mirai)", "value": "87ff9d8ee40afe293d185f16235c60b5db568f83fce79aecac9ba454f7321d0d1fc78c10176b7ad4a08dfe7ccf59d45e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669978, "uuid": "54a825a4-95ee-4288-abd9-61f37bfd3a3c", "value": "T1BF93F886B8818B62C5D552BEFA1E51CD331317B8E2DF7213DD106F257B8A86B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669978, "uuid": "7ad7e9bf-1359-4d4a-86d7-174723c73ec7", "value": "1536:ApnLzxRoilfD0fkq4I4iftGukzRDXqpCoy3qM4i+6sIFJBS678PYOnv8VR:wvoS0f9+2GHzZqR6sIFJBS6wP9nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669978, "uuid": "e7569cb6-427e-416e-b311-7a7f99404c84", "value": 89208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669978, "uuid": "0daf74ce-3d26-4363-852f-a1514ddfc083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669978, "uuid": "797638fd-3f2b-4872-9da8-4279fbab6450", "value": "splarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a5a7d3-d809-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765619664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619664, "uuid": "15c7e268-2332-4d56-9fd9-5ea29c0ee92a", "comment": "Malware payload", "value": "76f9d3c7e71b00a6d42b3af2b34f85ab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619664, "uuid": "0bd5dfa2-a1cd-4952-ab61-7c0263def549", "comment": "Malware payload", "value": "363f1bb665135d3a7543e2026b6ca1912650846d304a548779d40778daf0b35a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619664, "uuid": "69baccb4-9ad3-48ae-97ee-4340254aa60a", "comment": "Malware payload", "value": "cb122df12a4389522acaf977d035e50a6871c062", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619664, "uuid": "2cff92e5-681e-41fc-b0eb-603b151acb6a", "comment": "Malware payload", "value": "31077e9d3922f7565450b6cce47cc350935e7dd8db7633954e435c4c43ee2f9a170d3013303b7427580499fd6d85d716", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619664, "uuid": "29faee8b-dd76-4dbe-b3a2-e90c807fddad", "value": "T125842354A697CB95F70E94DA37AD88067FF09748F45E84C260F0649B08B3438EEA7DE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619664, "uuid": "6d8ffe18-f077-4fc5-889e-1a34a284177b", "value": "6144:bi/RYAHXZw5RhjuOjQH9eWuGFw2lGucrE3K9VQeE6pQ0l2Bt92mwobvh6FN8ibBY:0TYR8WQH7FNceDp6pn2h2mwK6FTbmbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765619664, "uuid": "b688d818-80ab-4683-927f-8e8eb00615e7", "value": 371060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765619664, "uuid": "76f374a8-1a5a-4ee3-b8ee-69a1119eaf2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619664, "uuid": "6fdeb3f3-7310-40db-9581-500aba9ea250", "value": "Xvldeos_Lia_Storm_IM4GES_180459.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cfb6ccf-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667996, "uuid": "803b0bfd-35b5-4e92-8644-026ff5ef38b8", "comment": "Malware payload (Mirai)", "value": "0531fb485a4ee5856fae7c3b5645f9e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667996, "uuid": "f9b84364-1101-4720-a546-233e3ffeac1f", "comment": "Malware payload (Mirai)", "value": "3665ba6ce916ea71f12fce277165714fd0239aff64e3ec8cf7829f29ab7e81b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667996, "uuid": "49b00fa6-774b-4088-98f0-bb449784f582", "comment": "Malware payload (Mirai)", "value": "269b53466aa6c95d4d7bd0899325ce8021cc4769", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667996, "uuid": "613b2397-af6e-4093-8c58-6be046342d90", "comment": "Malware payload (Mirai)", "value": "94f927bde2d68cae327d38f28d66a2e1e9317d22be764cbafd6098d42ceb5453ba9c84de0a6304ccce6e7bc0595ecdc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667996, "uuid": "288ffdbb-0d94-42f7-8d5e-f2d6a77d56cb", "value": "T1D3735D4373184A53D5A749B0253F27E183FFAA9020E0B785794EAB8946B6E331447FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667996, "uuid": "de19526e-db86-4a97-a681-52a96c0a8a62", "value": "1536:waEzvHBs6r6NxmqBDnSuGWNs/m7fARJhmnv8VRh:wP8nFsesknva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667996, "uuid": "91ebd4f4-b687-41f1-bc7b-6ef7ddf7bf41", "value": 79140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667996, "uuid": "7300b65c-a047-41c4-a39d-a65c327c11fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667996, "uuid": "01f4e936-3fc4-4f9a-b887-da38b6a3151d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfddeef-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650255, "uuid": "2d6c20bd-1e1b-4b43-904e-7cf499da09f0", "comment": "Malware payload (Mirai)", "value": "501a0d43f6aaa313c9151b3d52ed871f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650255, "uuid": "1376e955-4111-4498-b1b3-8a318a93828f", "comment": "Malware payload (Mirai)", "value": "3685b0a216f27ca33726fcf5ddb1adc85284f6e7ed31dab43bf632a978578c8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650255, "uuid": "b552a249-0fc2-41dc-8ae3-7d3515a5598b", "comment": "Malware payload (Mirai)", "value": "52ead65baed27353505c398bfb3e0bf2de963efa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650255, "uuid": "70d56fe5-619a-4c80-a983-1509f95d4cae", "comment": "Malware payload (Mirai)", "value": "e00128d229dbf4bc4125519f6610d4b904d49e426db7c344df2b903937c0ebb9571004a19e1c9b4beee3938d63bfe073", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650255, "uuid": "602b2669-0e4a-470e-b237-4369d04cfe11", "value": "T15843181BF9408D36CBD423B6628D115D3311F7E8E5C6B702ED308A3A36CDE7E0625696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650255, "uuid": "8fdc7ce8-7604-4384-bb20-c6603e6ca62c", "value": "1536:k6rCZTDMlWCkxxVpmDEbY7xhKOmcUekpAb/uqkGc2PquWMYJKi1H6FSr5t3/447x:eTDMzkqEKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650255, "uuid": "13c940f8-a5c6-40e3-92ef-867b1e92d77f", "value": 58888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650255, "uuid": "9a8f50aa-898a-499b-acb0-3bf0b11b8588", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650255, "uuid": "59c10481-740e-4c33-af98-05e84d7d86dd", "value": "shadow.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e67ea32-d81c-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765627599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627599, "uuid": "5be132e3-166f-44fb-aa2a-2f79d6bfc166", "comment": "Malware payload (Stealc)", "value": "838176186239d6e08787700ff3344abd", "object_relation": "md5", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627599, "uuid": "f0f0676f-30b8-4612-a350-459d08a3a05b", "comment": "Malware payload (Stealc)", "value": "36e4ad62de16ebf3a3fd4fd206eacfa9d37661dd2722e69a762cfa509f2f3ada", "object_relation": "sha256", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627599, "uuid": "681e9f50-ee6a-49d3-8263-2f07ff0888af", "comment": "Malware payload (Stealc)", "value": "4e5010a17409ca3e41ba65ae94798b9693b7a9eb", "object_relation": "sha1", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627599, "uuid": "e298ad82-4bde-417b-a780-616d728ebf85", "comment": "Malware payload (Stealc)", "value": "d27b25b0b549a436f4085f282996285b10b30831563aabb29bfa50648410ce1d6cb52d1dbd5c2119957138f2dbb28f1a", "object_relation": "sha3-384", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627599, "uuid": "f7eef4cf-10ca-43ea-a12e-7bf4df61db4c", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627599, "uuid": "6c1a28bc-2574-4fc4-8bbb-817b78504ea3", "value": "3:rNoYwNDgXLRn:ZoYwN8XLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627599, "uuid": "034cedbf-abc2-474a-affe-571430e5c130", "value": 33, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627599, "uuid": "6527047d-d49e-495e-8866-9fbd0e692528", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627599, "uuid": "1f3f1b86-62e3-48d9-92ab-849f15d97f9b", "value": "file.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f496f6-d84d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765648708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648708, "uuid": "fbd4fb88-3f7c-4ed5-9745-6f78285489f1", "comment": "Malware payload (Mirai)", "value": "8dc648840d60a79ba74208967825cc88", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648708, "uuid": "14ad2bc1-fc32-4e7f-bb9d-2029dc7791d7", "comment": "Malware payload (Mirai)", "value": "36f2eb07d9a9acfdedc55fac430b70620d69274ba453df07dd0a5ebba29506b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648708, "uuid": "b5b5afb1-6ee6-4aca-9cd5-d25c6d1c07dd", "comment": "Malware payload (Mirai)", "value": "67985c7cb840a591bfd9c55c3d37655ed3dbe134", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648708, "uuid": "a96c8399-7953-446d-8faa-8080ad5a1336", "comment": "Malware payload (Mirai)", "value": "860f82f477ac995cb62653d15675af5d653c63ef86fcf3f2a8deaabe6bfb268e194c7f684aead43bc013f3fe0fd8f5da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648708, "uuid": "2c309eb9-cf64-41df-bc43-2a4980057cef", "value": "T1CE53820ABF650FB7ECAFDC3749A91746248C651A21A93B797D34D828F64B24F05E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648708, "uuid": "315d6da4-a81d-4947-ab88-7d375f3de0a9", "value": "768:xoA81yaFrbXVbo5Yedk7ZlfW5LqemedSef2zAFXVkW0BqXiaM6aP53:xoA8/RedIfWo7gSw2v7eaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765648708, "uuid": "d7f1fec8-31ba-4639-8f0e-d4567788e9c0", "value": 63388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765648708, "uuid": "2bccf234-aeb2-4bcd-8983-6e39b60aab9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648708, "uuid": "e02a4133-5a9a-411d-908d-0053a51cf8a4", "value": "Mercury.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e57c66-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615747, "uuid": "3f93a552-95eb-4f22-9f27-2ecef4d5f93a", "comment": "Malware payload (Rhadamanthys)", "value": "571f5ea0aef6565fb3e440b718aaf2e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615747, "uuid": "f6a68184-2703-45c4-8105-33afcfb05f91", "comment": "Malware payload (Rhadamanthys)", "value": "37250020b7eaf8774cf017dc000943ada0f4ccd1f931f98eb6779e2540361256", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615747, "uuid": "0ca2ef5e-ddff-41d6-95d4-4409d8aeb681", "comment": "Malware payload (Rhadamanthys)", "value": "d28f6e82964736ba234895201456ab21ea7fcc59", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615747, "uuid": "aaa1db32-58b7-4695-84e9-1fb4faa13486", "comment": "Malware payload (Rhadamanthys)", "value": "7999cb6157db2b9d5d86bc3846867928ebcaf2321306d654ca162e84b323a4c3d2636cbe25bd6d3c99351e95a38d7f52", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615747, "uuid": "86b99a29-0f64-4aea-b1e8-0b841afbd7bc", "value": "T1A2A33A540D0A7CAD85F13011DAE41EA0BA6E65ADBF2FB3C7EC5D9FF42895A0510A4EC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615747, "uuid": "04fdd8d7-2336-4452-833f-0d70f73b4c67", "value": "1536:GDB7eKg20ma8r9r22uqstNaTYAGSDM0y6BkQWJ+aY:GDB7b0ma2BPubtNaTeSDM0y6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615747, "uuid": "7ffb066c-7526-436f-a472-107e75ba48ce", "value": 100177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615747, "uuid": "c7b6bbe4-2cc5-4650-936b-300709a28943", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615747, "uuid": "fb0568bf-03c3-4e77-b95f-6e8981447333", "value": "invoice-1637482117.pdf (45).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e78387-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615660, "uuid": "856ebdb0-32a8-4c77-8a70-86c9f659242d", "comment": "Malware payload (Rhadamanthys)", "value": "852ff0b01dc2be942144ab2a58d83d07", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615660, "uuid": "70af7bb6-d7d8-4520-a22a-5dbbe41894d1", "comment": "Malware payload (Rhadamanthys)", "value": "3807206e61c8ef07d517f0d944a67abfef7b4811cd1c723cc2ad6345b0d72bbd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615660, "uuid": "79c96617-0e04-478c-a59d-6aeac7289bf6", "comment": "Malware payload (Rhadamanthys)", "value": "f0484b66984221415a5833363cb30b58425e0f68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615660, "uuid": "9109990a-263e-422f-8fcc-6793a32bb593", "comment": "Malware payload (Rhadamanthys)", "value": "91c884a532e580d000f02163b7d3e78ee740a049ff0bfc185324e3b1d696f872b4dd397d17ae88075c0664f11acc2458", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615660, "uuid": "9020a34b-d685-40a9-8fcd-6d47deea65fe", "value": "T137A31B023894BD994067F2901EE05F4D884897826D30E89CBA5FFFB3FB46A9179D61C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615660, "uuid": "7ec4e511-01b7-4684-a847-8336d18cbff5", "value": "1536:GDB7eKg20HfMJQSNQnSqROH8DStMI3elSy1iLqP3l0HqLHLao2m44rdU57rw0tjh:GDB7b0dMb6Kt06BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615660, "uuid": "e746ca6f-d8ff-46ee-81e8-f130d87f3071", "value": 101379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615660, "uuid": "a29b11e8-3309-4de9-bca1-12c7df3c9d51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615660, "uuid": "3c97ef82-679c-47ee-ae64-d2da1b5e05e3", "value": "invoice-1637482117.pdf (67).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8681ae04-d806-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765618298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618298, "uuid": "ff1f599b-ab81-4263-bd63-9235f1658fc6", "comment": "Malware payload", "value": "3f86da695b0456b820aea2264c55f06c", "object_relation": "md5", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618298, "uuid": "52a4aaae-5f0a-40aa-bebe-9bce91e176b8", "comment": "Malware payload", "value": "389b5c82d0f8608a6c60d866f24d8647241bda9c55d2d371cd629d0b030e39b2", "object_relation": "sha256", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618298, "uuid": "c1f895c1-1966-4eab-994a-eaf55f53e1c7", "comment": "Malware payload", "value": "6c4029477bed9bdb3dccbbfda5c32cc970afe7b7", "object_relation": "sha1", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618298, "uuid": "b35b8691-199e-45b7-9de5-d352649f3ac8", "comment": "Malware payload", "value": "1fa442b3e33d48cd40615d90e36d727fd5fdc4aa2d7764793bedcaf1799229f1f562f6dcaebcd5be45289617b593a1a8", "object_relation": "sha3-384", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618298, "uuid": "13f7acbb-b151-42d2-a746-c4a9f2dc8665", "value": "T102263334D4C8857446C742F702625AD9E64A58893AE9B8B433D2F54EF6FE9B30203F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618298, "uuid": "92e4bf31-ffb1-4e14-8ec0-654c7d14a7c1", "value": "98304:c+mKV5nNMD8dZAhrqh2xM200EOntYBuQBmVTqSPiFs:rmKV5nGDQ9olE+YuQBmlqSqFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765618298, "uuid": "59630ca5-7cb3-4d25-a9af-f78e8f9ad78f", "value": 4692355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765618298, "uuid": "f282a2d6-a1b2-49b4-9a0d-e14ebdad0aef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618298, "uuid": "c2954404-a544-4f0e-9b57-ff925e0ef643", "value": "trojan.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ba38ef-d807-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765618752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618752, "uuid": "b2a28e61-671b-40e3-b8b5-a219e528f738", "comment": "Malware payload", "value": "41fb322cd379ea24be89235b045d62fd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618752, "uuid": "937d0964-9752-454a-a85a-91403aec33fb", "comment": "Malware payload", "value": "398d1ecd729fde2109b3cf23c9c8360e15506a41fad4170c412eb314332d7c5d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618752, "uuid": "a02188c0-57d9-4f51-b76c-f23d7e6b28bf", "comment": "Malware payload", "value": "8af1106ca15d41361f85278c42f59f5a3cd648dc", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618752, "uuid": "d7381c07-1aa9-431a-a1fe-3f221cc8ff1d", "comment": "Malware payload", "value": "81a09f62541fc15568b74221dd101dc7d1646db22b0b7fcb872e8d020b43e09a39084222043e8d406073e4fea5eedb6e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618752, "uuid": "bab53a84-7595-4aa9-b159-c5c43779d5da", "value": "T1D81585E61F1E1247DB8324F318103693CA4C691C63E7C0356AE6925FD24EDBC25A6EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618752, "uuid": "9950b609-bfcd-44f3-b7cb-10ae6de5dc87", "value": "3072:zrur2uTvfKMFI2SFe5j0Agv2hpIUBwWuzHD3ozMz3jRI+C2n3QD5TctO4e0kvcdD:zGMJPeNWUzDX0uDxMSecbuzllnINa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765618752, "uuid": "061cfbb3-6802-4341-af09-4bfb016bccff", "value": 944021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765618752, "uuid": "df4cfe84-028b-4553-81d9-2db324bdef02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618752, "uuid": "f0482190-ea10-4498-b553-3829ab952d7d", "value": "398d1ecd729fde2109b3cf23c9c8360e15506a41fad4170c412eb314332d7c5d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9276e0-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765613154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613154, "uuid": "60e6de35-2ac7-490a-9594-ff55a3d86680", "comment": "Malware payload (XWorm)", "value": "31a6a1b3887604e4b3e66ceafb864651", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613154, "uuid": "4c1d4dc6-c97d-4a03-91f2-f8bf91f7788c", "comment": "Malware payload (XWorm)", "value": "3a52be806e17cb31a3d77233bc8834b914955e91b92badbd5f3f5c9e425474ce", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613154, "uuid": "d1c361da-de45-4be1-9b0a-ec3d753ab65b", "comment": "Malware payload (XWorm)", "value": "2d2198175c0f5c2c2d5a50e1c9645b37bb4ae870", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613154, "uuid": "eeca69ea-da79-4e08-8a72-eee2a242225f", "comment": "Malware payload (XWorm)", "value": "26f79955b066de6ea4ee603f21c00e1c1b11650380957a35659a5902237e9851adc19ec85cf6cf5ba550d05553cbffdc", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613154, "uuid": "9eff9b57-bea1-4672-8624-f5072d234464", "value": "T191F423181158AD305DD6A9A3CE94E49FC08E5AD10DADF0BA583F4FC37B66F32620B94D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613154, "uuid": "a3e51059-12d4-44ee-91d2-8610ca01d6d1", "value": "12288:8Mj4OmbSab3VqPcp87D0WIHONaUFaZZC7ekrgpEEimMc7sBTQnKcKykpEsHBCm7K:8a1voV+c9WIHONaSkk7eNSC97sBTQnsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613154, "uuid": "3563bac5-7108-4ed2-a517-bce576001c00", "value": 735194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613154, "uuid": "5d185999-1139-4b62-9bfa-a6c1d593ea2c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613154, "uuid": "ed4957f9-0ab8-4042-a185-01f115b9cb25", "value": "3a52be806e17cb31a3d77233bc8834b914955e91b92badbd5f3f5c9e425474ce.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856a29fd-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615719, "uuid": "8b59670e-decc-4c74-a79a-f955cbdafef5", "comment": "Malware payload (Rhadamanthys)", "value": "271bccabbb9bcbaeae43ff4a8d0470d4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615719, "uuid": "ea63acee-af8e-4249-85fa-10ec85f5491f", "comment": "Malware payload (Rhadamanthys)", "value": "3af608e99989d8a81d58900596d107899492bd5f931abf0bcc62cb3929a62628", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615719, "uuid": "d969e2f9-92cc-4c23-be03-d59920a75d35", "comment": "Malware payload (Rhadamanthys)", "value": "0c0c0a643d8d77841d60165d0157623c7efc2597", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615719, "uuid": "ae5fff83-78f7-46bc-9a23-39b88c6b5250", "comment": "Malware payload (Rhadamanthys)", "value": "f0fd839fae938ce9a3dac2752ee8a15509a37bd7daad13375be55174da5f3dcba4505a943841546fbddd5090b8e754ff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615719, "uuid": "041fd1b1-c8d8-4b89-b460-9c514d58495f", "value": "T1BAA319658FF15EAC21A637EE0D4417F48D2E83618618F7CDF026FBA4A09C7451AE63D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615719, "uuid": "4eae6c35-c24e-418e-a6f3-a6b67c03ad01", "value": "1536:GDB7eKg20LCzjNTyX/ZWoGEMjqLiL6QCzeCe5GoxHZ2UA4qt4J/mASr1Q/Kbre48:GDB7b0x7pJT4e6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615719, "uuid": "2d279747-2ff0-452e-a68c-e8dcc68b62c9", "value": 98739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615719, "uuid": "52c06f20-6be0-4d5c-a1ac-47a1fce44f7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615719, "uuid": "3f2e8e25-3183-4e99-94e6-87496930ddb7", "value": "invoice-1637482117.pdf (54).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aab3e0d-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615970, "uuid": "149f6a3e-1774-482d-aa67-535bc4db5040", "comment": "Malware payload (Rhadamanthys)", "value": "5393620c269220f6c1191431ea1113f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615970, "uuid": "fd776125-3fbe-439d-a230-04d0750f8a81", "comment": "Malware payload (Rhadamanthys)", "value": "3c058379fa8874a9846ef537ca4e5eabb6bea857415936c33d37ad50e44ecc34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615970, "uuid": "34081a2c-94ee-420b-af5a-fdb0a4d30a7a", "comment": "Malware payload (Rhadamanthys)", "value": "6ce83f5173e7a3a1b3493f150d9073f3d3808811", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615970, "uuid": "9c54f2cf-659d-43fa-b365-c331b3d76d11", "comment": "Malware payload (Rhadamanthys)", "value": "019449e7d3c9af11e75c024151a0edaa334ab72780288bfc19686ff8918f06b0de1d99f941d2d184d4e9af4dcf9f7113", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615970, "uuid": "e8068001-ab96-48a8-9882-30d7816836c6", "value": "T170A309861E3A89235A212611788619ADBE5F2847F5833137358FB746D3DCAB77C2D0CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615970, "uuid": "60b55593-a3af-4fb8-a2ae-f431fbdd1ba4", "value": "1536:GDB7eKg207S1rHr+4T7PGr2fRAbgRnsj6BkQWJ+aY:GDB7b0EL7emsj6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615970, "uuid": "b55a6ed6-8f59-49d9-a5db-ff09530e6a75", "value": 102771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615970, "uuid": "baae49fc-0f6c-4d8d-93f7-bfb103e7a288", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615970, "uuid": "a88be194-cf6f-4824-b4b5-f8374f077b99", "value": "invoice-1637482117.pdf (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f331ee2a-d853-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765651552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651552, "uuid": "34f92236-652c-49a3-8c18-948ead5d9a68", "comment": "Malware payload (Mirai)", "value": "341b1e279ed12d1d22401b317faee992", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651552, "uuid": "e94419fb-8fca-4342-8f11-86438bdf81df", "comment": "Malware payload (Mirai)", "value": "3c38f20e6d5b53db85d8d7c5bb9ba916e7aa8bb988242faab11f007e64c8f420", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651552, "uuid": "bacbe708-da18-4d99-9181-b0948d42b93e", "comment": "Malware payload (Mirai)", "value": "36e75e5b21a9cdb7f9773fe130ba752fab283aae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651552, "uuid": "665bd8ca-06a0-4f6d-ae4c-a37bf729243c", "comment": "Malware payload (Mirai)", "value": "bf5a087c4f94dd940532c3d8f5857b342436340e6ee39ca35842a2c8a76fd304f2dd3cafac5a04edad2442c29daef5f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765651552, "uuid": "b34392d2-219c-4d57-adca-7274bbda7428", "value": "T11E043C85BC819A29C6D003BBFA2E018D331767B8E3DE7212DD145F647B8A95F0D37A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765651552, "uuid": "18834ea5-1cde-4e6d-a460-8ee38e938cf3", "value": "3072:0HWhLxACTZChT2dYESN1L5C2AYn/2s4OZYuEhvosnaO4Pqmt/amv6cWntA7e9UuG:0mx1TZChT22ESN1L5rNn34IYThvdaNPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765651552, "uuid": "112273f8-083f-4f58-9314-b8d537552bf4", "value": 182720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765651552, "uuid": "aa78fefc-5b45-448b-b51d-ac3bf93d5e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765651552, "uuid": "9cd4f3b4-cfdf-4c8a-bc6a-76e60421f81e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce240467-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765627008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627008, "uuid": "93ca889e-8a65-4fab-8424-d6ae44dc4fd7", "comment": "Malware payload (Mirai)", "value": "f860d63e38ec10c99665d10aaed72843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627008, "uuid": "681a0e56-3046-4574-813d-d5dee267759c", "comment": "Malware payload (Mirai)", "value": "3d60cf96ced714daaccba4cca4587e484c6a9ffca6d0a1b8c0b47f1a4c45fbe9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627008, "uuid": "8b7c459e-e919-4956-856b-6999deb8ae2c", "comment": "Malware payload (Mirai)", "value": "6b604c6c9c0845964821854cef8baac516d58997", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627008, "uuid": "974382bf-9a00-4b95-ba8b-b4c8f7d43b95", "comment": "Malware payload (Mirai)", "value": "a6972384aaa450bfa639783a2fb4e3d108ad4fd0374751b1d16298a47cff0228f4e0584ef9c2684643b9cafb8f6128aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627008, "uuid": "9104164c-418c-44ec-b279-2451c6234016", "value": "T13BC33B46EA818B03C4D617B6BAEF41493323E754D3DB730689186FB43F867AE4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627008, "uuid": "d892a73c-112a-4188-8d21-65b57bd650e2", "value": "3072:A41MBGVL4pYkwgjI3Kh3JVCQUeadc+N7GM/9pVA:7MBGVLGAKh3JVXUO+NiM/9pVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627008, "uuid": "e3d68894-f3e2-4296-b30a-778a897b3c68", "value": 119621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627008, "uuid": "1a2e7d01-a101-4c11-90f3-0bd7fc2648b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627008, "uuid": "c5a3b5ae-5bd9-46d7-9f0c-5617519e9d94", "value": "Mercury.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281dfeac-d86e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765662807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662807, "uuid": "98870e12-c1d3-4e34-bc39-4006fb873aeb", "comment": "Malware payload", "value": "ba81bee3d3f813b669daaee617ccda3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662807, "uuid": "d78c0551-f989-40dc-89c7-c8014b3d04e7", "comment": "Malware payload", "value": "3d8fa7bd69bb6ecbdf5b5a89b53128ae392c84019011bcdd7374876b562af130", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662807, "uuid": "7e6c03a7-5fa3-4611-96f2-f48268110e7d", "comment": "Malware payload", "value": "b7f61533f0ec47b14eb59e0f4845720dbc23b1ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662807, "uuid": "6aab53d4-4edf-4354-8fc4-b9354cbfbb7e", "comment": "Malware payload", "value": "72c2cfded476a83236575179b4e943eadc5570297593dbb3e2459df318186e21de2e66c68ba3545fbacbbffdb5d73bf6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662807, "uuid": "73539534-370d-409d-883a-facb3123d8df", "value": "T13F731985B8918A63C5D462BBFA5E42CC332553E8D2DF7207DD11AF153B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662807, "uuid": "e511ec17-fbbc-4089-94b7-f287866bab6d", "value": "1536:LYljDntqt8fgYM3g4FklATMBhNekuOFYvGOfnv8VR:LYlj1pmgcT+tvY+wnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765662807, "uuid": "a6268ec7-c3af-4ada-a51d-650efa59b094", "value": 79728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765662807, "uuid": "c7ce4360-5bfe-462c-a853-e5b42ca3c6a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662807, "uuid": "9e5be814-3f24-41bc-8470-40d7e957477c", "value": "jklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3b937a-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667294, "uuid": "19096208-75a0-4491-a458-82f503d5ebe0", "comment": "Malware payload (Mirai)", "value": "d6dab2f3e022801fff709a68a4e2fc19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667294, "uuid": "a2d1e874-af36-4f28-9878-8a0e8a4372d2", "comment": "Malware payload (Mirai)", "value": "3da5c83825063fda3bc7ca9e645992b3ae498148c4f9f3cfc1d9af8151680559", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667294, "uuid": "0aac04d6-2325-4908-ae0f-e97cb9ffe997", "comment": "Malware payload (Mirai)", "value": "c6aa48777974cda59fdad6c090ebfd09837f426e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667294, "uuid": "b1f8d1c3-bd4f-45ef-9dfd-9628c8881442", "comment": "Malware payload (Mirai)", "value": "41d8b5dcbcfb444d2303aa3f80c21df911e6b0599e3c8c6e4dd05473235fabbe3815bfcad67c66cf2d8dd3dd32538485", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667294, "uuid": "6597897b-9961-4d66-bc8a-5b4a6b76edf7", "value": "T14D735B2179752D27C5C8647A51F34730F1F62B4A36ACCB6ABDB20E9DFF14540210BABA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667294, "uuid": "cb5a3d02-56ae-44d8-a16d-23e6d84d1d6c", "value": "1536:gAfSgOv9verKoy1vp65f1HpiVWVjTMqyNwnS3Br77fUcwmH/Muh+JR:h6VmrK3uImbw7LJH/2JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667294, "uuid": "3fe1b5bb-aa53-40f4-b118-35681798ad74", "value": 76820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667294, "uuid": "c5d7b38f-e329-4a7d-940b-6f772d09c738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667294, "uuid": "9165c65c-84b9-411e-b925-2c696954a663", "value": "nklspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17cbcb4c-d7bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765586330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765586330, "uuid": "8f1cd20d-bddf-4eb1-be97-174033a9e0fa", "comment": "Malware payload (Mirai)", "value": "c73e270bf05a98692b867efdaf77c044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765586330, "uuid": "fbdecfba-0fe8-4f61-9cc1-1190b78c953b", "comment": "Malware payload (Mirai)", "value": "3e3cd57e4a65be478da8af4bfa636f6bad2e31bb19ab8819e9e0f45e68b3cbba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765586330, "uuid": "5ab70cb6-a3ae-4478-9c18-e7e9de4a4506", "comment": "Malware payload (Mirai)", "value": "44120ec58468c9bae7e68591fb22567ec1531213", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765586330, "uuid": "3a0e4793-5550-403e-a82a-4d76961ec76b", "comment": "Malware payload (Mirai)", "value": "de3871451b2af698bb1c2afe5259de1d5ca058e6cb1ca4412ef7bf9a7e6ec1eac05a151b32b470a668cdd40439e1b955", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765586330, "uuid": "b9b38c86-ab03-452c-a815-65d6d0f20f08", "value": "T14614F60F6E258F7CF7A5C63447B78E31966823C726E1C586E1ACD7005E6428E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765586330, "uuid": "2d9502cf-4537-4cd1-8a75-543de2d64472", "value": "6144:wwD9x2MSnMeXfdZKvpvXQxClFu0YgTvxfNU24ie:rr91AUgpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765586330, "uuid": "b7eda126-66be-4a95-a02e-f974874f3352", "value": 197556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765586330, "uuid": "f49795d5-1af2-4a2b-a123-fc0d4a124b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765586330, "uuid": "008a8ed9-f051-4150-87f9-f6f4905b9700", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2921fb1-d81e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765628787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628787, "uuid": "614f6c02-b351-4055-92b8-3b45d2bf1001", "comment": "Malware payload", "value": "9a8086f9122f6f7737587fc88b84b1ae", "object_relation": "md5", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628787, "uuid": "8ce6199d-b3c6-4233-906f-48b6f5ac0c17", "comment": "Malware payload", "value": "3fb594ca6f922d3e77e845562c49e0b7f280feced90b7770dbfd50d2f87a5658", "object_relation": "sha256", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628787, "uuid": "45dd78ab-a4e9-4c6f-9ac6-6ccecf63f4b4", "comment": "Malware payload", "value": "2a3dcbe2c12f6bda56de6db5f23600c61c830071", "object_relation": "sha1", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628787, "uuid": "33d7cd28-5b24-4011-a29c-6724e890ac27", "comment": "Malware payload", "value": "a5311147ca3b4f7b957c9bc11cf613ad09881b4e46ed51e633255857c168f8b77c333090160b1629ff1dd7dbbbccb676", "object_relation": "sha3-384", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628787, "uuid": "09ad1768-ad3d-4fe9-8ed5-b157efe441ec", "value": "T1BD0523DF551C0624EE693B3EF528E909BC9BD3AB4444DB08DF2391A05B0E17E2F64E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628787, "uuid": "5dce3998-37d5-4a69-bcea-f52336d09bde", "value": "24576:nSXqMvpO9SoPgDocq+O/WeP5Leqwwrzwo7bECEq:nSXqMvpOgo4ocqleeljlwo74e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765628787, "uuid": "3c57a41d-58ad-473d-ac56-764da61bccb4", "value": 835596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765628787, "uuid": "4059fad3-032c-4c31-bd69-a05467adb29b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628787, "uuid": "a8648015-a34a-4cb9-bc43-b0ec16635740", "value": "3fb594ca6f922d3e77e845562c49e0b7f280feced90b7770dbfd50d2f87a5658.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acdd355-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765613178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613178, "uuid": "93aa5540-7a9a-4485-a25d-da28029be129", "comment": "Malware payload (XWorm)", "value": "153dbcc86ac03d6aa6a0bc1abdca448e", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613178, "uuid": "242511db-8e4d-4ff1-b2a0-b4e97c557a84", "comment": "Malware payload (XWorm)", "value": "3ff318a62b094f94fe68d7626af70996eaa1e7c52967422055b0a17884b28cfc", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613178, "uuid": "b3856c1e-e34f-4656-984a-52c97c88465e", "comment": "Malware payload (XWorm)", "value": "a1b87ec1dce49dcac22dc1ab040baf5f6bde4731", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613178, "uuid": "95346497-dc21-44fc-978d-a52cd4dbd2dc", "comment": "Malware payload (XWorm)", "value": "1b72ddaef2c673ee00f0f8de2441fc6a94af214e7995417528d46f148f1ced52f246b071bc55833aeaedd52351e6568b", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613178, "uuid": "ad83fbd9-52f3-4e48-a6a0-203545a5a2a3", "value": "T10A0608FCC2CC2581EBAB65AFC7063AB1A7FE0A499B56544D40FCE5D62903BB4C327446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613178, "uuid": "68ba6d2a-a225-418b-83f5-1870e51fd206", "value": "24576:zBxPWnF25ehs+Gt5qe5BI9Ov2cq+c06LZ8EnEW4YHnCMTXRxPgi9ns8uqJRpYS0S:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613178, "uuid": "bf15c665-e1de-49c9-ae08-8d085d211dad", "value": 3864792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613178, "uuid": "c0dd1a70-c943-47b4-8e51-594b0dca155e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613178, "uuid": "f894bb1b-026b-4021-95bb-a1c3bcf7ac71", "value": "3ff318a62b094f94fe68d7626af70996eaa1e7c52967422055b0a17884b28cfc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5767c651-d875-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765665893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665893, "uuid": "707d0261-2c22-43aa-9030-2591d544b95b", "comment": "Malware payload (Mirai)", "value": "11cb25c8f488e3fbedc3e02666f0642d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665893, "uuid": "c0be53cf-9e86-4c8f-a5ec-101e600cd2de", "comment": "Malware payload (Mirai)", "value": "40038bedc9f1f53c9980bd6b2a32f3b4a5e1f8d7305a66153f705b72d9944149", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665893, "uuid": "5bb6e44e-4cf5-4ab7-86f1-a6e729207794", "comment": "Malware payload (Mirai)", "value": "ea3930dd877f44e78523a06f52ce7f8bedc00076", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665893, "uuid": "d96e242e-f0ae-4e1a-ac7c-49cdc3ffd376", "comment": "Malware payload (Mirai)", "value": "e0476020fb7280073e786640193097bdf54c11697b2ea29db9a0892f39f1a1e1a3b0fb3b5fd98d8650ff7451de0b83ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665893, "uuid": "77584d6c-4cea-44d9-aef1-f14165415b67", "value": "T12723F1A9474E28EDC6E3F8354BA217942F72554545032C0A7BADEADACFDD83C38824CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665893, "uuid": "7f98fbef-b734-4d3a-8055-4cf1c04ff5e5", "value": "768:WGJBIF/288DtW087dQWzHAD1ZJmNPiQ1vTrOpF0kqOOl/sC5yBAtIGltJgGlzDpA:6LQmdQo6ziiMLrkqkidUBnGlHVJujv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765665893, "uuid": "57e69ace-2254-4c1a-9f2b-c050f9dddc12", "value": 45612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765665893, "uuid": "c6809dda-233b-4889-b984-b5f451667469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665893, "uuid": "6d0eafc4-4f2d-4279-8ca2-df1d944ad2be", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0730d78e-d7cb-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkVisionRAT)", "timestamp": 1765592744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765592744, "uuid": "43bcdee3-c469-4329-bff8-760d719b0ec5", "comment": "Malware payload (DarkVisionRAT)", "value": "d8c92c57be7886570344eb0548136bb1", "object_relation": "md5", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765592744, "uuid": "c2bdcb14-2cf3-4c4d-ae6d-55838d7219cc", "comment": "Malware payload (DarkVisionRAT)", "value": "404dd8778337a5c688973771df50cb5d76a176bcb9d51834bfd406de5d0451d0", "object_relation": "sha256", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765592744, "uuid": "b818dd47-9fdd-465e-ac2c-60356b19b942", "comment": "Malware payload (DarkVisionRAT)", "value": "2074217069ebba4cbae0c34aeb3f51d83b687550", "object_relation": "sha1", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765592744, "uuid": "8e484909-352e-4b2c-abbb-78035b34424e", "comment": "Malware payload (DarkVisionRAT)", "value": "ac473410eca50d0ab73087ac04743aeaa09ad6bbadfb3a29ec2ab1b4fa2b45ecb2c8d6776b97aff9607697026d5e427d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVisionRAT", "colour": "#976084", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765592744, "uuid": "0290b0db-22c2-45a8-a5b7-61cd0a615c31", "value": "T1CE9523C4B65160F9C04C57774083BA7E79697E0398824E663AE97BDF2D329072E73B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765592744, "uuid": "ab5b2b2d-d48a-4568-a9d1-aa4338ccbe99", "value": "679877ea45ff38e48e48875d525bcbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765592744, "uuid": "42ad337a-e45d-4ef4-9025-91b60e955df3", "value": "24576:1dcKroka47zWKA7Exs10mcUo+ZVMo3CNcueuQ5F7mRON9gw1eKNwELKagSE0Gx4D:1dZrnsKKV7ll3CNch+yv5wqIdSb+6Ot8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765592744, "uuid": "7d8483fe-1546-457c-98c1-860c0a1d5a04", "value": 1990184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765592744, "uuid": "aea2e60b-ba65-4097-ae14-d108e118d57c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765592744, "uuid": "9d2d45de-516b-4756-8989-359692eac291", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0514f6-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605557, "uuid": "8b8592be-ac91-40f8-8da2-45d808901835", "comment": "Malware payload", "value": "c30f0a2718cf2e9c203281a93560837a", "object_relation": "md5", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605557, "uuid": "2dd7ea31-200b-4140-ae6a-7f58b7a0f656", "comment": "Malware payload", "value": "417aa252c29e168ab23593c36570cf97cdd8e374a44f85aef05c0d1a78f3edfb", "object_relation": "sha256", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605557, "uuid": "fa994a34-d1d6-439a-8a2d-753c1ca5b60e", "comment": "Malware payload", "value": "df4f00b7ddebdacc4a12ac63b3f089fba59718b1", "object_relation": "sha1", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605557, "uuid": "eceacbc3-290a-45bd-9c86-861bb01a7a7a", "comment": "Malware payload", "value": "9665dc42e6388cf79a4aebbc38cc06c2ed7c784a94ee3c915fe15b30bbf496a932df40d4c37623508beab5912fb1edbd", "object_relation": "sha3-384", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605557, "uuid": "8aba84ad-2ff1-47a7-bf0e-e0e480b1b99c", "value": "T17FF6337CDAE86145DA0E45B5249A3BC7E0F33511BC32ED9C0214F39DF62E912FA16B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605557, "uuid": "407d601a-d0c5-4d70-a4f4-ae191f1a80c1", "value": "393216:WB8YSr3WhzaOC0eGJ8fSDJWz5toXVangbj+43NLkssWT:WC1rCzav0HuDNteLZZk+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605557, "uuid": "8790bf63-785c-4301-92f3-f3da304c8b61", "value": 16758209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605557, "uuid": "eaaa1f05-d720-4f82-a80d-6993d892ba84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605557, "uuid": "f8b8831e-ddf1-4133-9cb1-6439926d2ac7", "value": "417aa252c29e168ab23593c36570cf97cdd8e374a44f85aef05c0d1a78f3edfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07fd8fc-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615845, "uuid": "bc57a1c9-ab50-4808-8cdd-3726208da979", "comment": "Malware payload (Rhadamanthys)", "value": "621b276b5d229959e0c934783fe94af0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615845, "uuid": "f724e4a4-fd0f-460c-98b6-b2fe48153ae5", "comment": "Malware payload (Rhadamanthys)", "value": "41b24e08b69307921b38cb0ab00a930d59b68e218eafb92aa16937d1d19bc094", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615845, "uuid": "3ec8c984-6129-42dd-a4c0-6ae225c95b9c", "comment": "Malware payload (Rhadamanthys)", "value": "911077c373747ed1dbd3071de815a7a2cae1c6e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615845, "uuid": "bb0fc6fc-a1e5-4870-877a-ce4bd46a9d11", "comment": "Malware payload (Rhadamanthys)", "value": "f2037658d3eb2e39c760147b62c6eca2fad20d576f98716592406d40e8ea92b6ccba306e291dab15c4dee2f7537f365d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615845, "uuid": "98abbca5-f60f-4ed9-b681-e819d41a1c93", "value": "T1F1A32BE57D13FC254841BB67B89D71B84CABBB426508288DD13EF311A1487E7099A3EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615845, "uuid": "f7d85807-18c1-492c-a815-225d49d5e76c", "value": "1536:GDB7eKg20mgUGrkrPDgh1AMQw6BkQWJ+aY:GDB7b0mgdqLqvQw6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615845, "uuid": "7c5786b6-643e-42a6-8024-52f5137e5104", "value": 100796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615845, "uuid": "de4bcb7f-98f4-472a-9d3f-3de48620f22a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615845, "uuid": "1719c7ad-b878-4504-9ac4-2713fe7818cc", "value": "invoice-1637482117.pdf (28).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b8edba-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615524, "uuid": "99f81391-2b48-418f-af1b-56cb25605b26", "comment": "Malware payload (Rhadamanthys)", "value": "1c2d646693d06bd7427ee1ccdc8dfdb1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615524, "uuid": "36a54b7f-8307-4199-9469-831f9ee9441e", "comment": "Malware payload (Rhadamanthys)", "value": "42aa8d13849dba889ff65c323b27d7b14a442909471b7f366b0512803e84c260", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615524, "uuid": "ddacebda-269b-423a-8c1c-609471e7861c", "comment": "Malware payload (Rhadamanthys)", "value": "2ef92e0ef45c5e25c9c2091ba26fde8cc6e9a0dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615524, "uuid": "4a3c8dba-e7c0-4713-a5ee-192eb361ebdd", "comment": "Malware payload (Rhadamanthys)", "value": "3fc009813c9c295f7eb4f7d4b0855988a3c5e04b6ae917c18b1aeb6341ce6fc66f1aa1e464fb8632f7e568d931bf4c77", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615524, "uuid": "deb696fe-34cf-4075-905e-5f14e9598d6a", "value": "T175A3E9061733A8D524CDEB9C2EAE58F48DC6A959501710D8474736F836CB6F30AB1AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615524, "uuid": "270ee3bc-7443-4ce7-b24a-4237dfaabbd1", "value": "1536:GDB7eKg20EONObhW0YrVIb9r8yEqWI7kn2X3uCqSpNahTSNHBjsAAIz+0eqylk7c:GDB7b0xNjcmIDCqhjkIzcEz6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615524, "uuid": "b102fc15-b022-421b-9828-00192b2b4284", "value": 103488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615524, "uuid": "cfcdabae-1b4f-496c-bfd7-bea74a8a19fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615524, "uuid": "3c65b2e4-81fd-4257-8f29-06e33f7381a9", "value": "invoice-1637482117.pdf (96).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154555f5-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615961, "uuid": "bec60cdd-5a94-4047-986b-4925cf838de6", "comment": "Malware payload (Rhadamanthys)", "value": "f292f94734675add6f59e7ca6517895e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615961, "uuid": "224e3f8c-08f4-49be-ab92-1c67287062eb", "comment": "Malware payload (Rhadamanthys)", "value": "42ea437ff2ba09a26366b9d1da5a4356eb598dbe7529a7548b5d0b2570fd0af8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615961, "uuid": "c6f56ba7-1a67-4618-8da9-80029b9310b9", "comment": "Malware payload (Rhadamanthys)", "value": "2697e2f250729d2e7f3bede21721cf0b2563fded", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615961, "uuid": "18fb32fa-6070-4a99-960c-7ecf0ccece23", "comment": "Malware payload (Rhadamanthys)", "value": "93bf9021007bd4bf9e6536529bd4c0dc3acfd33b5394ce1438a7c300ffdb6c4564c108409040f739f5656f4516ae05d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615961, "uuid": "a1443398-4d07-4a61-ac2b-51a8423224a0", "value": "T1DD93F8173F72DC590E576523D8D169BEA80F448A8533988BA40BB364BCBD3460CDB5EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615961, "uuid": "c30a0080-1611-437d-8700-de71d9c656e3", "value": "1536:GDB7eKg20ybSb5rQrLn4bW9bEqbpblbMAAbYbVborr6BkQWJ+aY:GDB7b0Qw5+7muEolBqGxorr6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615961, "uuid": "79408548-61f9-4365-b379-fbc2a3bc7b51", "value": 97468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615961, "uuid": "f11d96ba-ab50-4670-9159-51491e597c44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615961, "uuid": "554fc0bf-b247-4105-8b84-b9a6ff035672", "value": "invoice-1637482117.pdf (6).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81c5353-d7e6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765604691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765604691, "uuid": "3f04e875-10dd-4f4a-b82f-b60161941c85", "comment": "Malware payload (Mirai)", "value": "28fbbc29ebf4c113ffceb42a6594fc63", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765604691, "uuid": "f3aa9733-6e3b-4118-b081-c1e98ffbdbec", "comment": "Malware payload (Mirai)", "value": "433b61d03b583aab5d9b7c3d44fbe53c1fbc710e630c961980bee322f072d242", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765604691, "uuid": "06154254-68f5-472c-b583-2b57fd08f40e", "comment": "Malware payload (Mirai)", "value": "20eec4c2047b24e5ea919174cc29312f057bb1a4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765604691, "uuid": "e242487c-b3b0-48be-bffe-a79b9a2542ed", "comment": "Malware payload (Mirai)", "value": "92ce196bd9a85ffa8b8261d30f9bd5403d74bf5649bca44f17141e42ef2c7ce6b5e08c5f517f850d20e2f7448480e242", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765604691, "uuid": "1aa3b4ba-bdac-429b-b183-694d94c792c3", "value": "T17301D2BD0129EF3581580F1A725B9026747397AE707B9744BEEA727A72C85513032F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765604691, "uuid": "dccb56ba-ecd0-42c5-aadd-176be27cc633", "value": "12:0hdzK4hagyhJ3T3Djth+6LBhlOBHwT4hnhHhOUJS9hwDWAh5ttdhcOc3:WBH1wlrDRflYHwTihBJIv6Zz3c3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765604691, "uuid": "7870a1cc-fb11-4bf4-970a-d19739a2ba61", "value": 768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765604691, "uuid": "650a5bd4-004d-4d55-bbd2-40d498e04654", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765604691, "uuid": "67441738-7399-4772-b1ab-3409d10186f0", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ff93cb-d7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765612197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612197, "uuid": "e97ea83f-bf9e-4e95-a91a-4518e98a622a", "comment": "Malware payload", "value": "5314b1845dde793ecc048e9fd9e66bba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612197, "uuid": "0b1adcb9-ae07-4eae-bf7a-86ab04033f81", "comment": "Malware payload", "value": "43f11eba490c7341afa0b50c99a888235461e479f09390304e95bee2aa5397ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612197, "uuid": "35a2cd28-3202-4c51-b81b-65d66dbf8cab", "comment": "Malware payload", "value": "e856c802488b23258abd9176c1f522b4ed3aca58", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612197, "uuid": "cfe7343b-f4a0-4326-9d4f-c860f62e6eaa", "comment": "Malware payload", "value": "dec26117952bf8674c4f90ef8aa048d338976125eeed6f4fae7093c11b59686c281482534af2b60e692bdd84766d0367", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612197, "uuid": "c5d90a2e-0f54-40f8-acd5-8eb95852d057", "value": "T1D0A1D4CAF9B133334DD4DD19F296892FB05A90C086225FB87ADD78FD78EBD449A40254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612197, "uuid": "6a96b7dc-52b6-4996-a4df-cc89bb8a6211", "value": "96:1xe9eUe1Re4eUce9oeHXZ2xukOvdPiVioi1RiUiUgi9kiHXNby1fWU69mHXjtHl0:mcz1I/GtHXZ2xukOvdPiVioi1RiUivi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612197, "uuid": "bb40bed6-f0e0-4afc-a2fa-056ef75085a0", "value": 4660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612197, "uuid": "510af016-a358-48f9-b48e-0c6f5b2f28fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612197, "uuid": "7c84ef91-6971-4a2e-82a5-06378f225462", "value": "dvr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7740a1-d859-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765654012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654012, "uuid": "33b322a8-501b-4872-9223-ec5887464c52", "comment": "Malware payload (Mirai)", "value": "7a96a0bfefe801e0b493febdfd19c39a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654012, "uuid": "25d22348-79bb-4d20-8511-8353e4030c39", "comment": "Malware payload (Mirai)", "value": "4407b966fcbb7b656ec625e95e469cc27bd7b40095bf76685f10231a05d1e486", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654012, "uuid": "db7e0458-17e2-4058-a802-4ae4c30957c3", "comment": "Malware payload (Mirai)", "value": "729ca73ad4d35b3530d5db957d014370eba9b49a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654012, "uuid": "1f082ab8-bc3a-4684-b214-ab61bc1b5771", "comment": "Malware payload (Mirai)", "value": "27ca9d46121ac764eef432087fd5da0b8340ccc97a726ed61c783030903ff1d95b4f5ad0b4c8a4395c0d92e86334427b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654012, "uuid": "4cd9b946-2b03-404f-be34-5d1748d9545e", "value": "T163831A46B8918A13C6D466BFFA5E41CC332613A8D2EF7207DD259F153B8A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654012, "uuid": "50593bb3-211e-4e67-ba4e-3c7643f77fef", "value": "1536:TMFZ+iSiHyupDtpydPFLkBHfyQcLzh+qMy7abDBvBnv8VRG:TMFZ+eylFKHfyQcLdxwhBnvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765654012, "uuid": "44ba5295-978a-433d-8e63-52698d467d64", "value": 83136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765654012, "uuid": "da34a28a-2516-44ec-a152-1c690868d5e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654012, "uuid": "44a43761-b43b-48e4-8f0d-03a0d1ecb1e9", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4954f3f9-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615619, "uuid": "89806b4e-58ba-4b38-a1d9-a0a69b400864", "comment": "Malware payload (Rhadamanthys)", "value": "b4e057be29f54aaae745c23073b26017", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615619, "uuid": "f1f07484-d2af-4da4-b92d-983527c6abdd", "comment": "Malware payload (Rhadamanthys)", "value": "44b1475adceeb7a1a72315da5420b4709ec7fda80b6568cce4ef8f98b9b71f3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615619, "uuid": "f1ac621d-6e87-495c-9d86-b17814be61d5", "comment": "Malware payload (Rhadamanthys)", "value": "d040392068f1e7077da92cf3a3a388131d9b5c5e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615619, "uuid": "37bfc8bf-a95f-48a6-ac54-b1ebca0498ba", "comment": "Malware payload (Rhadamanthys)", "value": "1c4c203d74144beccf8db633d81a7c85eda4e2a34919d45f1d43046f6a05e9558b9464ddecce06f253c84e7c0158aa1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615619, "uuid": "744acabe-a56b-4ed4-8b80-bfda0d82b823", "value": "T17293D91B9C128CD5013B3CAD7AC364E7563E1619068F40BAE92DF775E485F282EEA5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615619, "uuid": "d415b90e-48b0-42e8-b228-4ef1a9b7f78b", "value": "1536:GDB7eKg20UrlrMI9Er2jA42i6BkQWJ+aY:GDB7b0eZTerW2i6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615619, "uuid": "001d2d9b-d24e-4f5f-ba5d-cfc5cf6a48cc", "value": 97421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615619, "uuid": "68763f6c-4900-412c-a49e-bfab9daf3d0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615619, "uuid": "ed502387-faea-45ea-8a38-6737869ca6ef", "value": "invoice-1637482117.pdf (78).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ef438f-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605298, "uuid": "c08cf1d0-b026-4c73-854e-ffa69b09c08d", "comment": "Malware payload", "value": "93b13074f169033d656cfd8c7a8a6f56", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605298, "uuid": "c2571f3f-dd80-4b9b-ae7c-e9bea352d5bf", "comment": "Malware payload", "value": "45294605bbc83f4d8403dddbda6dacc10d5b00ab1a5f3158538477183745c8a6", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605298, "uuid": "4839eb84-1907-43da-8468-9feb38aadc8a", "comment": "Malware payload", "value": "7e6d39efec145118c0e2e726799afcefecbc7097", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605298, "uuid": "f1c5951f-a4ed-4319-b1ca-d8bacea24fee", "comment": "Malware payload", "value": "17977c92968935f178483a45b6305a9778b3ec738c74501a254e073a3787dd399bb04026dd0dad5f8d51e0d3e8da6c48", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605298, "uuid": "42805048-f4b9-4a03-9911-3452482e6235", "value": "T112942A63E3982804CBB886F58B599358BA35FB5C1370437B7B5062E6ADF63540E1BF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605298, "uuid": "ea993781-0e63-4ef0-8b9d-41d0bb0a0d42", "value": "6144:z4QZVhf5x8vGrq0x5XTQOJrnVpUtGixECiusLH:c+hf5x8er39TQwTOGixECiusLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605298, "uuid": "f2dc14a5-5ded-4bc7-b0c7-3c5561f5d0c6", "value": 447280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605298, "uuid": "d2035d5b-6501-4d20-b8cc-e90fb38de956", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605298, "uuid": "6faeaf9b-b4d7-43f2-9bf0-acf89432d5f7", "value": "45294605bbc83f4d8403dddbda6dacc10d5b00ab1a5f3158538477183745c8a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5a2a55-d877-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765666950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666950, "uuid": "d922f4b0-d21f-4bf9-9bc0-6f119fabf58e", "comment": "Malware payload", "value": "e4ce105f05cbcd325109d60a3c696ddf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666950, "uuid": "c7033024-7721-42f1-aca8-70393f67e11a", "comment": "Malware payload", "value": "453d80751135e6480c9878f70a8cd4fa316971e26233691fc9ba3ecd403617a1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666950, "uuid": "c0e6b8d9-e49a-42cf-a754-8df9b64e025c", "comment": "Malware payload", "value": "e5632eb6e3d095a27411d427781eea724e7786ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666950, "uuid": "25ab4d81-106e-4441-9c61-97d62d501fee", "comment": "Malware payload", "value": "5490bdf7806a3fc00d07689bfb84071525e3e458ef5e8cb2c2fad76fd1ae8a45fce0261ce1996f0278e95f0fced9e4d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666950, "uuid": "c01941ca-e1d5-489c-886a-0dbb08676719", "value": "T1096186E8B831A37136D8CD3CB115989C6AE7D8F9B0782615B6E56C72C0DC9192219B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666950, "uuid": "237c0e1e-4814-4008-a54f-71f277db71f1", "value": "96:diLVEByqW3+V6WB20InUXxTAPCI7ITC/h/L:diLu0StNXzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666950, "uuid": "bd855c4a-737c-4e03-98ee-136b2c21eeb1", "value": 3250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666950, "uuid": "50a3c64f-12a8-43c3-96be-decbb05a7072", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666950, "uuid": "40f34860-55a1-470b-bcfb-ad5331f16bfa", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93bb5e57-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613166, "uuid": "44f0a5e4-e509-41c1-952b-480cf4e0f302", "comment": "Malware payload (Mirai)", "value": "8d74f421131082572170d20c0a62cfde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613166, "uuid": "683d77f5-a90f-4fa8-b054-035e7ac25703", "comment": "Malware payload (Mirai)", "value": "45811c896229864a3bef220ef26943e0180e3e7e48e57304f8d1c936974c4235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613166, "uuid": "2379e3bf-71c4-487c-9e7b-009f889de776", "comment": "Malware payload (Mirai)", "value": "a405c1fcb307e069094fb3e7a2491c9316ac7282", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613166, "uuid": "3514dac5-31b9-42f8-9695-9e5327eccaa9", "comment": "Malware payload (Mirai)", "value": "08546c1cac13b384956bbe6a5edc533bfa2d56388d8289890ef0274a355322ee2bb426cbc26f377f42517fb19ae4787e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613166, "uuid": "7a881a68-5716-42f6-a22d-a30369928f48", "value": "T15DB2C0CC61543084CA8D7C7C178D4A664F6CA1C0BAED9B16E350CDD4B7BEA4B345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613166, "uuid": "b28c4cfa-1954-415f-9965-bdf5d8255d23", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpMZqSWvc:4QlS07FUXqIYSXQKqu0qE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613166, "uuid": "4ea33197-36cb-422c-bdfa-37a13c6fab22", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613166, "uuid": "0778e93a-8eb4-4229-8607-a416cbda1051", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613166, "uuid": "7b9d2ee4-3890-49fe-96a5-1eb91ae19a01", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804268f9-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615711, "uuid": "50c02ebf-17db-4be2-8b7a-d7f5e277f5f7", "comment": "Malware payload (Rhadamanthys)", "value": "5b5f4f31c3789fed2dbc0f41b6d0ddc5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615711, "uuid": "01868127-2586-47a4-89a8-6c64fe6f3588", "comment": "Malware payload (Rhadamanthys)", "value": "458ee52f50c3bc394b57d4d74d56fa32a5840fe265f73c6ce7de2cb2a68622b0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615711, "uuid": "686043e0-770e-4911-956a-4ce99f120177", "comment": "Malware payload (Rhadamanthys)", "value": "f7e15c7bc0a5cd6a582259498a8669e312d5300d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615711, "uuid": "0505419a-b005-483a-9923-128f55a78266", "comment": "Malware payload (Rhadamanthys)", "value": "f94e7795fecbb666f0364b7f56fe39321502d3dfc24c6faf7f8947e6c835a8ebeb501294107a73a866bc497510b0129a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615711, "uuid": "16cae8f6-c7df-47cb-a321-45c58dead6e5", "value": "T165A31A8DBD31BA640399B0F8BE0932E34D4744E496B98824944BF736B7B4717E9880F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615711, "uuid": "af90f335-0609-4f4f-91a1-7c2e2018331f", "value": "768:GDhd0i7J4sYKgY/CMNfWd5aTrXi+ru4WoHmdK4AndOxGSLAuAAroQW+FF+Ec+0FY:GDB7eKg208rDru4Wr3AnQg6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615711, "uuid": "d46afb75-93a7-4cd5-a611-cd18c14eda0c", "value": 100129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615711, "uuid": "c794106e-c187-4376-a197-9dbb6bf74f2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615711, "uuid": "a15a894b-e962-4c99-8adc-b9e077f4bd0e", "value": "invoice-1637482117.pdf (59).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a5b274-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613170, "uuid": "7304e933-6f0d-47c7-be78-e8ccabe79206", "comment": "Malware payload (Mirai)", "value": "715165732f22b00d840bc09b639688c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613170, "uuid": "ecc1ee4d-3611-4598-8ad1-7d1fed229de2", "comment": "Malware payload (Mirai)", "value": "4662a70800fd059ed2c168745d25313710a7bfbbae76b9dbb683e18c25c3476b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613170, "uuid": "7a395cb0-d0ce-4312-8b6b-1a52847af04c", "comment": "Malware payload (Mirai)", "value": "d95eb48ae0fef3b4c85eaf896aa983618ffaf446", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613170, "uuid": "9a739367-59c7-4e96-8252-b7dbbdfe63b2", "comment": "Malware payload (Mirai)", "value": "8457916a90d68a6722147fac638920be442a645781f9efc72ab2d023cc7ad3895042a9894a802859bc38e80b4dc88222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613170, "uuid": "e4f10fe9-ea6e-4b12-aaa9-ffef57beb0f1", "value": "T19882D030219B74E4CBE14430FAEE8EC6971A0BF8D1FC36A317586B78C94650655F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613170, "uuid": "5febfa7e-8e3d-48dd-8335-fd1fc3d68772", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaAhymdGUop5h5lp:2dV0P6+kom0tVAoNvm+to1As3Uoznlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613170, "uuid": "6f07e9e2-2abc-4a93-8a83-00aa26b62261", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613170, "uuid": "ec5fc45d-7161-4ee4-8e13-d17fa3e89b15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613170, "uuid": "6221fa4c-210e-4cfa-be72-fa4754dbf7f8", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f7a2d3-d879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667481, "uuid": "56d63a34-a516-4f57-9c9d-b34143dadaa4", "comment": "Malware payload (Mirai)", "value": "755f40c99d2d5474d87801e3cc2f14fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667481, "uuid": "a7b81562-23d8-41ff-abc2-0624ccacfa40", "comment": "Malware payload (Mirai)", "value": "466a110a1565d3b3374e091259878f62750bce358dfefacf1f47c1a5cf4d2a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667481, "uuid": "15d2806c-7827-469a-bf68-07d4326033ee", "comment": "Malware payload (Mirai)", "value": "d56443e9c094d443e52a7c048c75c9e56ba34c87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667481, "uuid": "b937855b-85b4-4173-b9c0-f4e43209dcaf", "comment": "Malware payload (Mirai)", "value": "fac0ad6fd507a6bbaf62fc7d12c99f3cd3f8f68b25a75b0e9ec0ba6a0f82de85945debb3a121019740871d010eff0bb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667481, "uuid": "3e49e5fc-f970-4fcf-ba74-2c7d5f805bf1", "value": "T146932883B892C96EC6D413BAB66E268D3352B3B5C2CF7213DC149B60778651F0D77A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667481, "uuid": "cc5a94d5-ba04-406e-b930-485796a5bbf4", "value": "1536:EoztRGcyr7vO/eaFlELmD1pdXCgmN4lHgZPijsZ6sopUqMQS12IymQY2AUm6hh1Q:5jGcyrz+F0ml8n6Fb7SD6hh1PXCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667481, "uuid": "03e859ee-f6a8-4938-9052-a8d64f70a86c", "value": 92300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667481, "uuid": "fd5c40a0-c369-4af6-8c15-ebfad9b2d706", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667481, "uuid": "69e9df20-538f-465c-89f6-292ade85efa1", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb0e876-d85a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765654465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654465, "uuid": "994a1ab8-7d55-491d-b5d2-6eea4c147034", "comment": "Malware payload (Mirai)", "value": "52ba01fe4d7aaf57062024f851f1d9e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654465, "uuid": "5d05df8b-624a-43a3-a2f5-92f73ccafc44", "comment": "Malware payload (Mirai)", "value": "466f7d830adfaba09065cb42cc3d10219382cea6da3976238f4785c97da41d28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654465, "uuid": "a9fa0461-f418-4fb3-9062-9fb75cd38bd4", "comment": "Malware payload (Mirai)", "value": "00d837fb88e04fdf7e1e82a1d0302ff81baab246", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654465, "uuid": "54cc769c-d440-43a7-9cd2-d80271c6aab2", "comment": "Malware payload (Mirai)", "value": "464ab36d3456352d0ef85b464aad33d4b08213108519723da873c643ed2e86ca5e16c267935a9228942fa0896fe5c6bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654465, "uuid": "ab40931b-594a-44c1-847c-b44fe87fd072", "value": "T13C635C4372180D13D1AA1AB0253F5BE193FFA96121E0B386B51FAB5A8676F334046FDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654465, "uuid": "2843f39a-480e-47e2-8fda-e1884a19c38f", "value": "1536:hZAManQbOOqREbAWTLBWMHSggZjHpRE0knv8VRh3:VWjkAW1Sgu9+nvy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765654465, "uuid": "a2ba5b76-f1fc-4288-9bb0-66dc7c4a731a", "value": 71156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765654465, "uuid": "5eee2973-bf7f-47ca-9677-3bfc1509d690", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654465, "uuid": "c7838fd0-eb65-409a-838c-7aba3ab8b95d", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2eb0508-d7ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765585731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585731, "uuid": "1368cbe2-29b0-4fdb-b618-669842e76290", "comment": "Malware payload (Mirai)", "value": "11d0a44a9ad0a6af934ca753f634ab49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585731, "uuid": "e52dec63-e6e2-4b98-98bb-85757cefce15", "comment": "Malware payload (Mirai)", "value": "468c86e06191bfcd9a02b0c3c23d07270efd5f89108c6dd1e318481b36515e71", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585731, "uuid": "8ba3cf3b-a340-40d0-8048-7f1ca3b78e5c", "comment": "Malware payload (Mirai)", "value": "d1eafdbb138c324905194902b36a15ff9ebc596e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585731, "uuid": "52d863fd-b0d8-4d7c-9596-e673d7d0eb34", "comment": "Malware payload (Mirai)", "value": "e003f418e673f22ea0ce7243880084cf2b910f00f997076931bde7f8b71d5c807293433f85a8ce37eeb11670a7e5656a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585731, "uuid": "fb9c099c-fc35-4f12-9c23-6ac40274b5bd", "value": "T19E04BF63B70B18D1CC2106F807C75BAC292714136DA7D6E3ACAE36396E774CE25163E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585731, "uuid": "9907d41f-acc5-4630-926c-3bdeca01a487", "value": "3072:NZzLfLKSLeuzM/CvCIPndW4lEtdDbECmkJagQCLKL2l4OXub01Mizq:NZzvvXgmPn2dvf7J0CLKSlIizq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765585731, "uuid": "21792732-bd25-4b6f-be54-3092b00447c3", "value": 190180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765585731, "uuid": "56410d2f-40cb-4bb7-8d93-1fb5c78854d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585731, "uuid": "2fd91a9a-4c20-48ad-9db7-201fe4fa025b", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92048d15-d86d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765662556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662556, "uuid": "df163efb-0b26-4f97-85c6-45329205f931", "comment": "Malware payload (Mirai)", "value": "acc271977ea1dfb4573d8cf86e8adc4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662556, "uuid": "36764e93-dd5b-4730-9a8b-85f221f55575", "comment": "Malware payload (Mirai)", "value": "4743737b3db4ead6766d40e9097f8075326eba60c1efb365fc2fda9e3ce08d2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662556, "uuid": "3b3b874d-3ebd-4666-bf1d-d5cc7aa6c053", "comment": "Malware payload (Mirai)", "value": "79604ecee6535b9b6fdf4f8dbe125942e57272a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662556, "uuid": "dae90ac0-d886-472e-be69-60e804f46b06", "comment": "Malware payload (Mirai)", "value": "d1c110d5edae9d17d920bd98a47176b6a83f691b22958723365fdb0af73ffb627ec064e65d37bc468e03e6817e126624", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662556, "uuid": "d1c9239e-acd0-488b-ac82-07da9129d31d", "value": "T14AF38CC6E643C0F6E952097211BBBB338A73D13F513BEA43D3B99931D841541D626BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662556, "uuid": "e37c8a3a-51f1-488a-8d83-c3fad7e594ab", "value": "3072:k07JtGWZ/jMbjHCcUlvkWjZiaFZ1ubtEoFtl1SvThGB17V:k0DGkLYjRo+actTSvaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765662556, "uuid": "ac869d65-41d1-468d-b9a1-04d72cae9824", "value": 166408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765662556, "uuid": "29f3618d-36eb-4a32-8ef2-1f19bfab2171", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662556, "uuid": "68d17375-8c12-4455-b4c2-905349b23f03", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf3a7d4-d7f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765611165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611165, "uuid": "dd4a6b10-abaa-4b7d-84c7-ed519ef2b6de", "comment": "Malware payload", "value": "8d2e610505c6cdfca0661139589d6a6c", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611165, "uuid": "123d8bec-607a-4a30-8e01-9cc3722af62f", "comment": "Malware payload", "value": "4766236a60c8ee605026b025bd2165e503b0c53efc202331e300014b88ee6d28", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611165, "uuid": "1d0fe266-e578-4bfe-b210-da2bd5264348", "comment": "Malware payload", "value": "ffba02f808a566436c992104da78c2f010c7048c", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611165, "uuid": "47b52a53-a799-4a0c-876d-fc21d209825b", "comment": "Malware payload", "value": "0c8cbaeba6eda7b734ac79a845e2b60138d3bb892bd4f368d14d245e08ae07e28cbdd7a7e65c2c1c59c16930bf6e048f", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611165, "uuid": "46cfbf30-9214-4217-94c0-a54a503a88f5", "value": "T1AB286B4267FA01C5E9B7DA3985F64217D673BC466B3086CF264C072A1F736E08E76B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611165, "uuid": "100f34ef-c5b2-475a-975e-13c65b010d7f", "value": "80959bfcea0a5c7ff3ffcefbdfdcb7db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611165, "uuid": "21017702-fb10-44bd-8e92-cf1e6dfb40fa", "value": "393216:jH2yh7Pav4KyBhWgkpyYW7rcVLJlb1Q/9IVYfB0sIyNOnS0B4AycWMCYf2eCHhZt:Tr7K96IFsJY2x0LgZmhrsxwbq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765611165, "uuid": "87619761-2e24-404a-bf7a-31135215f46a", "value": 95387136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765611165, "uuid": "a9132f0c-ae1e-494f-8f79-2b55adb947b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611165, "uuid": "fa37edf5-bb17-4605-b70e-43eae5fc52bb", "value": "Silent-Utility-V3.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde71e75-d7eb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765606848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606848, "uuid": "5afaa6b8-fe10-4a2d-ad76-c4f67a238b11", "comment": "Malware payload", "value": "249cbea12e6d7e1280f5348dd44a5c5e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606848, "uuid": "45dd1812-d23f-469e-899f-1c5c00909dbe", "comment": "Malware payload", "value": "479eb5558b756e45975920568f54893b9ac3435bd63f2663a16533db0eebb6eb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606848, "uuid": "031ad83a-1e32-4bab-8428-aa2ba3f7717f", "comment": "Malware payload", "value": "1be1b218089e4b6e59cba353b8f300b2b3cc930e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606848, "uuid": "82423402-1ca2-4def-8c4d-89b48363b8f6", "comment": "Malware payload", "value": "6e4b851c59f7728ecfefc45578e26c7fd67c5739d131f0b6164e195e3ddaf805eafeeb35a57eac0a4e7d3b0536eddcd7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606848, "uuid": "09bfe38a-914d-455b-963e-de5759ca9972", "value": "T167A65A3439EA502AF173EF7A9AE4759ADA2FBB733B03545E10A1038A0723981DDD153D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606848, "uuid": "c9ca1bdc-00bd-4d96-bd0a-13312dd8b35e", "value": "49152:59Zf7jizoL5laI3xpwVtIAJMzH734Eo07slRXTMZalGbPaph1Xvg+DoSJUoZ9edn:h0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765606848, "uuid": "2914bd8d-6b8e-4bbe-afa1-9bf1936f9c14", "value": 10377728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765606848, "uuid": "ffdecfbb-94a9-4f71-8622-d8a84613a10c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606848, "uuid": "9dc26497-ef00-46a5-9201-8d9ece88675d", "value": "479eb5558b756e45975920568f54893b9ac3435bd63f2663a16533db0eebb6eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193945b6-d824-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765631000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765631000, "uuid": "2807e7d5-b0a7-448f-8ad9-068212f29015", "comment": "Malware payload", "value": "39a959a26c7a3c5f4fec353dd2321ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765631000, "uuid": "83292446-1ddb-47a4-8586-e1857aa2173e", "comment": "Malware payload", "value": "47c6993a4578742ce5c1f7a73616437b645aada0032d2d64264aa626cb5cd87d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765631000, "uuid": "fa14ac50-a191-4302-aaed-dca19a24b3bd", "comment": "Malware payload", "value": "9e32394d08f9304c25a8d8aa5c4ae7d50b40b8a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765631000, "uuid": "c3d0662a-d044-4230-b1ad-008e89031ce9", "comment": "Malware payload", "value": "387a51e4f792e58f10c19fa92ab040cd93358e63a7a6152febdbc041ac00f7e9cb63691f262fa3bed757119a4e9c9a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765631000, "uuid": "6685cff5-0db8-4435-b76a-6185d2f95c79", "value": "T132765C2B76A4C16CD16EC27EC1E34F01D533B4B65B32C6EB929222651F66AC45E3F234", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765631000, "uuid": "016f86f5-646b-4244-aa91-17a966a6daf7", "value": "e25b9940291226e05857e82cc1405bd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765631000, "uuid": "ed2139a1-388b-4a3c-9be4-ed4398d7669d", "value": "49152:M09aWH9evnpIgnxU5Mkv7bZUU1sSGerywqHKOrfGJ2KY18pM414wdNbUoHGlCZFn:M0HHhuB8xECZQG2E9Ev6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765631000, "uuid": "4ee9ceec-333e-4acc-91c0-15716c33eece", "value": 7241728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765631000, "uuid": "29a50f38-f534-41f8-b6cd-52fc5cf70126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765631000, "uuid": "6793328e-2feb-42c9-a5b2-88f5afad212f", "value": "SecuriteInfo.com.Win64.MalwareX-gen.44446329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ef2300-d87e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669622, "uuid": "0e19160c-a89f-42fc-9b4f-836502ae475e", "comment": "Malware payload (Mirai)", "value": "a42787f5508b83bd97aa3a94fe1c020e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669622, "uuid": "f4957935-e5a4-4e81-b3d0-8cf30282b8ed", "comment": "Malware payload (Mirai)", "value": "482c573680d1c5c130cfa01e1cd0e14d016518bc489de428bd504b24f427936b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669622, "uuid": "9bb6d602-9391-4f27-b7a2-414e88347e8d", "comment": "Malware payload (Mirai)", "value": "1ecb42933458f03a1c368149d38f977c91751d6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669622, "uuid": "fa29dcd0-d571-4f14-9c75-885f525f8be0", "comment": "Malware payload (Mirai)", "value": "d3b423b9c48aa9e09e143076d64fdce8a21cd5db3beece716fcce7f4f9dc54d58e71860e017fa7bd3af4912685262c7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669622, "uuid": "801d1c52-0d6e-4e79-bc41-19a7d298e4b3", "value": "T1E8930886B8819B55C5D922BEFE1E028D335357ACE3EF7212DD115B247B8A82F0E77901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669622, "uuid": "01bc9a52-e814-49cd-89a9-9b4b05c49f59", "value": "1536:OtnNzJnP+YAqkjp4guQW/L/MijI51i0MLZI+lSz3Y7llegiXkO7MwZ2YmgBnv8VR:WP+NbG/LjE1i0MLZI+lSz1tkO7MwUkBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669622, "uuid": "15477649-e5f6-4d97-882e-dce1874231cd", "value": 96184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669622, "uuid": "8905b3ce-6bda-4973-874c-ad16f5b69e9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669622, "uuid": "5bfc31a7-5bf5-4d50-bfb3-cf84b450abf0", "value": "nklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9cc629a-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613203, "uuid": "de1f5d72-478e-4657-ad1c-3128fa267bdf", "comment": "Malware payload", "value": "66b42a41646f2b0546e716160ea07c73", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613203, "uuid": "ee5422d9-965e-426c-a5d3-07f9a3ab77f3", "comment": "Malware payload", "value": "4832b1eaa8a1c119dc97724ecee8ef317e7708e0800f4992cf8de8f7e42d5ea8", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613203, "uuid": "6c889830-2f52-48b9-be72-5cbe0123714f", "comment": "Malware payload", "value": "ad66bd66a76f46101c05a537e4f89729aecc1351", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613203, "uuid": "f72e56e3-2ab9-4e13-8b1a-68a02829de08", "comment": "Malware payload", "value": "d6be8a0198500b7b641b2079d021481f9deae48cdecc89fa998264dbaccea32e3fad38fe22b4b9b6e6d758bb5e9eed34", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613203, "uuid": "f314593d-6a09-44a0-9033-1aea812f841d", "value": "T1550608FCD2CC1681EBAB65AFC7063AB1A7FE0A499B46544D40FCE5D62903BB4C327446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613203, "uuid": "cb548341-99af-4cc4-a6b0-2dca24fac42a", "value": "24576:sIWD4Axe6mRhTLF9RkOlPthT9AJoC6NK5FY0zl3ihPq4W8xHo2ZG0HYx24M1iybw:s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613203, "uuid": "dae53980-2b23-4c36-a78d-bd5d0c13468f", "value": 3798625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613203, "uuid": "7dfabcb7-a3a5-487c-8832-8625ce0e04c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613203, "uuid": "3c55b41a-4726-4d19-864a-7d8e14c505d6", "value": "4832b1eaa8a1c119dc97724ecee8ef317e7708e0800f4992cf8de8f7e42d5ea8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac9388e-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615514, "uuid": "1ccfc30f-3686-48cf-ae56-4b30fc20feb1", "comment": "Malware payload (Rhadamanthys)", "value": "8967960942fc707277292f12c3bb5ecb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615514, "uuid": "78677c24-6d04-435d-996a-b6a079e54218", "comment": "Malware payload (Rhadamanthys)", "value": "4953d73931d674a3883e70b7129acdfb1d09e49920384b6f1d83a0304a8072a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615514, "uuid": "f009826c-e1ac-4d06-96d8-ca177f56d0d1", "comment": "Malware payload (Rhadamanthys)", "value": "819f2dd7c33ea4299432e8584ba121ce15258ee5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615514, "uuid": "a5a24d29-3539-46d0-841a-2f989b92fbd1", "comment": "Malware payload (Rhadamanthys)", "value": "350adbceb828e4b2458fb0c4fa34e90e454e901a8875da73cc403e0105435ed1dd3145833820aed1f29297f996ce4078", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615514, "uuid": "24f1e9c6-da01-4eff-b48f-66292068ff0e", "value": "T154A33A494B23ADF215797B331D6701AEBDF973E38403A09493887F56950CB6E0A5B2E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615514, "uuid": "27fe0d89-66c2-4aeb-953b-79dc3d965f36", "value": "1536:GDB7eKg204oLopr/r+cVojNo+jTokoFo9AdoKoToHAz6BkQWJ+aY:GDB7b0pMJTfei+olOdTkHAz6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615514, "uuid": "b28315ba-edd3-431e-921b-fa725eb2d4f9", "value": 100780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615514, "uuid": "199027be-b8ff-4ab6-a282-eab9278776ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615514, "uuid": "27fe98f3-5306-4e1a-9740-a8b78be3328c", "value": "invoice-1637482117.pdf (100).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126ca9f1-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615956, "uuid": "65c2f885-bda5-4af9-ad1e-2dbcfc65898a", "comment": "Malware payload (Rhadamanthys)", "value": "10fa5d13c5a114d0e77adba37db0c38d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615956, "uuid": "82218943-0c4b-4f15-9108-c787da15cf4f", "comment": "Malware payload (Rhadamanthys)", "value": "4a057cf5f51e2b08f00db1fd9e453ea07ba4bb0988135c0e35a034e31e9bbadc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615956, "uuid": "d8b01a3c-1c12-4050-aacd-20170a77b559", "comment": "Malware payload (Rhadamanthys)", "value": "831a9e3b70e5f42038d53b0eed3440434c71a7a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615956, "uuid": "e6aba0d4-c1c9-4ed1-9981-d8966b68f5e2", "comment": "Malware payload (Rhadamanthys)", "value": "59785af27f74f30349571e19f7fb48f50f15e0c8947b2ca1c7b1f00a77b1fbf6e9bd6bb11a9eb6e00300109a7f35f1d1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615956, "uuid": "365de3ce-081b-4a30-94a7-c2d3548d6b71", "value": "T1A3A30B74AE972C24C4C364B8899482B1DF39874557E9E0B8C70EB3D61689F0F4B76AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615956, "uuid": "ab800289-669c-4322-ac21-36bf67b5f77a", "value": "768:GDhd0i7J4sYKgY/CMNfWdtb2s1rXQTrL3RpHuLABEzVSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20LrOrL3RULABCV6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615956, "uuid": "cd6d3063-5e6f-49a9-8014-7ac067ec2b51", "value": 100124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615956, "uuid": "3228d0c0-6e66-408d-b0ef-ae19e74ea7ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615956, "uuid": "502099c5-1a89-4d83-87c6-eead497b9d3c", "value": "invoice-1637482117.pdf (5).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b49563-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639122, "uuid": "73593659-8e2a-4efc-a41e-b89dc89ed414", "comment": "Malware payload (Mirai)", "value": "20d88c5a104adebe03c92d2a1c258dbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639122, "uuid": "121f091f-c47e-40dd-bd00-73156896a0d7", "comment": "Malware payload (Mirai)", "value": "4b7ffa06d23aff7b17c34800426c0d2705a27c38d8690ae7bfbeb4e9769313a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639122, "uuid": "2562a77d-d9ab-4493-b54a-6ef058a40b37", "comment": "Malware payload (Mirai)", "value": "b035a71184b80d7b214c82bbc29e5deb021ac7a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639122, "uuid": "3d4735cb-e1a5-480e-a04a-298c456cb822", "comment": "Malware payload (Mirai)", "value": "87dfb87c632ef4fda3c0c59046f5a72dff0a1cba8c58741fb1b7f760c0155820f8377a7a4c6e34eb105dcfaabcb94b79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639122, "uuid": "909ae660-685a-4ceb-a9c0-3dfdbef831a5", "value": "T146C3AE73D42A7EC4D1514034B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639122, "uuid": "d58f3d4c-b12f-40e6-975f-c9009ef90500", "value": "3072:hfpZykqkt436I+9eIHHmNOkSMPXeC4GnHM:hRZ0F3BcGNOkvZhnHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639122, "uuid": "3cf2907f-8e52-4ef5-b263-bfbf277c91a6", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639122, "uuid": "1a5541a3-86ce-4a5b-9568-11e71f251ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639122, "uuid": "b5737f28-8d4b-4bc1-8d88-5c001786868d", "value": "frost.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1b612e-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650256, "uuid": "6265bd82-f4f0-404b-b148-6eb2a56ea92c", "comment": "Malware payload (Mirai)", "value": "36f0c76ed3613bd1f16479645bdeed8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650256, "uuid": "b600c3d9-377b-42c9-bfe4-1e351fbd3358", "comment": "Malware payload (Mirai)", "value": "4c60dd228762ced070cdd57c047e83432439ec8134477860ababf085892f46d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650256, "uuid": "c7a039c5-4aeb-4506-b46f-4df17bf2aa0d", "comment": "Malware payload (Mirai)", "value": "fcb96496b0673830163a75a33a808a53e081e214", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650256, "uuid": "26ecc75d-02c9-4796-9636-160d1f704089", "comment": "Malware payload (Mirai)", "value": "5b313ed35d9ef4acb52bdae0271f8c9a9eb24ec55c0db42c8c99be6317f5b1148d560851a6bb18f92159e6b79f4b30dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650256, "uuid": "bd0de820-c335-4c0a-bad2-80dd4eb5c39e", "value": "T181B4CF63FAF45FD5D8120A741CF9E2340358F39203D26A41E6FEC965284BA7A7E8DB11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650256, "uuid": "559b19e3-222e-415a-8746-6201919f3ab3", "value": "12288:bRupYNv5sU3BnDsqtLAYl0gpi1qc7AC6640mf8pn1gV:bpg83tLp0MiPAtVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650256, "uuid": "68161dd7-fa85-4c96-9113-48429e15704c", "value": 528908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650256, "uuid": "9bce4e57-35b3-4db9-acc2-a486a49b2931", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650256, "uuid": "b7e8a9da-09fd-4bb7-946d-6a4d887ceaba", "value": "shadow.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84c515f-d7f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765611107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611107, "uuid": "bb04d6a8-7904-44f5-9124-500b0224a42a", "comment": "Malware payload", "value": "52fd6a976f0d7185c8472037409f09d8", "object_relation": "md5", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611107, "uuid": "edd4b0c2-101c-41d9-8bb4-b571c4c69651", "comment": "Malware payload", "value": "4d9ee9755ffdff948664d91ef18d6f37b9a58fceb6c1510af5e013898c0aeb0e", "object_relation": "sha256", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611107, "uuid": "dc1548b5-cf9d-471e-bf63-ab30edb51dd6", "comment": "Malware payload", "value": "187db8b2484386c59003c66076d8227dbab35112", "object_relation": "sha1", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611107, "uuid": "5110ef18-cfa3-4ac1-ad0c-de25be3cec88", "comment": "Malware payload", "value": "2960c4aba1349b5614d32bdbffee72191a2659d091b5011141ea94da1b899ef65a74c6b677a5a09000862f8264494bdb", "object_relation": "sha3-384", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611107, "uuid": "a8014022-8595-4a9e-8caf-704edf64aeeb", "value": "T132C08C87850986B95A87C2E6507A6F98C50EA505D1AB246323B284A5E4961CD814C3C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611107, "uuid": "522d26da-0697-41ba-acd0-f0868d18f301", "value": "3:TXT2rGjCMeasGSHCMeasGSeASZJWOen7ROrSLkueDXBiGRKLPwi+2O9221W9vn:P2ijPeanSHPeanSKZJbtGLkue97QPccR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765611107, "uuid": "2715d26b-6d18-4199-bc24-47c647009b8e", "value": 163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765611107, "uuid": "35b86c41-0346-410e-aee0-6380c4605386", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611107, "uuid": "434f55bd-4e59-4ba2-a22e-507303095365", "value": "4d9ee9755ffdff948664d91ef18d6f37b9a58fceb6c1510af5e013898c0aeb0e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc79971-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605264, "uuid": "b06d6ce4-9c9a-43ee-b915-8c99711dc032", "comment": "Malware payload", "value": "476630f2ade308fbadeba7339e6b5497", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605264, "uuid": "14a6e293-f859-4bbd-bf1d-ab45235d5ee7", "comment": "Malware payload", "value": "4e4acc0a6bb61cf07705aac7bb86ec5a014f68771566cfa9400e702561c645f9", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605264, "uuid": "6c2376a4-6210-418f-bb87-863bb4063888", "comment": "Malware payload", "value": "7878c071a4f9259a663127cd4c72d28b213a7a22", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605264, "uuid": "c1b3798c-c855-4547-a472-9f0463f05d07", "comment": "Malware payload", "value": "1a8852b9c552d4641e3c9eff1a50f5fb6fec167cc245da3491dd01421a9427b9ece3d952f5de114553df7e697ebdcdde", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605264, "uuid": "1e2c8966-2fe6-4064-a5dd-175222c4f6bc", "value": "T112942A63E3982804CBB886F58B599358BA35FB5C1370437B7B5062E6ADF63540E1BF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605264, "uuid": "118dcc44-c368-4cca-8f36-95acfd50ed32", "value": "6144:z4QZVhf5x8vGrq0x5XTQOJrnVpUtGixECiusL:c+hf5x8er39TQwTOGixECiusL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605264, "uuid": "47a1fb50-bd97-4ddb-af09-ebaef51065cf", "value": 447280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605264, "uuid": "eccfce53-ba42-4341-8a11-2445491e923a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605264, "uuid": "f3e3f81c-f004-4dc5-8e95-51a657f37d0d", "value": "4e4acc0a6bb61cf07705aac7bb86ec5a014f68771566cfa9400e702561c645f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a339640f-d7e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765602884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602884, "uuid": "2b398a45-3618-45ed-8d77-95d426da88fd", "comment": "Malware payload (Mirai)", "value": "6c4ff73c705abb1836df857a1fca503d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602884, "uuid": "7537f643-b64b-4c57-9c99-d879fa5a0934", "comment": "Malware payload (Mirai)", "value": "4e556816ee6a26376a76df9cecd1574020337653d73adf4f24d2649871ae8cab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602884, "uuid": "cd835dfc-51d8-4f68-af1a-28285adbfae7", "comment": "Malware payload (Mirai)", "value": "ca90eff82ee673a6c42d99578ad07a64d2615aef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602884, "uuid": "c615bc4e-9f3d-4f16-b290-d50cfeaf44c9", "comment": "Malware payload (Mirai)", "value": "8801745b1731c9d1f4966a9682f1b626a0cb4b2e116478f9bd87ab66ea1937c2b8ac2813076e04549fc7cec750c0c181", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602884, "uuid": "aaf9d5d1-8545-4b7c-b9c2-938b94ac50a2", "value": "T1F2E37D4772180E47D5A315B0263F2BE083BED1D121F0BAC9791F5B5A4676E3B1486FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602884, "uuid": "198ab00c-ff0c-4705-8466-4506c4f4e4b9", "value": "3072:39I8JBNTrp3PS+wUxGcEemcN5DJ2x4pftu6NU2Dof:39NNP5a+wUxGcEemcNVJ2xwNU2kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765602884, "uuid": "046c37f8-adad-4018-b787-c23466bd5b2f", "value": 157240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765602884, "uuid": "0443dc4c-b311-43f5-86fd-0b89118d7dc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602884, "uuid": "037d3c5e-9127-43e7-a1d1-7188e80e4c13", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e147d1-d7eb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765606800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606800, "uuid": "fbb3b74b-23ad-4b99-8d6c-9e19bf62f17c", "comment": "Malware payload", "value": "c3bbd293652850a5fde9ca0c7c868b25", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606800, "uuid": "a1907333-b642-4000-927b-9e15edb3ab46", "comment": "Malware payload", "value": "4f5c28df89ac6cb5c301063960e86253bb0723db993a041e4c44f66576f680d9", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606800, "uuid": "63719f21-cb0a-4e2e-aca1-e2a6b7909fa7", "comment": "Malware payload", "value": "f987c65162e11517fa7549cc3748061441dc7796", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606800, "uuid": "34f19ce0-8067-43f9-996d-2b5e579d754f", "comment": "Malware payload", "value": "9a3d738f125fc3a3d412cc4e7d6ce92ad2b3f66137d839a6a6b98e4ae40a6d2dbd729d178ab2336cdfabf5ddf9c5e947", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606800, "uuid": "d697c49e-fd77-4e02-8e6d-647b4f0c7096", "value": "T15CE0CD0FD549306BE46E14F4C3095F16157CD5903DD49F3F5146793548896A46DE2055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606800, "uuid": "cd274b97-4c65-4e2f-a980-b6971d61d4ff", "value": "6:5jtlsA7mju3E4eLj8XtO3NWNhh6/+bwOtleiA7qmt+lgt/:5jtlh744MOtUYNh2+kgl07qmtag1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765606800, "uuid": "07805a4e-ef89-420d-80e5-1c2952189f0e", "value": 316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765606800, "uuid": "c345e9eb-5ce6-433b-88a3-9ca7f021de8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606800, "uuid": "8758c877-bcdf-45a6-a971-7be50fca5493", "value": "Invoice#222.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e184c61-d7e1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765602285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602285, "uuid": "2414133d-5f0d-4517-8ae5-bfa19f937274", "comment": "Malware payload (Mirai)", "value": "6a789d0958f4d4110b0a41e6345ec4e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602285, "uuid": "7ac68b56-3008-47bb-9e3b-2c72406c7430", "comment": "Malware payload (Mirai)", "value": "4fbc1414f28f6be64e6a7df2312598467c361bf972e09c96dd4369ee91f82667", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602285, "uuid": "5ef520ce-79ee-48fe-ad58-4e19e16264af", "comment": "Malware payload (Mirai)", "value": "69dbde4f89fa2c1dd58fa34e39ad58c9a546f4d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602285, "uuid": "c16b7563-0da2-4ea2-9d81-bf2311c99a4e", "comment": "Malware payload (Mirai)", "value": "cfd2487e5955e38db0176cef20fa7236d5c3d2ba9fde0c58a6761e6310f810677735db2d63fda98c728f460ec10d3a0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602285, "uuid": "9b5e90b1-21fb-4d21-8007-f2d42461b95e", "value": "T120630842B8919B57C5C01B33BA1F435933329748A3AB7747DA186FF06F8B61E0F66246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602285, "uuid": "55c4e48f-dd8f-4199-a56d-f4af6d8f0b26", "value": "1536:uYdcJ58sB30PPI0VuIpFqWoj9yMqLf+7Cjj9hPabdi:uYC5/h0PgyppFqWoj/qLGaCZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765602285, "uuid": "e411313d-b096-4806-8cb5-63d0370e9ff2", "value": 71663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765602285, "uuid": "a237882d-41b5-4b2d-bceb-3d32fb3ee303", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602285, "uuid": "3cc95f28-5e2d-409e-a3b2-4cb7574c904a", "value": "n7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c75ef9c-d7e9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605692, "uuid": "564c027a-4066-4517-9f98-c948759033ab", "comment": "Malware payload", "value": "42c4db508fa7c6f9351c09644049acd8", "object_relation": "md5", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605692, "uuid": "9d5a5479-1260-4fd2-9d34-caf31803218a", "comment": "Malware payload", "value": "502f7291f284ff79aa7ffdcfb32cba6aa92945114f9ad46b9fcd3851cb1d497d", "object_relation": "sha256", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605692, "uuid": "5a97b189-b857-4fdc-976b-5c087ea02b99", "comment": "Malware payload", "value": "67ec824100786abe7cdce1ab818c505f6884c3ce", "object_relation": "sha1", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605692, "uuid": "44aafcc8-11d0-42ac-ae22-2336bf77f573", "comment": "Malware payload", "value": "febc310ce964038c866692ac5b52ee9d1138e170710f1fe09f998522c7e36fa4302f8814c8355f3de30319bca833ac97", "object_relation": "sha3-384", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605692, "uuid": "2c00709c-6a7f-4b18-bb02-024536aec8d7", "value": "T1EC5733ED1659AAE2D69490FC720F9844B19713BD2C8A74FDD36D1A6EEB070C1803E1B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605692, "uuid": "12ce38a6-c6cc-4e4e-bfb0-5479f33ab70d", "value": "786432:yRtkpaFmep6sGf20HddipcybMK7PpaRH/otwW0R:yn/FTp6v2GPiZ7BmAtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605692, "uuid": "3b7c6dd8-5a92-42c1-8b23-5729188ef427", "value": 28070167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605692, "uuid": "8c073ab9-e60e-4a64-932b-fee2c66dddf5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605692, "uuid": "2ac01432-73ca-48d2-9da3-c075cb8ea21b", "value": "502f7291f284ff79aa7ffdcfb32cba6aa92945114f9ad46b9fcd3851cb1d497d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e65791b-d84a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765647356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647356, "uuid": "e2306af3-59a8-4e71-b6f7-80b0f8c23fa4", "comment": "Malware payload (Mirai)", "value": "245d9ae733e6686ab00d4dbdf21ec1b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647356, "uuid": "bd98cb5e-720b-4197-8947-86776cbb49c9", "comment": "Malware payload (Mirai)", "value": "504bdd7246999c6e036c15a85b654982c6be5c4dc5f12fcd536d22b5dc937e4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647356, "uuid": "1e9b88a6-ae3d-4e38-bdca-75d1fdd9ad34", "comment": "Malware payload (Mirai)", "value": "87fcc68fa9137403a0b06aff0a51996f74e7ba55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647356, "uuid": "6ee567c3-364a-4a88-862c-dd0b4dbeb942", "comment": "Malware payload (Mirai)", "value": "c145120ca822b8019f86ab734e6cc8a419c2b35d89dacc3e708e69657f7559d6c5ec6da5abf8e6743deb7128e8851ec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765647356, "uuid": "da3ceaf7-f541-477a-8708-25f8ef824b34", "value": "T1D6232A91B8819A02C5D423BBFA6E41DC332563E8D1DF33079D262F507BDA82F0DAB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765647356, "uuid": "d9575411-92a7-4aa5-8cce-dbf2d825e256", "value": "768:rsjoR4ddTIuAd96kvRkw+hlTd7ZIRINk1XjoKBT5MeQd6NwTTP+OdU/hJCOnLAQY:aoKPT2/2lT2BVNQdUOj+wU5JKN27aRoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765647356, "uuid": "8c8a64ff-1720-4fb0-9189-c370a620de81", "value": 47812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765647356, "uuid": "77b1559b-ccd3-4105-8b42-b1e412931be5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765647356, "uuid": "21106bd5-de49-4ffc-ad82-d42c85aebe39", "value": "Mercury.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afb0c51-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639136, "uuid": "138552b9-da6b-49a6-9ebd-0c7c4ecc4404", "comment": "Malware payload (Mirai)", "value": "64dfeb9432a5abdf2f2bbb5a571281af", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639136, "uuid": "ff5ad8aa-e310-4aa6-b671-a36ad1187341", "comment": "Malware payload (Mirai)", "value": "512d8dec74c9b119c4fc480599df915c1d4289d2bb41eb4c432fb37ec4b627e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639136, "uuid": "1fb963bb-689a-4bd4-a868-d5f75085b7e0", "comment": "Malware payload (Mirai)", "value": "412fcb8cbb4a0fba7f914ec04ac411ee18d289aa", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639136, "uuid": "3af6a8f5-02fd-4a06-93c7-0b7e243c02e8", "comment": "Malware payload (Mirai)", "value": "de4e8d75c746e1e69adbd76273dd6d097a3a4461283ccec562826340f97eaa9514c50e3fe50021901c3bc4b8ad77c7e6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639136, "uuid": "d3608b2e-c4f0-4b5d-a7b7-f8937f29625b", "value": "T146119D8E2390112ACB09DF583DAB2F186F85839CE5B54B1C5986283B42BC704F04BF1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639136, "uuid": "fa927035-6108-49f4-9407-cc252ed85c39", "value": "24:4qsObNqsjIX2qsxNI5n5qs1rKDsqsUpHqsd+kqsfspHqsBCqHqstukjqscx/qsyQ:oetoqApxyckjMUfMjIqjQkvu76houA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639136, "uuid": "ea84c133-8a97-4932-aaab-e1cd23b527ff", "value": 1022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639136, "uuid": "3c2d6d12-5300-4419-8344-fdd83a7df05b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639136, "uuid": "79bd6069-4b06-4e46-b6f5-75eed7b0d6fa", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f901b581-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666594, "uuid": "b5df73a2-f604-41dd-8df7-d0074ec9d4be", "comment": "Malware payload (Mirai)", "value": "1dfe97c270bf935c36ee16a7d4d76a52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666594, "uuid": "e0cfe651-f888-4833-933a-e6d4c2f6d0ab", "comment": "Malware payload (Mirai)", "value": "51770ca4c2a200d14f4b13cb4f0af747a4203db8d66b4490a562071f0d581bf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666594, "uuid": "6c2b34eb-1a91-4585-b374-47caeacca25e", "comment": "Malware payload (Mirai)", "value": "e87836868d84fc734600e5aa1ad80243d5f97a40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666594, "uuid": "c29ea173-59d8-4276-84c5-dcaedbead83c", "comment": "Malware payload (Mirai)", "value": "d7022b726ed7c13584c62498352796108fa7603b7d7cee4264c4fe468f870dfdb49400ce97b46881730f27050dcb791c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666594, "uuid": "c8c2e32c-4efb-4d84-a415-73de50707d5d", "value": "T116F34B13F58180FEC18AC1345B6FB63AE935B5DE1238B6EB67C0EF123949E215E2D944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666594, "uuid": "dee53bba-fbc8-4d81-845a-d5b79b5ca6e4", "value": "3072:BV5KDWFB6kQIh8HZQZuREYEAgGQEmpOPbSq599A75CSXEEMMuKYuFiC8H0BaAyUh:b5KDWFB6BIh8HZSuREYEAgGQEmpOz5ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666594, "uuid": "cd1326dd-efed-499a-94fc-3e190f68c313", "value": 162856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666594, "uuid": "18e5794d-30bd-4e3a-a66b-02610a586d5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666594, "uuid": "2416be9c-7bb4-4027-b617-d80f35b4992b", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b427f66-d87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668530, "uuid": "3576a059-32a4-43c0-a326-04d911afc03a", "comment": "Malware payload (Mirai)", "value": "d98a6866d2de3752ec52898494bb5a90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668530, "uuid": "e5f8dda4-7af4-40f7-a043-a73a61e7cd33", "comment": "Malware payload (Mirai)", "value": "51d2d4c77f0d9aedc60020b603eff4c4b053a59e3b6da3d732e9971730ac0663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668530, "uuid": "f72e88cd-aac8-49e7-ae2f-5e1a34d13a47", "comment": "Malware payload (Mirai)", "value": "7afdf07ece1a25e456601d91b226e0ebab6248d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668530, "uuid": "8a0c9c85-a99b-4401-ad2b-01a7961c772f", "comment": "Malware payload (Mirai)", "value": "cb3c254811784f1d160f5f9f18fb245affb2e4fca39cc8f717750648cadd17fe1e230d8e5642ba989de69094bf991dcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668530, "uuid": "b0b494cf-612c-4600-8c1d-f93c858bb940", "value": "T1B47302469B514E62EF9090B20A750B1ADFA31F366526F63F35ABC0D76A870E070817B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668530, "uuid": "96f1e541-f26f-4853-a5c1-3f930e3c3bf5", "value": "1536:x/WqcTxyd1rC/svj2Hy/7NYeTOEXII0LFpeDVJuv:VWquknr+Qjiy/hFiI0L/eDVQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668530, "uuid": "66b3e05e-0e9f-47b5-858b-5f28ce63a407", "value": 74516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668530, "uuid": "d181f8d8-50d0-420d-a93f-e1d861365016", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668530, "uuid": "f01a8397-4953-44c9-ba31-a3ddfcc33e9a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304f5d67-d82c-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1765634474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765634474, "uuid": "290b94c0-0430-4ab4-bd43-5d325e981e73", "comment": "Malware payload (Sliver)", "value": "96548bbcebff559943574760b9875f6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765634474, "uuid": "29bbd649-729f-4958-b30e-06500a478936", "comment": "Malware payload (Sliver)", "value": "52236ab4de862e6c2a382db8c42367c6e04ad8217046321bcf3aa5ce1a75d7fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765634474, "uuid": "925fd25a-204c-43f2-a7f8-8690ac158991", "comment": "Malware payload (Sliver)", "value": "864e1d1b7d765924f83cdbed4c23dbe43824d17b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765634474, "uuid": "14a49e2a-8a0e-483d-84ab-ef7e113ed298", "comment": "Malware payload (Sliver)", "value": "61234333adf228083a0188991fd24d28613c711c1f10a1ebef8171e66c71be075489c7fde945576355c4340c1004ecd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765634474, "uuid": "f8587565-5a74-42e7-85fb-2443ff33d0b5", "value": "T12EF60903F8D52495C8E9D1B089254262F971789C1B7923DF2BA1F7B42B327F09E7A790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765634474, "uuid": "34ad6384-1051-480e-a096-b14adc94f353", "value": "98304:zHTIJtqElMI7akdVgcgpPMaQb6YOVDoPxVoSZ4GEepwTPnGrJnGwdD:zzOt59VfgNMRb6bkpVoSoDsGQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765634474, "uuid": "63554e89-8835-47fa-bafa-3c23824fa081", "value": 15831280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765634474, "uuid": "a37ed9a2-b4d9-4ae2-9cda-f45aac361a33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765634474, "uuid": "954400ac-d58e-46c1-8599-1dde85aa989e", "value": "hele", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6694cf70-d858-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765653463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653463, "uuid": "9d8a5c37-8138-4745-95a2-888952be0e29", "comment": "Malware payload", "value": "6f163c0525b1967126b2a84af0d69643", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653463, "uuid": "087e14f4-13c8-4105-9153-a1c9f41ce235", "comment": "Malware payload", "value": "527f8bc1aa16f496031b5d67f94ba32a8c1ac4432daba78575b7bcfff3c24d0f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653463, "uuid": "ca4b9219-2866-40b6-a185-4d44edaa7480", "comment": "Malware payload", "value": "e2a9cb1ab8568c2081a7a34ac8ec62dc1e420707", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653463, "uuid": "45e60b01-3453-48e0-9f9d-d00943ff4067", "comment": "Malware payload", "value": "92c06da3653a5ec52eb11d3300f6b41c2e61783ea7a398a143b4b9ac9695e1b700b61d02c5089b96a1b5c0b1750d1e73", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653463, "uuid": "019476f4-67bd-4f9f-b2f4-34a29801e570", "value": "T1ACB5229539D4CBF7C0206A74F59222F970142EA2D805AC2777B6BC857DF67C289F1E28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653463, "uuid": "7afc5070-5a2f-43b9-913d-79a3dbdf1aac", "value": "a01d4eeeb2e6d1930ca89466fe0f4145", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653463, "uuid": "a8807b7e-6c5f-4357-bd8f-81f846ffbd7c", "value": "49152:ypiTVWAEwFxW0i5JlhzGPV58z6/pxzTu8ho2A8l2TMrVWW6:ZTXEcxFiblhzGdPhA8ho2zl2TMRr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765653463, "uuid": "24674649-47ab-4318-b1b3-baf09326dbf0", "value": 2435784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765653463, "uuid": "bb54ee11-a29a-405a-9fb7-dbff3468c22a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653463, "uuid": "e5930747-c671-4f10-836c-302817160d15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6db8a12f-d81f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765628994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628994, "uuid": "b4a97c1d-360e-499a-95bf-361ecd8ba206", "comment": "Malware payload", "value": "3b3610ecee27894486b86e230d009217", "object_relation": "md5", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628994, "uuid": "925d30ca-9243-4bf7-aeac-5c7b1b2fea5d", "comment": "Malware payload", "value": "52df57494fd29a3fea03b7214201dbe49d110b2add18306bbc85528dc162fad8", "object_relation": "sha256", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628994, "uuid": "34593b95-fafd-4697-b7c3-8d22c1210df4", "comment": "Malware payload", "value": "a353d926a0e5dfb593a3f90c7d61c19aaa9464fc", "object_relation": "sha1", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628994, "uuid": "477d9bc6-1b4f-49dd-a759-19f064d99689", "comment": "Malware payload", "value": "c37310673ec69f35017be35275d7cd16dbb55e54939d4388af352cb2070fa67454a2d14fe1d696c3ac360c213fa3f10b", "object_relation": "sha3-384", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628994, "uuid": "ca1b199e-9fbb-4c5a-a214-6cf39572624d", "value": "T1D305239F591D0634DD592B3AF528A90DBC9BE39B4848EE0DDF2352E05B0D13E1F64E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628994, "uuid": "6f80a9b0-4f90-4bc8-b0f9-76bbd66e08a3", "value": "24576:DtXqMvpO9SoPgDocq+O/WeP5LeqwwrzwoJbgCd1:DtXqMvpOgo4ocqleeljlwoJkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765628994, "uuid": "a8525f4f-b706-42d1-b519-93fb9997b486", "value": 835592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765628994, "uuid": "524cda1b-95b8-4a10-b6ac-01b5c9cf7368", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628994, "uuid": "0c7dd194-cd42-4311-96fd-b4b6978834be", "value": "52df57494fd29a3fea03b7214201dbe49d110b2add18306bbc85528dc162fad8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9444dd0-d81e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765628799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628799, "uuid": "03da194a-295b-409f-a395-63cb96da3f76", "comment": "Malware payload", "value": "2d8efa344914e856e1643b86024f71b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628799, "uuid": "3d54214a-f708-4a84-a13f-d5836012aa19", "comment": "Malware payload", "value": "530664be611cb937abf327d4242777e55c95c1c544505d82bd4f5b367672abb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628799, "uuid": "df76e9ff-d6c7-4345-b411-0d7b9a0dbefe", "comment": "Malware payload", "value": "a2d727f5ed625ba1e18c13c2b3ba7cf7244a0153", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628799, "uuid": "3f0de7cd-1a54-4cae-b5a3-15fd06fb179b", "comment": "Malware payload", "value": "d21f764935b9bbd7a8a8f2d7c1b4bf92eced321e710f92cbdc51670588133d64cc75c30f048eb91c7d4a0fdc8d960070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628799, "uuid": "f797132f-ab86-4ebd-928e-ca34ebdc620d", "value": "T16755E5DA075C3DC0D07D37B254562A94E3F3A5F9C969C319E98CA3D827732822E8169F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628799, "uuid": "5df10588-8f12-41aa-b272-443a368f6afb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628799, "uuid": "78b3adb4-966c-4bf1-b3da-a8cea4ced7bf", "value": "12288:k1ZkpSyepTj594rs98KHOjotVtaJ32aSR8d/uaZ5kcAS5bZ1fcbBdBOWrj2DgeR8:k1ZkpYRsqHiotLCGBarZ1fcbBzraJRYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765628799, "uuid": "2b3c0c23-7bc9-4e88-9ff4-9d4ef8b61471", "value": 1383136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765628799, "uuid": "296ed30d-4b0a-4718-a46b-0e30be4890d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628799, "uuid": "6ad9591e-3cc6-4298-ad30-a24403a0fa37", "value": "530664be611cb937abf327d4242777e55c95c1c544505d82bd4f5b367672abb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55c0308-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613223, "uuid": "f9ee8240-f4d2-45d2-bc6a-7f2200f54e59", "comment": "Malware payload", "value": "6fb4604ddebbb2135b05ef7481d0ec21", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613223, "uuid": "e6a9640f-987c-4d10-87bc-162ab94bd64f", "comment": "Malware payload", "value": "53662bbec99517d160dce18e776ac5ea759e0f520f585c4e45e3299ae0887623", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613223, "uuid": "6e1ffc70-853e-4fcd-9aca-abf286b08e42", "comment": "Malware payload", "value": "16714a64416ed7e6290180abd8dde47185f93125", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613223, "uuid": "e99d6097-21d8-4782-83a8-9dcb0ed254ba", "comment": "Malware payload", "value": "060efcfb11ae3696aab89a0e9875a300e505a0808c0b3f95dfd7adb07dd73800f963ffe50f4c63f3df8519d75f174623", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613223, "uuid": "a95f37f6-9cb2-4fd3-94ea-69884589464e", "value": "T1B241675033BA9A5A480266CBF4969A11D1382D7654E08C51FBEEDF0BC1866A061BFB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613223, "uuid": "cda2e539-755a-4f09-af01-a48d873edd72", "value": "48:s3r1pCH1LQCl83/Z2II09WNub1xPYqCunYYIHN:sppCVLQug/0F8b1JYqvGHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613223, "uuid": "dcf9e41f-6113-4054-9c7f-088407bb3c1a", "value": 2311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613223, "uuid": "ff1ed29e-47ed-43d6-a0b4-72e7beba54bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613223, "uuid": "f9a775d8-12c5-4bd9-9594-6df1e544a435", "value": "53662bbec99517d160dce18e776ac5ea759e0f520f585c4e45e3299ae0887623.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d96557f-d82b-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Generic)", "timestamp": 1765634040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765634040, "uuid": "e46b03e1-9824-4607-96fd-53e5f5fb0e8f", "comment": "Malware payload (Adware.Generic)", "value": "01a043167c5f956665ee333d08a71226", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765634040, "uuid": "54c108ef-5778-490c-b805-c75fabdb1f41", "comment": "Malware payload (Adware.Generic)", "value": "538073d6951e80cee6cd2606ab90f6f5bb1a67cc16b2bacb0b712fd3ef010f42", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765634040, "uuid": "11397b5b-5cd5-44d3-8848-0044046f5821", "comment": "Malware payload (Adware.Generic)", "value": "4632df0d75ab4198a64ea7b80c77ab65604f2604", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765634040, "uuid": "d89cbe32-fe43-4336-9fc4-d536f8c19b7f", "comment": "Malware payload (Adware.Generic)", "value": "50318f37e1df29364a840327f5e4e78bbdb97daf592103eb240a3d0bf740de71b696b1ef55f894a2ac319a9a2e209778", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765634040, "uuid": "c45e2782-4d65-48a6-bab8-c7f19e2354a3", "value": "T11275BE3FB268663ED5AE0B3245739350997BBB61B91A8C1E47F0080DCF664701E3FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765634040, "uuid": "00fe378a-42cc-438e-96b2-d40e9415ae8c", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765634040, "uuid": "d9224a41-55fd-47b5-ba18-b27b60c03da2", "value": "24576:E7FUDowAyrTVE3U5FY7d+jT95p54u10mcmVGIc2LlSaAAPyGbDcRr+eZ9Fl0:EBuZrEUC+l5IupFcipPLD4j0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765634040, "uuid": "701f5ec2-b6e3-4380-9a56-b6c100eb2cb9", "value": 1610048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765634040, "uuid": "ecbe65d6-a992-4888-8db1-e313fff684fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765634040, "uuid": "df44c21e-05dd-457e-8c4b-f12f5edf6dd6", "value": "007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06cb0f54-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639129, "uuid": "854c79f2-c983-4b6d-8605-9e4e2ca877ff", "comment": "Malware payload (Mirai)", "value": "380fc9aa7e45dbc73dcddda670fe8443", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639129, "uuid": "2fb9b8f3-bf83-4482-9414-9b73045ecb60", "comment": "Malware payload (Mirai)", "value": "542e89bbf89a230ec6da19a41bb16cc858e5835e93ad152f2d56df0cf253fbf4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639129, "uuid": "f7d50adf-45aa-4037-bb9c-67548fd6fba2", "comment": "Malware payload (Mirai)", "value": "223b172f5f611eee1864e102ca0b854b9ce700e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639129, "uuid": "ec8f494a-d933-4fa7-9386-d86e64c29e71", "comment": "Malware payload (Mirai)", "value": "7dd75f453cb0deac6096a94296a3a924039a020bcbef0f254b967e3fba0d86a5b2d9b66a040f9c077985e88111cf9db4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639129, "uuid": "6f707bc2-4231-4f0d-8e10-2379bd8a1a8f", "value": "T1CAD33A2275791E2BC4E0A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639129, "uuid": "87f67559-58ed-4746-9474-a6e160b98c4d", "value": "3072:nZUlV+Fawd99IVWFjKc7RgyuOFe30Hi09lshKwnh:ZUH+FD99IVWFtWOgEmhPnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639129, "uuid": "14c045fc-acf2-4958-942a-7b6cc72e2d7a", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639129, "uuid": "b14a63db-f79f-42e1-adea-f93d534475ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639129, "uuid": "f7428bed-b36b-4047-9f02-4815c32130e1", "value": "frost.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c95141-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615509, "uuid": "46a3b28d-540f-4143-b5a1-0601957bd05b", "comment": "Malware payload (Rhadamanthys)", "value": "8212ff7c89c698f0ab4a841b015af62f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615509, "uuid": "f019c7a6-d623-44a0-8835-89b78e78b51f", "comment": "Malware payload (Rhadamanthys)", "value": "546bf50d98e740ca429b200c6993a1b6311d089d49f7b27f29db9339572ca3e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615509, "uuid": "f85fafe4-b15d-431a-9133-3036316438c1", "comment": "Malware payload (Rhadamanthys)", "value": "5301bd0ccfc2c511996fea5be67f0b470b137c86", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615509, "uuid": "67476a28-5f45-48f8-842b-8961e015df13", "comment": "Malware payload (Rhadamanthys)", "value": "389aa78b4d9db05c98cc4d682fe1a846cd546345774b294a09246744f96ffdeb4d00db1e2451f5617876fe2144cd8d9a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615509, "uuid": "952db417-8aaa-48f2-8b11-89e2d3e4e3ed", "value": "T179A32951AF21CCF138A23ABB1CA2B5E24C03915679125199F6CBF4756BCC22FE905F53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615509, "uuid": "fef1faff-b149-4105-bfd9-f9471707deed", "value": "1536:GDB7eKg20gJmuPyN5an4yDiSerFZWDC5lRUb9vlWkSzMLd1C5eCOrcT8KlDNrZH5:GDB7b0Bj3GkD0J6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615509, "uuid": "ad286a9d-f5cb-474d-a6a5-73033ba7e9d7", "value": 102781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615509, "uuid": "a1b24474-9f28-449c-8c72-9e2a870b13e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615509, "uuid": "1eed856b-3b14-47ba-adbb-f4bb2af448a0", "value": "invoice-1637482117.pdf (99).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cf152b-d877-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765666641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666641, "uuid": "a6ff95df-8dc8-44a0-9ba0-ef18ed967fa9", "comment": "Malware payload", "value": "aaf0f26390a830eef3b8691d2a8e8917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666641, "uuid": "3d0c29d1-31f3-478e-bf9d-1114d372c64c", "comment": "Malware payload", "value": "55161713f2e89d48c6291a7213047de671b58b591f0487dc6795fab40f739de5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666641, "uuid": "7795d363-849a-4216-bb76-5cc04a0fc1be", "comment": "Malware payload", "value": "0908f979655926ed925cad2497df7974d426a892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666641, "uuid": "6b065f7a-66a3-47ef-a747-735ebf120fb1", "comment": "Malware payload", "value": "006c62badb04850ca416e3be3069ea8f2c6dc2031e9336eae4fe4ec4d719056ad3f645f59b1b4852b8da5152092b08c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666641, "uuid": "8a723cfe-edae-4a7c-856d-dd714097f287", "value": "T172C65A41FA8B54F6EA031832415BB23F23305D049B28DBDBEB547B6EFC77681197A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666641, "uuid": "31f4eae9-56d1-4b2d-9e1d-c951ef8fadec", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666641, "uuid": "de725507-0036-4856-94f1-28c44399c5d8", "value": "49152:1LKwVg4+yViWdzWDeW0ZURmBkFAqtvpIqJKqR/eDtY6PcNkzoncCYfiR2D1VxAI9:VlVh+sz3r6nKwq1PhG9v/p3yQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666641, "uuid": "f164a856-26e2-4fc2-aa3e-a277fda2519e", "value": 11654656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666641, "uuid": "ddafbf8e-516c-4c68-bb72-774a506217a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666641, "uuid": "a49acbce-61e9-47de-95df-a9dfc8f40464", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55dec22e-d859-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765653865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653865, "uuid": "558498cf-c180-46a1-b9c7-4e3f38819a7f", "comment": "Malware payload (Mirai)", "value": "7f171033c4fe9f14c79265b6a1c1b6fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653865, "uuid": "ce6db704-9cdd-4768-9500-53b3314946ac", "comment": "Malware payload (Mirai)", "value": "551b7831273d21d6e1a9974eda6c0427efe4efa38c7730783c4e4083aacca8f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653865, "uuid": "579d8e15-8a5c-4909-bfd4-cc0e8df1642f", "comment": "Malware payload (Mirai)", "value": "060d23add3b43c1b27b534949b9bbce02f62d5ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653865, "uuid": "1d7b0f62-61a0-45bc-980e-a8fbe088f656", "comment": "Malware payload (Mirai)", "value": "a0cb11ad3a230685244f16e29c13a2da1c9ae9551d7776012b6942a3d0df1c034b52517b2e88113f33326980be6f8b44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653865, "uuid": "3b701f07-5ca1-44b4-8966-f604d97559fd", "value": "T129831A46B8918A13C6D466BFFA5E41CC332613A8D2EF7207DD159F153B8A82F0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653865, "uuid": "6fd4a330-95c2-4b37-b900-abf04fa85b01", "value": "1536:TMFZ+iSiHyupDtpydPFLk5XfOQcLT1uqMy7abDBvBnv8VRG:TMFZ+eylFSXfOQcLdxwhBnvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765653865, "uuid": "9f3eec5b-3f8e-4460-8bc5-73567a9c4263", "value": 83136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765653865, "uuid": "ba7265e9-c98a-4632-9340-2d888b6de6c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653865, "uuid": "6a20e1ef-9c00-49c8-bc99-d508c47de28e", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cf30c6-d7e4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765603726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603726, "uuid": "c7837e78-7630-4a08-8e66-1b09577c7cf0", "comment": "Malware payload", "value": "e89709baf505b2f014d62db2f0493277", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603726, "uuid": "c8949190-72f9-4ebe-8792-46d76b1110dc", "comment": "Malware payload", "value": "554cb7af5469c5d2154f0f7c74cf50c4af15cbb7c652a47c5d9b40cb03a3579c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603726, "uuid": "c97eba01-ab39-4533-8eca-d2e6d93d570e", "comment": "Malware payload", "value": "0af790c213a6e86b6eadd9ba42c4c404a79e803d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603726, "uuid": "173e0c6d-17bd-4aef-ad8e-53dacf2387f7", "comment": "Malware payload", "value": "7027cefd5781d46a3af93bc01ffd017d82fa050b6320f21c57da102d48fe6e89d69e9b1fae8649dec74cd42eb279a16d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603726, "uuid": "ec82252e-b443-4477-bfdf-55cef9a8c6fe", "value": "T1B793190AB9815B13C4D41776BE0F034933736758E3EB77029A246FB46F8AB5F0E66846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603726, "uuid": "419c4180-9fe8-4fc0-85f6-5fd11d35750a", "value": "1536:3NnXaZU0+kQMBSxqO0meMWyJYpGPXdlPaiNg2kdFykecKWLGMy2SXqM/UgNmC:cnBSxb01MWyJYpShg2kXck+MC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765603726, "uuid": "3d822ca5-240a-48c8-b128-2548dfee3e6e", "value": 88802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765603726, "uuid": "a6a020f2-ee11-400a-9ee8-73bd4e3ba8d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603726, "uuid": "ed2072cf-1b8a-48b1-bb7c-8e464c67296a", "value": "n8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069a293f-d87e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669623, "uuid": "217a3d4f-ca2b-4789-acbf-d2bddbab55bc", "comment": "Malware payload (Mirai)", "value": "be27e86ec2c59e5782875aecf6c4f281", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669623, "uuid": "49c44ae0-0e4b-481a-91ab-8bdaeb12bc63", "comment": "Malware payload (Mirai)", "value": "56a3e6a8affd0c3d62c786240919b639a94e3b5e9ccb2c7b5eb60c299807d01d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669623, "uuid": "4452df1a-df80-46eb-8455-071a61bcac5c", "comment": "Malware payload (Mirai)", "value": "860680ffd294b07aa662d4e33250472bec7053d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669623, "uuid": "6824a0b3-6d9a-4fb8-a251-01dde5ad90af", "comment": "Malware payload (Mirai)", "value": "b6626acc10870ca2cc1ab5e7a10184bd1e4b83d9a40edeb9a65347cd99f4e0f0c634ee59411382cbccf6469f5351d659", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669623, "uuid": "353a24ed-c1f9-45e5-abc2-e1d7b42781e5", "value": "T16D93F886B8818B62C5D552BEFA1E51CD331317B8E2DF7213DD106F257B8A86B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669623, "uuid": "eac2eb8f-c534-4b68-b92c-bd279f074869", "value": "1536:ApnLzxRoilfD0fkq4I4iftGCkzRDrCpCoy3qM4i+6sIFJBS678PYOnv8VR:wvoS0f9+2Gzz5CR6sIFJBS6wP9nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669623, "uuid": "d5bca364-297b-4e65-b4b0-9e32216384d5", "value": 89208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669623, "uuid": "c95a7bba-cccd-4d48-96bb-22d1e2d18f98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669623, "uuid": "00db63d9-0ac7-4384-ab6b-1011770e9ec2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4eb20b8-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765668171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668171, "uuid": "0998c742-7978-4cb0-9fec-9dfa8f39f424", "comment": "Malware payload", "value": "d2e3f9b581e720c488d57edca1bd3b38", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668171, "uuid": "7d38faaf-5c1f-4627-b813-7a218438df2b", "comment": "Malware payload", "value": "56d740ac4c6d4aec84083bf6d070f5c60b8ed427ec370d855a1387443ccee864", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668171, "uuid": "3bbd13c5-d083-4b8a-bc6f-10fd4648b4a7", "comment": "Malware payload", "value": "e9e8fb0b1e0a56ac2865c98a7e27601778af2f68", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668171, "uuid": "2e05ef9e-9cc0-4d24-95f4-eec3dc160cb3", "comment": "Malware payload", "value": "8f40a83dc37f76c17626fef88ed0b55c31e1c66af4c1838f3eabfd0cd38ff9f0e55da87875bdc2e217bf3029f4b503f4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668171, "uuid": "8e51e736-6844-46e2-b5b8-8dab3f1e1aa0", "value": "T153F01DA80303761A811EDD3AB1750BCAB032FB4F645BEF857CC0A0FAE0C45D07022D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668171, "uuid": "49af672e-87ca-44a7-ab42-cc68f6d9dd36", "value": "12:sh2AMHxnphoTwAe0YYnph/nAW1s3nph/4Acnph/6NIlAiYnph/SaqAWnN:enMpc1DYSoW1snlmiNIaiSKu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668171, "uuid": "3dee8f76-1f30-4636-a690-67177ce23072", "value": 642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668171, "uuid": "e75a61cb-72a0-467a-8c2a-d6c0bf0caa03", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668171, "uuid": "64cf500b-c570-4f0b-9090-d790546dcb19", "value": "zxc.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729a59c9-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615688, "uuid": "2aaa8c92-5c2f-4791-9565-c7c6e9afc097", "comment": "Malware payload (Rhadamanthys)", "value": "79032a880dffbc3e08add74427c32fbf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615688, "uuid": "81d5b9a9-e286-42a4-b610-77e742505477", "comment": "Malware payload (Rhadamanthys)", "value": "57359d2aa07d637a0b55eea2a8d1e177b78e1cefe134f42bff6ee10d0c54d289", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615688, "uuid": "05302983-1e82-4eae-9218-9f94c399aeeb", "comment": "Malware payload (Rhadamanthys)", "value": "82833159aa38a1408ae63a24d8701de7d03fd5ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615688, "uuid": "fa77d5bd-9e83-4061-ab41-4a2e7ddae101", "comment": "Malware payload (Rhadamanthys)", "value": "4c4042584810b58328d580a6244bae8774254a2480301be6d1d0f14b942d86290ca8562d72142c192b14719f383dc151", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615688, "uuid": "b2c6142e-09ea-4672-90eb-a9f0165bc6f8", "value": "T101A3084BBC69BDEC37F8E519053A20D95EAF0D17C436B4630226B2789D6486837F09D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615688, "uuid": "0e5f9db4-e661-4e3d-a46b-c7a13c258a77", "value": "3072:GDB7b0giFn166c7ZbGu7r2wIhk80RWj4ijPFbEYktS481S2f9DN73TW/SKWEZCcr:0EH4RRWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615688, "uuid": "dbe8af33-84a7-44a6-b9b7-32ad3577638f", "value": 100155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615688, "uuid": "9de3643e-9f9e-47a9-a9e8-bb1190033111", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615688, "uuid": "d1b91878-d533-4c7e-9273-e5c11b4b7fff", "value": "invoice-1637482117.pdf (62).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57573657-d7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765612206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612206, "uuid": "b8099216-24fc-4149-9566-8ea179d12333", "comment": "Malware payload", "value": "6ebdcf2495cd5199c289f7c34e8210cb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612206, "uuid": "bcba8814-68a3-4e50-bfc2-1ddc9343483f", "comment": "Malware payload", "value": "581ec8700ace0ae9013934b7d9c83b964f01eedf6e68191d0b619e94d0db9871", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612206, "uuid": "78560059-174b-4977-9fc3-7d5fe4a966ed", "comment": "Malware payload", "value": "055ac25507f2291a010bd1e2252e90d47389e976", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612206, "uuid": "c5f2c20d-c6ae-43cc-85a8-cf53939838cf", "comment": "Malware payload", "value": "c1f8809085df2a2fcd666d384482be7f82fa953a7c701f3811311ee65399002804fcd237ba70fcda4b79f262ec3113ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612206, "uuid": "8bbdc04b-77d8-4f6d-9f25-5c82d03a4167", "value": "T15F9116CEF5B233B30E98DE59F266866AB0C692C006115F6A27C970F578FFD449E41358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612206, "uuid": "aa5b2bb3-57b9-4214-b959-b8b73598b2d2", "value": "96:1xere2eaEemeace4eIAF+FVFGFgF2FrF0siTiaia4iqiagiUiIeZUaCka6WIaFhw:maFaj1g/IAF+FVFGFgF2FrF0siTiaiaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612206, "uuid": "6966b71b-dc6d-479f-b36b-184c9000c273", "value": 4415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612206, "uuid": "c95362f9-5bd5-4729-85ac-b337525b8d05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612206, "uuid": "0d1ec78b-0116-4b44-bc17-a3596b0227fa", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffa2981-d809-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765619629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619629, "uuid": "03a6fa83-26c1-4257-8884-dc2578045264", "comment": "Malware payload", "value": "7546ada1e3144371724db209ba4c5f37", "object_relation": "md5", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619629, "uuid": "5584edc8-ac56-4d01-b0e6-6fee375730a4", "comment": "Malware payload", "value": "582eeb086e1e50f036a243e1ceb8837803c64ce4aa7208b3946c4b68b35fab10", "object_relation": "sha256", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619629, "uuid": "89cfe9de-23cb-49d2-925f-d58e30823998", "comment": "Malware payload", "value": "36c29d4238061ddfdd41735b4590c2239f019679", "object_relation": "sha1", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619629, "uuid": "ce1983a7-2fb3-4fcf-b83a-1f8eee22ddfb", "comment": "Malware payload", "value": "11cd2e0164aa55203578170b989dbf31cd0b5de2f6babaaa91be10d5e67ca15b4c8a130a1ad65a006e2ab3dd0e09d6ff", "object_relation": "sha3-384", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619629, "uuid": "2c91691f-9859-4a4f-a1be-e4844bf2e4e0", "value": "T1B5A4789C765072DFC85BC972DEA81C78EA60747B931B9203A42716ED9E0D997CF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619629, "uuid": "7af9e9f6-41f5-483d-b412-d7eb571c73d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619629, "uuid": "24605903-7292-4da7-bd70-5e343fe4b79c", "value": "12288:zcI2b3FMYrF3P0d54c86yJHsiYA+V6GhMsU4DOQ3gHc9mrcMorWrnhkdZBdwMsr6:zJ2b3FMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765619629, "uuid": "9f55da35-f2eb-4bff-8f28-12bb1cfb2832", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765619629, "uuid": "e1381de2-f4ab-4fbe-baea-bf768aa70a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619629, "uuid": "573b1a02-27da-44ac-935e-d2bcfead7d3d", "value": "582eeb086e1e50f036a243e1ceb8837803c64ce4aa7208b3946c4b68b35fab10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efef492-d7dc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765600247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765600247, "uuid": "9d9ad4d4-b817-4923-bbb6-282da13634e2", "comment": "Malware payload (Mirai)", "value": "c52e54e4a002ca9da8976fb9875202a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765600247, "uuid": "5154b31a-3395-4f98-95b2-5aa321b84655", "comment": "Malware payload (Mirai)", "value": "5905bf9630a3dab9a6b78e8d32d03ffdc99ff851624532e5fb0df900bc6038fc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765600247, "uuid": "d62b7670-0f7a-4e59-963a-276aba580994", "comment": "Malware payload (Mirai)", "value": "33c01de12cacc1de96fd731e2c9eafeea6bacd76", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765600247, "uuid": "e8fcddc6-85c5-4804-bfbf-c5011023f26a", "comment": "Malware payload (Mirai)", "value": "5c703f2764b23729713bd51450eeadcba00c71cfa028958bb2d61c9bcf3e70fd8698abcde7fca5c958d21d7c4e11fade", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765600247, "uuid": "771736e0-e72f-4240-97d6-dabfcb002f87", "value": "T130515A9433810038ADFA9D2F73E9081472A6D0577DC49F24DDFC64E944AEE8C7E88A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765600247, "uuid": "8b1c80d1-ea36-4997-ba93-c8a09c609f52", "value": "48:v+EQ9bUHFahFYFLhcvY3+Xo+coPWH2QNOfO+mYmw:v+EQ9b+G8NcvY3io+coPWWQNOfO+mYmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765600247, "uuid": "f2dc902f-7998-49ac-978a-c95460bf21cf", "value": 2655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765600247, "uuid": "de327c27-f21b-4d15-8709-823dbeb3dc67", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765600247, "uuid": "e78492fc-6cea-4c5b-8420-3e568afade5c", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf242d6-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615841, "uuid": "6706a798-e006-4d04-a8f6-536944f6f7e1", "comment": "Malware payload (Rhadamanthys)", "value": "0ceeb74ba30ac53c84a2a7a519e13d82", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615841, "uuid": "0d2548da-9763-43f7-a84d-2cb3c0ed82f8", "comment": "Malware payload (Rhadamanthys)", "value": "59335898c66d87063a18e36d143d24c1ca0fb055d14b866db4783b8929edb7a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615841, "uuid": "a190b691-f512-4879-9d69-cc347724a33e", "comment": "Malware payload (Rhadamanthys)", "value": "b564285c3da9fc5f048c3873c33d402dad156ab0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615841, "uuid": "341522c0-fca9-4098-85cc-b68ecab84281", "comment": "Malware payload (Rhadamanthys)", "value": "13e52fa088b598a8601fde4c51eb6fc2df92fdc52fe6beafca93b00332dc45f45fb71aa8173866d3cb0c951c2fede800", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615841, "uuid": "7f5d449f-0afa-4903-a6d3-29bc0b5774d0", "value": "T1CAA308473823FCB54A17C2A67E4B98A8396D168E9A501FD0BA1E7FB1D0F9D1390150FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615841, "uuid": "7f3353b7-9a8c-4f58-9a90-65094acff7d6", "value": "1536:GDB7eKg20ch9HM7h1TEAzhwJzwSyM5GtZ4X+K9rzx1ydZdyqiRBi2mHWHzVaqdTy:GDB7b0unxMsK46BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615841, "uuid": "d0ba960b-d928-44a5-b2a6-04b1243750a3", "value": 100115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615841, "uuid": "16c0cd4f-1f14-4b88-8bf2-4290309fd414", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615841, "uuid": "ea2ce392-61ac-4353-8ebd-c784ed3b2996", "value": "invoice-1637482117.pdf (27).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057630cd-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639127, "uuid": "5ba78da6-15b1-4dff-a7a0-d74e71eff204", "comment": "Malware payload (Mirai)", "value": "03e2bf98508f6dcc818d01ed871a9838", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639127, "uuid": "cd0d2c7e-4e07-484f-90ef-03183efdd260", "comment": "Malware payload (Mirai)", "value": "595e0305cea1167eee8592ec19842e1cbfa8716663ad8c7874809f98b07d8886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639127, "uuid": "0a972536-0982-4204-87fb-da8dc011245a", "comment": "Malware payload (Mirai)", "value": "69efd05166403132dd02f737b192806aadffa1a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639127, "uuid": "b36e9fbe-282d-4da5-b1d6-fe4c966e0d8b", "comment": "Malware payload (Mirai)", "value": "77a6f152deb376b7000083a001b3415f29c59633820fd4d904d1c39c45e55feae64e2025563f6f9522eee45b920d272c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639127, "uuid": "9ef697eb-f4a6-48b1-b475-e96566ae50aa", "value": "T100D35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639127, "uuid": "052f9d28-69db-4b8e-ae9e-544903a4cb52", "value": "3072:oWGIf1/UwfhJdU80rWtbYUaDGMsMA9TK5t:oWxN/UUDGCbYUaiMsMApK5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639127, "uuid": "eed0c6af-9d70-4f35-8da6-162c7dd4ff6f", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639127, "uuid": "aea85b9f-665c-4f3c-8bf2-158467a92b60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639127, "uuid": "17281c6e-c1b8-410e-895f-bbc760bcf7ff", "value": "frost.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3072861e-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615577, "uuid": "1e0ebab8-16a9-4160-9d7c-c66ad159470e", "comment": "Malware payload (Rhadamanthys)", "value": "b520af746e332ba4bbeee1a2aa1d8632", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615577, "uuid": "964d8003-d49b-4229-8550-3afac468c11e", "comment": "Malware payload (Rhadamanthys)", "value": "59929d5128482aff46369e743f6c1c750c7b680f84c0710b485a8c9d0490390e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615577, "uuid": "863a5bc8-e887-44d5-897f-c7f77e6a360d", "comment": "Malware payload (Rhadamanthys)", "value": "ded11789540b39c10937f9bcb4b0e58821bdf235", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615577, "uuid": "d1d20580-58f0-43e5-a9a3-bbbbda867251", "comment": "Malware payload (Rhadamanthys)", "value": "eb0b5b25f4652285eede47b699ed165ae4686e88fbb93feada2d4e15b4028ca94e19ea90b48616f4be476f9fc508cfe3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615577, "uuid": "2967ef79-28d8-4e24-8db8-9e5ef4a3ff02", "value": "T15F93F9811C4BFDAE8185FA900C7B5CD9D80ABC80ABA118D5EFD5B7112633E576DF12E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615577, "uuid": "2069f8eb-8f80-45d7-845a-23fc19be511e", "value": "768:GDhd0i7J4sYKgY/CMNfWdkTwyLrXK+rSI7Jn5Hur52pnAz0LNVaRvSLAuAAroQWK:GDB7eKg20KrrrSINE8A8El6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615577, "uuid": "9a7a9611-28d8-4edd-9c3f-ced434e63ca7", "value": 96259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615577, "uuid": "7ef6b6b3-ddaa-432d-b946-aa1eac9cc642", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615577, "uuid": "18795925-8186-4666-a84d-ff6f252af7da", "value": "invoice-1637482117.pdf (85).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bd6e12-d7ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607529, "uuid": "c5c4dace-4a6f-49a8-9afe-9bb6fccfa812", "comment": "Malware payload", "value": "060cdaa1ad654547b4ed7e7cfc0545ee", "object_relation": "md5", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607529, "uuid": "37ad3878-27ab-4b36-9fae-510778943fab", "comment": "Malware payload", "value": "59edcce8dcfcc0bd41041bf06a39d7ba1a13c5d8b8f46660b83625317dca6c81", "object_relation": "sha256", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607529, "uuid": "bca355af-c0d6-4bee-87a6-650325b1237d", "comment": "Malware payload", "value": "679a9a670e84ed64acf1361e94f61853133849b2", "object_relation": "sha1", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607529, "uuid": "922c45b5-32e8-45bb-80d5-9d5a86f3352c", "comment": "Malware payload", "value": "73d324fe2a5e1eda511fa1723ad8f214f0f91027f6cd84482443c25f5ab4ff2345af85e6016d0fd83d29620a5543eb9a", "object_relation": "sha3-384", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607529, "uuid": "bd25034f-f3a0-4083-a09f-f48b72d218df", "value": "T1F37155E27EB2BDB03F0D8138B6AF52823C42166F451ABE15318E6E595F7C20C65F8435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607529, "uuid": "e3642a57-7342-433e-9789-9eb87a5548e0", "value": "48:+ZH4257Nlz1ThREwFj/m4Su6NR6tVTXrtsMGVulwkOvYEq7IA+Fz4Rw6zW/VqJJn:+/5rBBuTdP6tVTXrts3qw/MT+FMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607529, "uuid": "5c3fcd5e-71ee-4ad1-a3b0-64a371cbe353", "value": 3742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607529, "uuid": "547b8551-90e4-4bdc-94f8-523ac6f5cab9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607529, "uuid": "399f2378-c52e-4fe9-9085-92814cd85790", "value": "59edcce8dcfcc0bd41041bf06a39d7ba1a13c5d8b8f46660b83625317dca6c81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453913b7-d7f2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765609599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609599, "uuid": "e68b92bf-320c-49da-9d4f-699f29353bf9", "comment": "Malware payload", "value": "c8df1da6dbb6c281ed0108c2ffcedd2f", "object_relation": "md5", "Tag": [ { "name": "185-196-9-212", "colour": "#0A1F41", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "hotelsep-blogspot-com", "colour": "#E59F69", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "puddi", "colour": "#DA4A00", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609599, "uuid": "bf9627db-799c-40d7-865c-bcc541b0c1e0", "comment": "Malware payload", "value": "5a93c8a8f64fbadf0b2df95f625748b060d18047523389ad61bc1d2213bc2b9a", "object_relation": "sha256", "Tag": [ { "name": "185-196-9-212", "colour": "#0A1F41", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "hotelsep-blogspot-com", "colour": "#E59F69", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "puddi", "colour": "#DA4A00", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609599, "uuid": "cfddf0c2-69ae-4088-b599-58fded41b9ae", "comment": "Malware payload", "value": "19c2b8988611bac757d4632baa693b226ef0117f", "object_relation": "sha1", "Tag": [ { "name": "185-196-9-212", "colour": "#0A1F41", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "hotelsep-blogspot-com", "colour": "#E59F69", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "puddi", "colour": "#DA4A00", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609599, "uuid": "f27f99a7-f24d-4cae-860d-cc4c929631f0", "comment": "Malware payload", "value": "94c4e8e65f36fce03fb345a148c8d0713071bff5260e04cde463ac83b1877bb9d57adc50df04e6ec2f6f0051365924a6", "object_relation": "sha3-384", "Tag": [ { "name": "185-196-9-212", "colour": "#0A1F41", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "hotelsep-blogspot-com", "colour": "#E59F69", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "puddi", "colour": "#DA4A00", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609599, "uuid": "2dd79bb2-5dcb-4e67-8804-5c7299f0c5e2", "value": "T150B5AA45ECE8DC629A986BEC374144377517FA4DF0EA3087F76318D60AAD8D016ADBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609599, "uuid": "59f8a10b-4a33-465b-a219-9dbfb1c466c4", "value": "12288:rW4f7wxgW4f7wxgW4f7wxgW4f7wxgW4f7wx+MeDndgMyR:rbXbXbXbXbJMeDndgtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765609599, "uuid": "6097699f-60f7-4567-8739-ce6c625a2411", "value": 2285007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765609599, "uuid": "463e9b84-4208-41d6-9a2d-82734e202579", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609599, "uuid": "683e0f1f-f87b-493b-ae36-0b1113f78f04", "value": "payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d01941e-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615678, "uuid": "d44f9dce-a57a-41ba-9208-468f68df1ced", "comment": "Malware payload (Rhadamanthys)", "value": "b23c257f0b6d17c4ad165f80988c7bea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615678, "uuid": "5dd3402c-cee4-43c6-9e33-40b9de5b5dd1", "comment": "Malware payload (Rhadamanthys)", "value": "5ae0d314440f3f38c42bf0948bc5d2c37a6590d8d33883816d7caed4b4db4082", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615678, "uuid": "0054dbf3-7a35-44ed-8704-8c7aa72417b5", "comment": "Malware payload (Rhadamanthys)", "value": "d13a8467c4f4d170d082571de9f8ac970bd48362", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615678, "uuid": "9300cf3b-aa1d-4cf6-a0ce-c7992c0c1204", "comment": "Malware payload (Rhadamanthys)", "value": "c6f61a1731f5d13ae7b458bd265904a328394d38193d5cc17dc3027b28e9a3219c41e68264b2c5a974e06ce01f2aa25d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615678, "uuid": "35bf610a-c335-48c6-9202-839414bf370d", "value": "T1BDA30C88AA6670FB5D2E33DA7A6534B5D3A753268BF8023156067B3E40D4F07291E7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615678, "uuid": "01856d5b-ffcf-4b63-ba69-4152e7ea62a0", "value": "768:GDhd0i7J4sYKgY/CMNfWdOl0lxlDl7lkl4lmlPlJlflklDl0lLlblRlslHlJlilB:GDB7eKg20zrvrmC7UEA68g6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615678, "uuid": "86e380ff-31d3-4e3a-87b2-6907c866b46c", "value": 99446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615678, "uuid": "a3822ba3-a97c-43bd-953a-e7f20b288046", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615678, "uuid": "ff4d54ce-3ed6-428c-aa15-300755fcbda7", "value": "invoice-1637482117.pdf (60).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d9afc9-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613162, "uuid": "e455c97b-8010-4ace-8d17-ee32fd37935e", "comment": "Malware payload (Mirai)", "value": "8ef10f5dec0ae1ac2cb3544f190ed625", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613162, "uuid": "93f3dd80-07af-46b6-82e3-94293886a380", "comment": "Malware payload (Mirai)", "value": "5ae320b3fc50c68abd22e3578ec8b2e43b482e6bac951973367ab60ce54fdbce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613162, "uuid": "f005e789-4b51-4f20-bc06-a32f5c56f1e1", "comment": "Malware payload (Mirai)", "value": "2d04a6d1cbd1160489f1ecaca994c31a5d461453", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613162, "uuid": "3c0e5beb-f1c9-45f6-8833-38775a7a7645", "comment": "Malware payload (Mirai)", "value": "2feca700f5bc3e3e1b0c4d406918cd0550102d6665351fb6e77b07766f2a7208c9cfa0c51dd533040f051f3c43bfd2aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613162, "uuid": "4c0ed27c-a6bf-49eb-a78e-02655856e552", "value": "T1D3432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613162, "uuid": "3ee2f876-5819-451d-a275-c7b850510807", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwQ:RqtmZPuutfbltZFBSJsBcfDSTFI+BEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613162, "uuid": "6aac038e-d4b7-45db-b8af-220c1d9d313d", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613162, "uuid": "c187d577-f76e-43fa-bc37-d2b4ef5486d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613162, "uuid": "fd9681f5-e4f2-4bcc-9355-eb09dba0600a", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45fc5e2-d856-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765652842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652842, "uuid": "11d6a75f-30e9-4505-8306-f3375da1ae18", "comment": "Malware payload", "value": "05715209f5b909dfa9dd573932170b68", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652842, "uuid": "ff96056d-382b-4fde-b1df-51d0f9986291", "comment": "Malware payload", "value": "5b29bbc8792f90df6030bfc594c99e36b26ce4fcf4eec76bd9a2fd7a933f9977", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652842, "uuid": "8fd1563a-124e-40d0-a352-9b584d5999a3", "comment": "Malware payload", "value": "b8700ec4995ee4b0fb9b55554eb99236b3cd63db", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652842, "uuid": "99a01fef-8492-4f37-9777-433618dacfb6", "comment": "Malware payload", "value": "19f59c4cca2b86addf6babd20ec1b1d960ab5e5c3d0718d18b0774017b2ac28203067e14f179164fe2ae719261e2e885", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652842, "uuid": "68660ed5-4c5d-4f46-a3d4-230cb7133940", "value": "T138D6121846E054FED59C9A33287595F722B69DDE921B9CB8DEFC226E3DCD2340CBA101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652842, "uuid": "4f1911ae-b36e-42a3-a823-f208f780fe70", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652842, "uuid": "0caf0585-1041-4ab0-97b8-3783467c19d6", "value": "196608:IahW4gTSJIeRo+jFgaIAjNyMzEltbW897GGr1LDsBTG9WdSWQta/R6j:BWSuSfdjcMo1N3sB1sWQ4Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765652842, "uuid": "3716ed02-b7f3-441f-90c0-3d89d6ec46db", "value": 13256696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765652842, "uuid": "9e57649d-6b76-4e3c-a3d7-299abcd40c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652842, "uuid": "2298ba74-3428-46ba-a3c7-59a7ca6ccd4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c01594fe-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615818, "uuid": "8effd022-bfb7-4d69-b462-a9a8ce3b07a2", "comment": "Malware payload (Rhadamanthys)", "value": "4aac219224358b58bf23307218eb0ff5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615818, "uuid": "83004b8d-61ff-42a0-9dec-b9a328167f31", "comment": "Malware payload (Rhadamanthys)", "value": "5b3f550334c586d9673d63a3e0e6380e216cf1bd259bae5f2def9b0c5f38db43", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615818, "uuid": "86fbb8ef-5a14-4343-baa8-773a558bc757", "comment": "Malware payload (Rhadamanthys)", "value": "7e7dc8086be54c62d91d8df0baa255fbce880bbb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615818, "uuid": "e5d100bd-39e5-4c9b-955a-da3980c671fe", "comment": "Malware payload (Rhadamanthys)", "value": "a8ca3a5ff56214f6949e7b0d8f9e9202ba65fb83fd5895727ebd4e1b3db3800657392f6fc64939556d1175b9f15a687a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615818, "uuid": "db72f529-b53b-4c05-a7a6-6e0264394b5b", "value": "T17FA31A09EC728C624A23D9E479B40097343AD5974D8ABB4678EE7B01D356B362C6FDC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615818, "uuid": "4ff88c3b-5535-4dac-8828-0eaf1c13f436", "value": "768:GDhd0i7J4sYKgY/CMNfWdkuDCwCInOrCLUeBt6t/7DPEppEYpMv9CI53YnAIl3YT:GDB7eKg20arzrUGsFzAX+H6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615818, "uuid": "7ff3cf6e-e475-4776-bc2e-798a0cf3f32a", "value": 103298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615818, "uuid": "857550f1-6f07-4d5c-aeaf-ee1689154f21", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615818, "uuid": "8732acc9-c5c5-4813-85e9-7248f7e6b08a", "value": "invoice-1637482117.pdf (30).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da89f59-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615733, "uuid": "2cd5ef9b-2e81-41ef-9ae8-75b44ecc3437", "comment": "Malware payload (Rhadamanthys)", "value": "6461b95aeead42bae3a74f298f8e4a7b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615733, "uuid": "43340b57-75a2-4d50-858e-c30093565dd7", "comment": "Malware payload (Rhadamanthys)", "value": "5b78d3be45db9595939e0b1eb2250470302c180934000cabc70e628475e44814", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615733, "uuid": "6c058ed6-af8c-4720-ab7d-ce91190e4d92", "comment": "Malware payload (Rhadamanthys)", "value": "97cfaacc29f25e02882051b4d7cb39b540df77bc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615733, "uuid": "616593b1-85b9-42bb-8726-d3d763c7221a", "comment": "Malware payload (Rhadamanthys)", "value": "6792fdfee4e332349d1f6cf4aad4b402667d42326169c7483181b5f8ffce5b18241658dc431b54f02772f1b288af5c8a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615733, "uuid": "daaf754a-20ce-455b-8bda-f5ee7d51e87d", "value": "T1A0A31AC37E778FE4F01436A058A095F2ED2D774D5B4605EDB502FF96A02DE3A26A04CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615733, "uuid": "68f64901-e76a-464d-875c-3be341bd6e6b", "value": "1536:GDB7eKg20e0Trjrzry1nK0dh6AqcNq0B6BkQWJ+aY:GDB7b0e0vfPydK0dhEcNq0B6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615733, "uuid": "3b0f248b-966d-48ee-a9d5-8d56fae8ed81", "value": 103434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615733, "uuid": "66b2d989-ffb3-4656-aa09-5144bc24daa3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615733, "uuid": "b5706c39-e20c-4a21-a131-680efa9f2372", "value": "invoice-1637482117.pdf (49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a848e1-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650261, "uuid": "b1ce45fa-62cc-4c7c-bf73-23061c50b586", "comment": "Malware payload (Mirai)", "value": "104cc51215001bd54b1501040fb275e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650261, "uuid": "558d51c4-bd11-4bac-a5e4-47dbe00c408f", "comment": "Malware payload (Mirai)", "value": "5be62444355fc553649a1f54d8606b7fd004152d25b370a97b0884ca8b900be4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650261, "uuid": "2e99eb01-9a65-4f5e-87b7-19c22c4e2a8c", "comment": "Malware payload (Mirai)", "value": "5dc21e4663328cae90b0af989be96a105acad29c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650261, "uuid": "9708c274-b5ee-4ce2-b525-c6853219d72a", "comment": "Malware payload (Mirai)", "value": "fc16f024dd5c2a3cd60ac39c2fe4b403a30757ec52bc136c7d30e97ff93c3f3475071a8ff02f7172adb7fcc45e7b34ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650261, "uuid": "504565f7-df73-4fc1-ae0f-05af61c92475", "value": "T161E44A82FB1C4563C9570DF0293F43D5F7217A9240B9C229330E6B572632E76AAC779A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650261, "uuid": "08476d37-7c86-44e7-99ac-05da74be7cad", "value": "12288:40R6TT8Er5ZUAKTH/XtJJEHafJYYJrL6N6ZT2RwFzepxhPrmfNe:ewEr5ZU5JJuaWh6ZCRbhTmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650261, "uuid": "efd47bf5-ce05-4489-8af4-9c2444e9be81", "value": 661192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650261, "uuid": "9eefc784-5d63-4ded-aada-7a80986ed8f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650261, "uuid": "68deed78-dabd-4273-a871-11c5dc2e4a94", "value": "shadow.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5220688b-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668032, "uuid": "b1608df0-69bf-4b9b-9aa1-191992aeee2d", "comment": "Malware payload (Mirai)", "value": "e0f5558b3d44ba5312f8e3b2aaa8c07b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668032, "uuid": "79131999-f1ca-4700-af39-68533cdeac0e", "comment": "Malware payload (Mirai)", "value": "5cc34e9a165c91784c87c01b527fb6f7ac9e3e982f543d44bcb4f972edbbbe87", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668032, "uuid": "6d200a45-0921-41c6-98f6-09c4a01c627c", "comment": "Malware payload (Mirai)", "value": "095996d939b8c050c0d4103704b42893d1b1f788", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668032, "uuid": "5d1554d6-7196-412e-8069-8bb424a1f009", "comment": "Malware payload (Mirai)", "value": "33637018e3ab8f475da6fe0e1968219dad0a0d832a8b0204e5c692c368e4dcfe6811564baf8937edba0f5bc05718c289", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668032, "uuid": "060c204f-6749-4888-9615-563db7dc8fe0", "value": "T155735BC5F643D4F4F8570471207BEB375A32F1B5112ADA93D7A8DA32EC63601AA067AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668032, "uuid": "e3ca68e5-00a0-46fe-aaa1-5af6e3776861", "value": "1536:dhkjqmGBQznuQAz9urPqRi3IPJSzEHpi9gvZTd3341/LWmqCvhh56czYSDk:DkjqmGBQzuQAzMrCRHXtd334FqmB5zNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668032, "uuid": "a7597979-e9a0-455f-a2e7-63f967c96415", "value": 79312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668032, "uuid": "20c8de5c-40a6-4c31-95aa-6f97ae77085a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668032, "uuid": "ff11dd21-b1f1-4dfc-9d36-3d99da2d4363", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f80340-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615529, "uuid": "4c4b5380-8425-4fa4-86a0-97c5c49b9476", "comment": "Malware payload (Rhadamanthys)", "value": "4af0299044197f21eabdcc946a32c736", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615529, "uuid": "04e2e9ef-1ea7-4033-86d3-fbc09d051ea5", "comment": "Malware payload (Rhadamanthys)", "value": "5d26c74c808d39201faa95bc10100843df0d0931ff5c5b0b4de28f9277ac2d36", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615529, "uuid": "5f3eb46b-27d1-4d57-b3f0-7b5316ff45a9", "comment": "Malware payload (Rhadamanthys)", "value": "9bdb03e2e456674e46976018bfd3d4901fa13681", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615529, "uuid": "501c9c49-6214-4266-abc1-4dd08926fba0", "comment": "Malware payload (Rhadamanthys)", "value": "283896842660ec36e29d52ca93528734a60aea5e7156333ee652f99a90d20f259aed7462671c631d49f53e291be10f3b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615529, "uuid": "8b5936dc-8b70-4d53-8eca-08f25d3b2f78", "value": "T1C4A31BCDBD952FA5028F917E079F22F29C7B35109B0A8091D166E242332C7CFE9565EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615529, "uuid": "4c6bb20f-b0f7-4f77-8874-c5126dc5a85f", "value": "768:GDhd0i7J4sYKgY/CMNfWdsDZsYN85aef3CvESuJ3yGXZOxt1jFMHbu6FFI2Fxa5l:GDB7eKg20orrr+Q/+CAakZ6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615529, "uuid": "35a322f1-f047-4651-b745-2eb7d9d8b20c", "value": 102745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615529, "uuid": "56faeade-c418-43e4-99be-a3380361dcb5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615529, "uuid": "3cc35c51-69d7-4691-8b38-d9e582a6dbdc", "value": "invoice-1637482117.pdf (97).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f438812-d7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765612193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612193, "uuid": "6a497c6c-7687-4e4c-ad67-834830b56be7", "comment": "Malware payload", "value": "429f1bb81e56f6bea92830ce10fc382d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612193, "uuid": "5b753b39-4f18-4120-92c0-b518a489e49c", "comment": "Malware payload", "value": "5d7957f2b584fb79725e558f8ebb25f9c8111c2332ab5fe1a93d9dbc62515461", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612193, "uuid": "499ce4da-b8d3-49ab-8360-3158ff2fbfab", "comment": "Malware payload", "value": "597fe899a785e58864f86b0f20c65b174506a76c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612193, "uuid": "b81e1b4f-c49e-4763-bb3a-ba64b6619d21", "comment": "Malware payload", "value": "257f1e1df887caf7dd623c1ded4d0d56ed161804a6c717dd1db456027d0e8beac6e927ab869c5f30080d459ea9497a0b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612193, "uuid": "6aa341c3-3b36-4117-bc0f-9679bc794a79", "value": "T1229138CEF5B177330E9ADE1AF216872AF04280D502224F6866C970F8F8FBD4A9D41706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612193, "uuid": "e44ec4a8-d445-4cc5-8a35-1ac9a2f75397", "value": "96:1xeoNeBeaDeBe9ceHeIHFUIFNIFRFjFBFoF0hioFihiabihi9giniIvoLvaRv960:mT4aC4l+IHFZFCFRFjFBFoF0hiIihiaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612193, "uuid": "c05e7b82-5bcd-4b30-be66-ca5b9a00aac7", "value": 4512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612193, "uuid": "3dfc00f0-442f-4775-9158-c6d8ca856778", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612193, "uuid": "33e4b389-22ea-4935-bdb3-e715ac97effb", "value": "tp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed215911-d87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668721, "uuid": "370b8b03-136e-486f-8941-e22eca8509ed", "comment": "Malware payload (Mirai)", "value": "1cc6c821fc1e1b8aca1167e60deb7fae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668721, "uuid": "574c03fb-4f86-4e0e-8d04-ee3aea6d8a08", "comment": "Malware payload (Mirai)", "value": "5d9c6a814622a0d1336dd4d05c9fcbc4b366799bb83bf2c5e9c0a5a98f9e721f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668721, "uuid": "27134f5a-ef64-4a32-a9de-ae55656e859b", "comment": "Malware payload (Mirai)", "value": "b80524584e5b8d62782089112086f5c71ade159c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668721, "uuid": "cf9b4148-7ebf-4d76-96bc-362c19455b5a", "comment": "Malware payload (Mirai)", "value": "9f282870dfe07b7f7f86c94d5e6ff417a6df6760ac87642a85464d91e80470021a2ac3ab51ef29b7aa8f77d6a60d863c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668721, "uuid": "8ef770d1-e707-4d23-864a-e078da6ee4d5", "value": "T14F2319C4D503EAF4EC1919702973F3325B73F57A112DE987E7A49B32B892704A60A2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668721, "uuid": "84f81afd-a280-4458-8e92-6a8ccaefe261", "value": "768:OaoA3whCogK6ba1TfxVOLQHTWgEcXzV4Nnv6BTn6QcOH/SsT8ARovC:poA3whlgBba1Ti0CgrXzV4Nyt9c4/Tr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668721, "uuid": "356d7c67-8017-4f05-a6e2-e07b6a2cfd10", "value": 46228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668721, "uuid": "8e4eb9e4-121a-4e3d-b595-d057e6eee7c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668721, "uuid": "c32bf4c6-5bfa-4f7b-838f-0bb23fc26bb5", "value": "zerx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93136dd0-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615742, "uuid": "927ce78a-4d70-489a-9104-1356c46bd478", "comment": "Malware payload (Rhadamanthys)", "value": "a98723de4d06cb143154a5df54280eac", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615742, "uuid": "b2553e7c-4de6-4b09-ae69-60ca4904d24a", "comment": "Malware payload (Rhadamanthys)", "value": "5dd5fd9e3ecfbc65fa09835236e4ec17d843337363e403f2ed76c0a7d70176bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615742, "uuid": "24893673-4239-4974-b6c4-7e382be509f0", "comment": "Malware payload (Rhadamanthys)", "value": "df12bb73fbcf155a9cfc62ef994b66ceae82da6a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615742, "uuid": "96d36593-d70d-469b-af64-025cb3a035c4", "comment": "Malware payload (Rhadamanthys)", "value": "1942fa08bea384935ecff1022c5f56444eae4c23af2a6fac6bc62077eedbfab0261bc123926d2932f86def642e7554d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615742, "uuid": "42007851-b61f-4dd6-994d-6bcebf24de2c", "value": "T1B0A3E9452639EC74199BA38EE5C309EF160CE6C1630102D6DB8FFB98D75C65B2E02AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615742, "uuid": "b07bc30e-a76a-4ad7-9e92-6d67eb63d355", "value": "1536:GDB7eKg203O3O9r/rBRIOUEO2+OGOYO9AQOFOuO3UF6BkQWJ+aY:GDB7b0tTntpUF6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615742, "uuid": "84cd7862-620e-499e-b644-48907aac9158", "value": 98194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615742, "uuid": "582151aa-8d9a-4fa7-acaf-d9ccac1183e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615742, "uuid": "c98856ee-8e0b-423a-948b-edd451f662ea", "value": "invoice-1637482117.pdf (51).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac117c2-d7e2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765602763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602763, "uuid": "853c72d9-0320-4cfb-9fec-1212aee5c2be", "comment": "Malware payload (Mirai)", "value": "48876e09bfd1fa4b76650312bd10d7be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602763, "uuid": "4afdf47b-6eee-4901-9de9-1fc4780dac24", "comment": "Malware payload (Mirai)", "value": "5e09b0e9335626b4d53148959ce78a8f82db51080f7662fe9f3e97557dac6889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602763, "uuid": "066f0c5f-dab6-4ac0-993f-67c36c13e5e7", "comment": "Malware payload (Mirai)", "value": "709d8cfbcc3cc3a45e939e635a1ccfc9eaf64923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602763, "uuid": "5da85bd5-f5a2-49dc-9cc7-96e716213cb6", "comment": "Malware payload (Mirai)", "value": "3ccad7038698c7df263293e4e631add6e06962409b7f23ec2edc2c4a22386e04077ac875bfdd12df5f2de0e322d590eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602763, "uuid": "3f0d905a-78b2-4952-adb2-abc312956f06", "value": "T1F0F33991B8829A27CAE622BBF62D428D331663E4D3DE7117DD214F2137C681F0D77A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602763, "uuid": "a74007e5-dedb-4f8d-b073-83ce83479641", "value": "3072:482L7PVWnphhDvsTqfWBJVItrgu4PwmM8SvEKx4pftu6NU2D8:4F8nph10TqfWBJVErWwxVEKxwNU24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765602763, "uuid": "99cb16af-e2c0-40ae-891d-a507d4d5ae3d", "value": 161240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765602763, "uuid": "f6ad0f6f-d408-447a-b484-9e21f9473dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602763, "uuid": "bdd21354-c0db-486f-983a-e414bdbaee7a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ed1a95-d86d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765662554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662554, "uuid": "a8503983-0e67-4808-aaa7-86fd721dce92", "comment": "Malware payload (Mirai)", "value": "098f82aece77ec298da3112f32f24416", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662554, "uuid": "aead794e-85c8-484c-bbe9-7f2e3685cd11", "comment": "Malware payload (Mirai)", "value": "5ee2671d4f96dbb3fe30bbd959d9f800cac1044467a31198449346acc4e356fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662554, "uuid": "d386ff01-c8a1-49b6-be28-7e319db24d67", "comment": "Malware payload (Mirai)", "value": "fbce775c939599c2b27e90e332ff1cd6814b133f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662554, "uuid": "b8f53e34-cff3-4637-bbeb-b69859aedfdb", "comment": "Malware payload (Mirai)", "value": "d138a666d0f6f34d1cbeda8ddaa011563bf3ccbd50fe6f54493033a520a9e50f50e553a1da1b884593517d62bd2fc840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662554, "uuid": "ed062d7e-bda3-4f3f-b350-cf802a51f89f", "value": "T1B3934B02B31C0A47D1A34DF02A3F1BD187BFA5D121E4FA89691E9B869675D332186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662554, "uuid": "fd11e37a-b217-40e8-9f6f-caeed292721f", "value": "1536:V8wO3dePVA1S0TvRrJx19EgwnWPcbTJRuCFH3uyoPUK2qx4TsI4FCvhl6rJ5VLPz:kkPVSTB1XwDu8uVXQsIICvXafPz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765662554, "uuid": "c96dbee7-8cae-43b9-bba3-0f0edb312e6e", "value": 92328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765662554, "uuid": "97a94c2d-001d-47ae-a843-c9780445777a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662554, "uuid": "b52347fd-c395-453a-b963-67716f3bead8", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c666f4f2-d809-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765619694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619694, "uuid": "d9e9e94a-673c-4ae7-9b51-64db13487a7c", "comment": "Malware payload", "value": "8f39efde29fe0b4a8c258ab12ef37a72", "object_relation": "md5", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619694, "uuid": "1a915097-abc8-42f4-876f-261c8719c0e4", "comment": "Malware payload", "value": "5f2bc3f3db9d33dad0bd97b9b7353f05fe4a313e82feeff6509caa9611fa22e5", "object_relation": "sha256", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619694, "uuid": "a5b8a682-6230-4d38-aceb-1aa10c5f5b20", "comment": "Malware payload", "value": "2e16a7644098eb633f35bf49c02bb51f82e5c191", "object_relation": "sha1", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619694, "uuid": "40ffc0ed-50b0-4606-a35f-0eca74b73c7f", "comment": "Malware payload", "value": "92c17913db8d32bbe8345a43d514502ed8f3ea9db93bd8664d3c5142ff50346d546ada6882c735e5d42c797428ad851e", "object_relation": "sha3-384", "Tag": [ { "name": "193-247-77-123", "colour": "#2ADAF8", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619694, "uuid": "bb991b94-db32-47ea-9881-fb6b407c7aa2", "value": "T1F542293549BC8E10E1A1E00E44D89BB626097ACF99D326ACFF2FCC56D519E6143DEBC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619694, "uuid": "968fd25c-47a5-47c7-8b62-e36a8503948c", "value": "192:eSQh0nw5aSQh0nw5USQh0nw5w7S7SQh0nw5yMC5SQh0nw5sSQh0nw5lSQh0nw5Jd:eSLnwsSLnwSSLnw/SLnwgLSLnwCSLnwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765619694, "uuid": "19e62db1-1e39-4447-b137-bae96a0b0c87", "value": 12264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765619694, "uuid": "1878023b-39c5-4a56-8bd7-6e04a59ccd8e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619694, "uuid": "de6643e0-90ba-44e1-8d5c-ec3c1b161b7d", "value": "xqatef.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a573314-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639135, "uuid": "fe7b373b-617c-4429-a3cd-b60f695f7ca0", "comment": "Malware payload (Mirai)", "value": "ae3b098e19ed38945f0e861289335c03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639135, "uuid": "97f994cc-0ff0-470a-b87e-f8afb7262396", "comment": "Malware payload (Mirai)", "value": "5fa579cc1dfb1ada50f37b07e3992cc6dd8e4986e6f48e38913aa5c66495010f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639135, "uuid": "387b36f7-4bc9-466c-92dc-b43ce3b37c70", "comment": "Malware payload (Mirai)", "value": "9a528f9eee302f3beea15384585f424261433684", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639135, "uuid": "f47e6ee9-7fef-42cc-882b-d7c4de293289", "comment": "Malware payload (Mirai)", "value": "e743b0bbeabcc8213bf0645f796a18c942e4088d040dde313a5631cb87b7e01d4c132940882572ccced3d48cdaa1e9c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639135, "uuid": "b8da24c4-91b0-468c-a751-9b27f163231c", "value": "T1B404B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639135, "uuid": "afa3dd77-5212-4188-b793-b790b8d04cc2", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD2e:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639135, "uuid": "3a11e8ce-bdee-4159-a6ee-4a5e3b473707", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639135, "uuid": "7533c773-b18a-4ed8-bc78-16e8a39d5488", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639135, "uuid": "bb0c2109-b240-4e55-bc34-a1c5c0f2a45d", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db46533-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615519, "uuid": "06a7d656-e6f0-4da9-aa81-5c5043924305", "comment": "Malware payload (Rhadamanthys)", "value": "6bef6a4ff99eadce67e0440b5ac37649", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615519, "uuid": "b12695fd-38f8-463a-a244-86b7502afa79", "comment": "Malware payload (Rhadamanthys)", "value": "6158fe30768cd0ac5936067efc2d85b915828e3e44353a5decc0c0dc389feeb4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615519, "uuid": "f9c9f8d6-dee0-4a0e-96e4-5dc411f98d97", "comment": "Malware payload (Rhadamanthys)", "value": "abdc0a2a0b7839e16760c606e9f736cdeef22a97", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615519, "uuid": "bfa1270b-416d-427c-8d79-a0247b0a142c", "comment": "Malware payload (Rhadamanthys)", "value": "39fdbcf419c498bbc814678230f0c8a910b65efb9fb44a3658933803be65a2b953947c84520a41ff6f865bbd1d6275f7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615519, "uuid": "3eb79ad5-2e92-4e0a-8081-92a81bf22ab7", "value": "T1A9A30C484E12AEED328312B20D5CDE79D48649052BEA645F7B6FF392D87CE4C15CC68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615519, "uuid": "874bc387-e849-4ba8-be83-1693f6e760b0", "value": "768:GDhd0i7J4sYKgY/CMNfWdYJvCTcrXO7r5JgNHLmAUULBdSLAuAAroQW+FF+Ec+0G:GDB7eKg20qtrmr5JgNmAU8T6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615519, "uuid": "65135c25-81f9-4395-be96-115bd1fe7f07", "value": 102081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615519, "uuid": "48ae6e91-5ebb-43df-8ba8-38223f75eef2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615519, "uuid": "e1a51875-8f99-4672-9bfb-d8dde13300af", "value": "invoice-1637482117.pdf (95).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f311039a-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615903, "uuid": "c17559e1-68ed-4980-a08d-ce761e16e2ff", "comment": "Malware payload (Rhadamanthys)", "value": "41ec7401a6821b87a6fb38e22459672b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615903, "uuid": "b74bc5cd-4120-4aed-82dd-b74b34737e20", "comment": "Malware payload (Rhadamanthys)", "value": "6247d4a79a1b20e749132d958961cd7fa7985c212cdc73bbedf1c092dcb5ed7a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615903, "uuid": "a17cd751-44a2-43fb-9739-493049220c85", "comment": "Malware payload (Rhadamanthys)", "value": "67b5992ddf76f17f7780913e4e7ca02af5f1ccdb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615903, "uuid": "ddb92e4e-97db-4c97-be94-82dc1e413eee", "comment": "Malware payload (Rhadamanthys)", "value": "4b6c3b2eb1f728805b0841dc03bbbdf2fa1400f1bcc0b6f6a542c52f3f003e894d9dfff799043aa7b23e622544216ce1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615903, "uuid": "a8a9fd1a-4365-44f6-8a9b-fe2b5fdcaf7b", "value": "T15EA31AA15DE790B5047B72543ECE0BF7C8261B12383E50D9982DAB60CB692157F392EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615903, "uuid": "96202a3f-29d2-43c8-b9d3-4c480661c253", "value": "1536:GDB7eKg20d/srqryBnfAw9GcWAvFwutn6BkQWJ+aY:GDB7b0d/GIynow9GcVFwutn6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615903, "uuid": "16c3b796-e5a3-4f2d-b0f7-ddf62fdb263a", "value": 101471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615903, "uuid": "799ccafb-fd7d-4a8e-8b77-86671bf1dff0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615903, "uuid": "833b2431-ec15-44ac-8758-a8127ad7e160", "value": "invoice-1637482117.pdf (16).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1700ae8f-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615534, "uuid": "f424f252-36ae-4d82-8294-1d90bf111a24", "comment": "Malware payload (Rhadamanthys)", "value": "3b7d4b5bbecf82abc17efb072db4abe7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615534, "uuid": "340c83dc-7215-41a2-b0ee-64a84a5cf4bb", "comment": "Malware payload (Rhadamanthys)", "value": "6295242b429f70fa5af6f7465542fb06bb15cc67839f41bdd67f1f73fc1b9278", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615534, "uuid": "621ca017-7dc7-4ddc-a60b-990da52632a2", "comment": "Malware payload (Rhadamanthys)", "value": "b5f4e84f9be616ea5961b079644ab73f4b8dd949", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615534, "uuid": "d55386c6-d4d1-49f1-8b20-fae2e7c088e6", "comment": "Malware payload (Rhadamanthys)", "value": "21136a50243588c4715e0dd4349cce9fda849ab51289d7756d36b47ce3a1c466d19ed544dbdb0be986ee0c4d986eb840", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615534, "uuid": "14930535-430a-45b8-a769-3a6759114b4e", "value": "T11793F9052E77BF97402673662FC30C7996778C449BB59BD16E02FF91A1A4A8032627CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615534, "uuid": "827fdff2-389f-414c-94d5-2aaf8e1de93c", "value": "768:GDhd0i7J4sYKgY/CMNfWd3p0rXpFrr475HVOeAs19EJSLAuAAroQW+FF+Ec+0FO1:GDB7eKg206rrrr47z7As/S6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615534, "uuid": "47644835-9ed1-4ee5-9434-0359d9621927", "value": 95584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615534, "uuid": "bfcc054a-b703-4295-ac93-87150f98d4ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615534, "uuid": "d2d63b19-349e-4007-b1f5-aced246e8c0c", "value": "invoice-1637482117.pdf (92).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27ee046-d835-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765638639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765638639, "uuid": "af74f519-51f1-4f0a-9583-9d33cacbac37", "comment": "Malware payload", "value": "2d4358708423b2133f49db01fb88b2f0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765638639, "uuid": "39894bee-7699-42f5-8bd0-47a9cc45e196", "comment": "Malware payload", "value": "63cc15e9bc28c3c483335aebb42b47ae74c4ca24b09990cf7c9153baf3eba128", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765638639, "uuid": "8bcf75eb-2ef7-4e9d-9ec0-0486b8fce318", "comment": "Malware payload", "value": "3c8adbec7d76821afad5a21afe4b73747f09ed17", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765638639, "uuid": "634fbe40-6749-42b4-925e-7ca32a4bfa2b", "comment": "Malware payload", "value": "b3b9b21a361af35e98f190b7f768c87bdc20c9af97652b5f865818ae136fd8a47737abfd2d517b5ca954724b7938b08b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765638639, "uuid": "e3f954ce-bac6-4371-8c65-4f7448970076", "value": "T146773389E535A05BE52EE4378E75422AEAD47D2B09F64837B501B70635F33F632B7208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765638639, "uuid": "52db1f3f-7ab0-4ce1-b606-6a697f851d84", "value": "786432:lZEpCEMkMt6LT6nkY640rIwrXS1alz3o/4gr9XsUVJxPHtua:lZkCDZtoH140rI89lk/9VsUV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765638639, "uuid": "6f80ce2f-30a5-4fce-8773-915f495939de", "value": 33619968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765638639, "uuid": "fa70fd97-fd4c-4919-9700-c724b447258c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765638639, "uuid": "d0dd3e25-56ed-4449-a0bf-bec7ef069d84", "value": "Updater.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e3400a-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613242, "uuid": "7dc496d7-590f-4671-a26b-cbeb8757922c", "comment": "Malware payload", "value": "4cc64bad5fbdd25162773fa36858241a", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613242, "uuid": "d7dab663-da02-46cd-9312-e39deb470afe", "comment": "Malware payload", "value": "63fe0038d59b0c2b9f8be7929f2d7fcf1edc7ca5ec60772642a928002f316742", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613242, "uuid": "db46b686-c90a-43a8-8105-54dd00702730", "comment": "Malware payload", "value": "0f268536fe71f5dc45b8e9d88667c443662c39c6", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613242, "uuid": "298b04bc-1436-409d-9da3-755db189c72f", "comment": "Malware payload", "value": "afa64029e8bd169be8a47fd8c9b3d144b6bbd9acd6b8034e62eb8343d184d0d6ec06a4edafc93a1acb10c11c6931de60", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613242, "uuid": "1f2af597-8456-47e1-948d-3baf4fe98fd7", "value": "T11C318B128D10E8CC52F659A814A7804A30EA46F3A8399D31375ECA766F187EF70E5749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613242, "uuid": "83011daf-b116-4113-90d6-9937d05fa412", "value": "48:XOlPfsDd5dByR9dxdqdtdlQdjdDaYM1drlP:+lPfsDd5dkR9dxdqdtdudjdDTM1drx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613242, "uuid": "f6a609d6-f06f-45db-ba17-9dd9ac3653cd", "value": 1602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613242, "uuid": "7d977d61-6426-4306-825c-7e3bf8633752", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613242, "uuid": "f6ee95fe-8954-4a49-b4f4-5be121f70546", "value": "63fe0038d59b0c2b9f8be7929f2d7fcf1edc7ca5ec60772642a928002f316742.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3337ca7c-d86f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765663256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663256, "uuid": "0f05fa29-d34a-48cb-abac-ecca0411ca7b", "comment": "Malware payload (Mirai)", "value": "627ef2ea5fce8d98127aa7eca6fd0e94", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663256, "uuid": "24b613f8-3a61-48c7-9a87-ca9570b04313", "comment": "Malware payload (Mirai)", "value": "64405f1ae6ba8a9d480f92b5bdda6187b67e0723dd654b2ad9d3914065754d70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663256, "uuid": "270a8e83-2544-4f25-b503-b1d87996f14e", "comment": "Malware payload (Mirai)", "value": "c97744ba4ac6ec9f46a9e00d20dbc63290ee5b9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663256, "uuid": "e07f0577-0bfb-4867-8aec-bd3c03c698ca", "comment": "Malware payload (Mirai)", "value": "a286424da516cf89a8ab836ef96f30e64272bd5c6be36d11139ab0e13507a363dcbec45ece8d7c370908c244a48aeb5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663256, "uuid": "16a321d6-c1b2-4803-835d-24dadb624c11", "value": "T16063010D5729EA26E9211439AEFE049B0D5B65FDE0FC2C4115D802AC8493A267FFD68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663256, "uuid": "2c9d8bdf-f430-415c-ac87-c54bbd7cf027", "value": "1536:/pl/zgJvF/3wGrv3075dL1uFVMT4xyAuMRx4ns0IC4/hNprLwFn:B5md/AefYdhuYLACnP9mpLwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765663256, "uuid": "b063f388-f651-4830-b0d8-d3a1d3e239be", "value": 71460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765663256, "uuid": "bcff63de-4921-4444-b21c-ea2d3c1e5fb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663256, "uuid": "39d033b6-cc21-46e2-9505-beb9acf9705c", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35598bc-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615850, "uuid": "e04c0951-7d9e-4d4e-b023-7839c901637d", "comment": "Malware payload (Rhadamanthys)", "value": "ab0bf2652e1137cb59b750f569b338e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615850, "uuid": "d9a5c8cf-814c-4608-9aa0-2fc83018d9e6", "comment": "Malware payload (Rhadamanthys)", "value": "64b1a3d759c9a5acdd27704e179250910e9689b62dfe5e0dcd2c8f82ceb0bf97", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615850, "uuid": "ea6d7022-e55b-4cee-82ec-79bc6c7bf803", "comment": "Malware payload (Rhadamanthys)", "value": "07f008512b34835812a40bce814a395d1b978adf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615850, "uuid": "352f452b-7e60-4818-96ec-dfd24277cff5", "comment": "Malware payload (Rhadamanthys)", "value": "6a49faf812f0719cb68b8bc82c63239a58f821005b86baee634e955fbc38be58833c89d791f8680b5656a87715508c66", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615850, "uuid": "1e297c5e-04a4-4667-905b-73687f34feb3", "value": "T1FB93F8606E53ECF4424D536D9EE2D4F8EB2A4D1585008060C52AFFE9A0A876FDDB4CDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615850, "uuid": "878a6fbf-060e-4ca0-bdd4-18c77b2e4ed7", "value": "1536:GDB7eKg205PLPHPEPbP5PWP6PUPFPBP2PFPmPMPQPGP4PEPAPvPsPMPzPMPdPsPS:GDB7b08yUQyHG6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615850, "uuid": "8e02b1f3-4478-4930-ab36-836d09f426ca", "value": 97408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615850, "uuid": "118191d2-974d-4132-918b-10ea8f70d4ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615850, "uuid": "b8c68ab7-1bb6-4eb7-aafd-4902d96be1ae", "value": "invoice-1637482117.pdf (29).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e4d8f7-d859-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765653861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653861, "uuid": "d413343e-3b03-424a-ac23-c8dc69f06d5a", "comment": "Malware payload (Mirai)", "value": "e5bc35ea9467bc0b6f370240caecada5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653861, "uuid": "067b450f-07b6-4341-a41b-970f129edaa4", "comment": "Malware payload (Mirai)", "value": "64b42dd209553cc4f1d71249e376813399251159b0c93132fb04bdb0538a8a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653861, "uuid": "bfd9ccc8-028e-4da1-8585-6d5210ce43a3", "comment": "Malware payload (Mirai)", "value": "55ad77e6777dc18ffff7420856b5fa114562cd89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653861, "uuid": "02d47324-c33c-46a1-9d23-e55972ce5fc4", "comment": "Malware payload (Mirai)", "value": "af5fae9f545e060c3dc3c066c6a3c441e7f079a8f83169f46350e563a4f81e320a344c6db0f3664df23680af6df0ab39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653861, "uuid": "d71f05c2-5c63-48ee-a08a-7fc91ea94e21", "value": "T1F5638C72C57AAD54C65892B8A8B08F391F137200D2936EFB1E4AD5A54043DACFB4E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653861, "uuid": "4a66b019-c35a-4e8e-9be9-b7b51f83a324", "value": "1536:5aawtQ32bYHBezYSEQb7DNU5kSU5+CwC7uVnv8VR:55d2Khm7G5kSU5+BWgnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765653861, "uuid": "2cc467a2-2e74-47e0-9638-485e004ddd60", "value": 68564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765653861, "uuid": "ade2ff0a-cb00-4d09-ae29-c5484231d7c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653861, "uuid": "7f91c46a-670f-41f2-aec4-6d94540b38d3", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19a6d0e-d833-11f0-a129-42010a9c0007", "comment": "Malware payload (CHStealer)", "timestamp": 1765637671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765637671, "uuid": "abfbd034-3445-4df9-8203-2ad0dcfe3b53", "comment": "Malware payload (CHStealer)", "value": "22efca03c72a9138012abccf517d42e0", "object_relation": "md5", "Tag": [ { "name": "77-83-207-208", "colour": "#FC267A", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "DESKFUND-BENEFIT-NIDHI-LIMITED", "colour": "#D7E91F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765637671, "uuid": "fabfb17c-3060-4f31-8a0d-5c9baf2ea1f2", "comment": "Malware payload (CHStealer)", "value": "64b97d63af694192e4d6ba57c278ec324eaf6c8700c0f7cade06f5a08da81f5a", "object_relation": "sha256", "Tag": [ { "name": "77-83-207-208", "colour": "#FC267A", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "DESKFUND-BENEFIT-NIDHI-LIMITED", "colour": "#D7E91F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765637671, "uuid": "037f75b5-7d7e-4cee-9760-8d59b9ebbbe1", "comment": "Malware payload (CHStealer)", "value": "f22a314b94e5cb46e0a4b3c68689c82b39d6c4d3", "object_relation": "sha1", "Tag": [ { "name": "77-83-207-208", "colour": "#FC267A", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "DESKFUND-BENEFIT-NIDHI-LIMITED", "colour": "#D7E91F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765637671, "uuid": "52f1d960-3ffe-474e-843f-752eccb09d73", "comment": "Malware payload (CHStealer)", "value": "40dec66c036f8ab778870c9a758f28d875c7dcef465d88292c84c8988b81c06cf152b0b833eacde25b8f3bcc4955c5f6", "object_relation": "sha3-384", "Tag": [ { "name": "77-83-207-208", "colour": "#FC267A", "exportable": true, "hide_tag": false }, { "name": "CHstealer", "colour": "#ABCFC3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "DESKFUND-BENEFIT-NIDHI-LIMITED", "colour": "#D7E91F", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765637671, "uuid": "cee36840-ea99-4c80-9e73-f732880a8f35", "value": "T187561213B24E273EE47A9A354976A950943FBA60651F8CA3DAE00E4CEF2D0501D3FE57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765637671, "uuid": "573e67ab-a643-4d10-8244-33d2fdf852ba", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765637671, "uuid": "419c29cc-375f-449b-b76c-53e895748ec3", "value": "98304:ZDbkJtUUst8Ofyr1AHICJjH1XFVJKxh+niTOFWYJPdoYIxLYqjmd1Wbnj:ZDbkHUUC8Oa1AHICJz9chJDsqw1Wbnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765637671, "uuid": "332d6089-8ff3-40ea-943b-c4f54ca485a7", "value": 5904976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765637671, "uuid": "5fdcd4f2-567e-4f36-aba0-9e1d0b52866d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765637671, "uuid": "f150efed-ed58-4ed9-8886-3580e97e1ca9", "value": "No Other Choice (2025) [1080p] [WEBRip] [5.1]_patched.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187b0008-d7bc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765586331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765586331, "uuid": "e8ba85e2-f1ce-4c06-8c8e-74cbc77f1ec3", "comment": "Malware payload (Mirai)", "value": "48a1a5e60ccb4ce0a27e0f8b59ac347e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765586331, "uuid": "853da3ee-b6a7-489b-9330-f995fcc82291", "comment": "Malware payload (Mirai)", "value": "64e82724a0cdf9a4fbd7e81144a4ecefc664e04d34b23828e9b58a6f7497f75c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765586331, "uuid": "36870d51-7976-4807-8879-5f643fd20801", "comment": "Malware payload (Mirai)", "value": "bdb5f52140a548302031ec1c0cf5ab99cb6d0236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765586331, "uuid": "6a6164e2-e690-4e13-9d86-2bb531951a05", "comment": "Malware payload (Mirai)", "value": "9e95b229d7fff4832200c0390af4225011a2b57d0804effed22fc866df905c3d2a02578e230523530a7c977e373c82bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765586331, "uuid": "405f2af7-e0f4-4015-8801-7bbcfa60845e", "value": "T18C143A07B5C0C0FEC495C1749BFBB53AD832B45E5238B2AB6784AF222E4DE701B6D585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765586331, "uuid": "fe02d3bb-da3b-4307-84e7-d2132e8a0ebe", "value": "3072:yAFBZZxJYwrmEOz6XuA3Rgj9dEd1oBbRAoV8ebQHgk8dZUeg7EJhYx1OocPi1d1:yAFBZZ3YwrmEWaWzb+oTigqsD61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765586331, "uuid": "413574f4-0177-4427-aa62-805700ae3ac5", "value": 201336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765586331, "uuid": "15d4590c-5281-4c9c-946e-b1ce3f66d8f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765586331, "uuid": "ae9dd952-9259-4294-b674-41debd672522", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ab8a12-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613215, "uuid": "9e169747-43b4-4e28-aa7e-7228c92bd75c", "comment": "Malware payload (Mirai)", "value": "00ae8620d28d8c7bdc37bf50690926d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613215, "uuid": "6f1f0c4c-ee81-4c96-80d5-2d6505127b0e", "comment": "Malware payload (Mirai)", "value": "650ea6a83877bc34a46853b3218eff2ca26a276087055f403f7359e51ff9526a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613215, "uuid": "5cd45058-fb4a-490c-b296-6fda615cfb2d", "comment": "Malware payload (Mirai)", "value": "ba3359b183a876b735d070bbc131ef56fec8519b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613215, "uuid": "61f7f2d1-67e2-47cc-b00f-965b8f7a005d", "comment": "Malware payload (Mirai)", "value": "27be746b4795b501d2c53f1c823e4366817e0785eb475e24947ce5e1251ef436155a234d2640f080f371b7c74b45ba5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613215, "uuid": "da7a15a9-f718-422d-9397-99e122d6ef24", "value": "T1F5431891BC819A23C5D4137AF56E56CD372023E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613215, "uuid": "4fb01c4d-d692-4a62-93da-a7a18e190096", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613215, "uuid": "a23406c1-4daa-43cb-90bf-9a4dea221115", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613215, "uuid": "b18d232e-b9cc-4fab-a558-d4a0dd3c4738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613215, "uuid": "c42626ac-0510-453d-bce8-b389839e2484", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b7b177-d87d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669434, "uuid": "fab912e0-decb-4052-8563-bdf809f383a8", "comment": "Malware payload (Mirai)", "value": "b12702bd1fcc3c95f2e3f82746d79e5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669434, "uuid": "93b3cafc-3f6d-4286-9f24-2a19500fc83d", "comment": "Malware payload (Mirai)", "value": "65635a05160a9554b00255899da57aad686cbe8551a4e717588b3fd6e57065bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669434, "uuid": "60bdca69-4990-4c02-9279-e99cb27e0bb6", "comment": "Malware payload (Mirai)", "value": "b7fd023813c7bf36f053757173d0181f4c2c45df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669434, "uuid": "0ac1ee75-f43c-4c62-8a38-314cf2d9cc28", "comment": "Malware payload (Mirai)", "value": "04f7b7aceda302d3e1fdf0e1267df67f13fe4d4fbe528d513e3cdce3024b852ab49dda231d51a443de0317aa162db53c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669434, "uuid": "7a171782-1e18-42f8-8fd4-3c9b61b1c630", "value": "T1A8930805BB644FFBD85FCD3745B94B0525CC560B22A83B3A3970D828F24B25F5AE3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669434, "uuid": "1092b4bf-85c1-46ab-93d8-ab1cb16c15b0", "value": "1536:dugc6TrB6AS8JaqtXBAzA5IWeVw9sQeSzC9knl2IPEqU3nv8VRl:drJrBhDlPzdb+qYnvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669434, "uuid": "2a53fdce-865c-44e7-a2d5-9f5e04588ce6", "value": 97076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669434, "uuid": "53a653aa-d800-413c-9444-1089ba752f0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669434, "uuid": "271666b0-9ab2-440e-bce5-330534f7b76e", "value": "nklmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "738f2f61-d826-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765632010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765632010, "uuid": "0ce5b350-1660-4d3a-8b26-6bcb223a0bc2", "comment": "Malware payload (XWorm)", "value": "88ba15506ae497efd8995b5971a91ef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765632010, "uuid": "6b4c4c3c-c465-44e0-9e31-7e57e34cbca6", "comment": "Malware payload (XWorm)", "value": "656bcff52518bd53ae865533a6cd7188372ed4766a1c27c6dfacd7d363af8b52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765632010, "uuid": "cb02ed9b-71ee-412a-858a-92b7d033ef3e", "comment": "Malware payload (XWorm)", "value": "478466346e981c958e0385b6b21e1ed3cbcf558d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765632010, "uuid": "58b22450-8b19-473d-b5c8-6354061f582f", "comment": "Malware payload (XWorm)", "value": "3b8e3d33b4c375c011f6997fd775945c5efb034d516a88f16fea6cf0918f503ae1f61070ad58e1d1001b2dacca6ec153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765632010, "uuid": "fcf0289c-84de-4e57-bbb1-868ed9fbef4c", "value": "T110035B48BB908221D9FDBFF559B3520B4B31F2039A13D74E0CD4869A2B676D4CE907A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765632010, "uuid": "6f568ed8-98bf-4513-b618-9828d658cb58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765632010, "uuid": "e1b6eb5b-6a67-4bb6-b484-4b69fd0967cb", "value": "768:FMrbDchIP/QjHFKuu3amNzHpu1FWPr90J6POwhpaQ0:KHDCm/GHFKuu3amNqFS90J6POwvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765632010, "uuid": "4e808919-c3ee-4cc4-91a2-3e49759f41c4", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765632010, "uuid": "a77b1d65-a126-40a5-bf54-09badbf3cbde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765632010, "uuid": "16388927-a091-4fdd-84e2-0562fce78f53", "value": "SystemService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340ad9c7-d86f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765663257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663257, "uuid": "b67048ff-b7c3-403a-a816-3c717bf80761", "comment": "Malware payload (Mirai)", "value": "c2a45b6d8d1b03729f32f012bd784751", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663257, "uuid": "a3dfacf8-c544-43c5-946e-c388dc17bd54", "comment": "Malware payload (Mirai)", "value": "663f92b3c4c229456187a0eb07f29490e63801c3eacedfaded786fe5a3d588b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663257, "uuid": "9a3e1aed-3d05-43f9-856a-f49bbe84d8da", "comment": "Malware payload (Mirai)", "value": "5c6c4634c7fc90408c5d13deac6b484da2ece234", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663257, "uuid": "87dff435-8cf6-4092-8e85-c46f90e9b5d3", "comment": "Malware payload (Mirai)", "value": "3585a31092e1d16cdf6588ae079750d07627288818a96167f2f5fbe1edd1fdcf81768b5f5de347ff327fd33d042ac49f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663257, "uuid": "807243a6-b767-4621-8068-64496cdf64c7", "value": "T183334BCADA43C4FAEC18093114BBB7335A31E8390475EFC3D795E835B9126127A167AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663257, "uuid": "dc315e53-e110-453d-8bdc-2121531f2a8a", "value": "1536:arpzBzPyNkYWipPSzq3YjaxI6NZyGRRkJp:arpzQBWi5SzyCGT8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765663257, "uuid": "5678d8ec-ea95-4148-aaf5-2986dc18c900", "value": 54192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765663257, "uuid": "86378423-07b0-4268-838a-ebd77f0faf05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663257, "uuid": "2e30c4f9-7c6c-4792-9084-0c83619bf6f4", "value": "nabx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75296507-d86d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765662507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662507, "uuid": "e76c3517-5c01-4ce5-9e98-4498f3563db4", "comment": "Malware payload (Mirai)", "value": "7b30e6e60f7e105081d6cf734ead128e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662507, "uuid": "15b2be9d-d7cc-4134-ac22-0874af375eae", "comment": "Malware payload (Mirai)", "value": "665ee3fc17e52f096e7f232cc4333b680943502f30e9e7340e2e2de957221f31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662507, "uuid": "1374e39b-187c-4cb9-b8b4-06ff372aa5b3", "comment": "Malware payload (Mirai)", "value": "5ecf0fec251b79094e72d49fc3d0372c29cd37b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662507, "uuid": "fb6edccb-014a-4c2d-9b51-ba9b0eac3fe7", "comment": "Malware payload (Mirai)", "value": "dae99b0c9ca8976eee0358113beea1c0ebe3e110711b69277a82b694691380580639903172da983a4eeb4d6f0bceaeba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662507, "uuid": "b27a29e5-3046-45ca-a3fd-5a4c02d9a1d4", "value": "T1825301A8C1FC8DC3EB8E6035A0FF154B2918B5DC902684A29FFC8A7524C175C1D59ACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662507, "uuid": "d620ebc7-b2fa-4d8e-89d8-1933b3114d03", "value": "1536:jRdSu5l5EaNUxZD3c4zU0tKGUm/BUd/0gS4m0g1TBnouy8Hyl:jiu5/EaN+ZDBzL6AOJy4m0g1Thout2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765662507, "uuid": "10eb0bd4-3024-4576-8b49-d286d7645f73", "value": 64400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765662507, "uuid": "2f8858ae-5ebb-4493-a064-655cc1aa8ff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662507, "uuid": "7fa724e8-353d-4f31-9bfa-f7114358dc1d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c973d465-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765613257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613257, "uuid": "05b7a609-2a55-4dfa-a2ae-3f29bed6281a", "comment": "Malware payload (XWorm)", "value": "9beebbcbe2425b2b522c080bb4446500", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613257, "uuid": "c37a40c8-ed64-4e61-a0fd-fb5ad32392a1", "comment": "Malware payload (XWorm)", "value": "667304c2ddccd1ecfe41d3d95fed3bab3d2308f8c1190ea0c5728eccfd8cf082", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613257, "uuid": "a72c5bd8-2cc2-40d4-8a53-1ab4c717a768", "comment": "Malware payload (XWorm)", "value": "ecf3126cab0fb5f3a5d5475442873f29a2ea6482", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613257, "uuid": "d4b64f86-fa98-4ab8-82a3-1dbb4342d9d2", "comment": "Malware payload (XWorm)", "value": "578e89f1d4961cf97ba27f32cae3220f99a4cee0a68ecc843e5d98e82513145a28532f01d84c16a925b69ed80a1b8a89", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613257, "uuid": "523b2089-b93f-478b-9672-b0ab51a089a4", "value": "T1B6E24B4877E08712D9EEAFF129F271091374E11BD823EB5E0CD8D99A3B639C146507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613257, "uuid": "ac74a467-38a2-4b94-9823-3ec6d00a0f5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613257, "uuid": "d22a9af0-6909-4b9f-8578-9669e03bbdb5", "value": "384:xYaJWq4Ava7Rm32oDuuw3Esd4T0JVaIgL5WwTh0duDCOQAoraR6pkFTBLTAOZwpE:7xC3fMbYwTGdf5AoeDFE9jSOjhKbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613257, "uuid": "cade5ffe-e638-445d-ab72-aa50414075c9", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613257, "uuid": "5f8da2d6-0c43-4658-837d-1ae72d8a7400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613257, "uuid": "245e25e0-b6f0-469e-b912-c74d54e47e75", "value": "667304c2ddccd1ecfe41d3d95fed3bab3d2308f8c1190ea0c5728eccfd8cf082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ca0d32-d7b7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765584343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765584343, "uuid": "84bc237d-b2cf-4790-840c-e524df312826", "comment": "Malware payload (Mirai)", "value": "8aec706aef839164454f01822e6c6914", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765584343, "uuid": "47d77134-b842-4b3e-8dc7-bc0597cd253e", "comment": "Malware payload (Mirai)", "value": "66e13f05747c74cddb2760d70d4a690a30c1a1edbcb610e7f4947b0c28a7680e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765584343, "uuid": "f27d2776-d8a2-4932-9c9a-c302318b5a31", "comment": "Malware payload (Mirai)", "value": "e143096e44f06b2401994ab49179b69c984a567d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765584343, "uuid": "07153eb8-68d4-42cc-ad74-8cf31986931e", "comment": "Malware payload (Mirai)", "value": "beb9519c1019ff5235f6c3fc174f35f6d1ce9b21d600216aa331b9d27551ab96c4f9cf8bc65c7103ff552af513979c05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765584343, "uuid": "ef0e914f-39f2-4b88-aaf5-a426aeef22b6", "value": "T138144B02771C0947D2672EF0263F27E1C3EFD9A225E4F645650F9A898272E371589ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765584343, "uuid": "b53b1b27-91b1-4d82-9f4c-3b9a443a8f02", "value": "3072:TC9tWmZWWpkxapRdVW0MapRpXSZbJ6hh1JfLo:TC9tb8nxazdVW0MapRxSAfLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765584343, "uuid": "f4418aed-0663-4c31-95d3-9f041617b27e", "value": 193208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765584343, "uuid": "06e2f6f8-8730-469a-97f4-030e53513c05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765584343, "uuid": "2dd5c3b2-9895-4efc-b762-a5f2a70069a8", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7741613c-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765616125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616125, "uuid": "57923bb5-ad79-4d5b-b20b-e56fc74d300c", "comment": "Malware payload (Mirai)", "value": "74b7369f68f5ff2e876dc458ae5b039d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616125, "uuid": "699fb01c-2a45-477f-8119-8dad8edc1f4e", "comment": "Malware payload (Mirai)", "value": "66f83ffd6cffb96ea400c974f0f7a9e40a5f01afffc5c4c20fb3793dab598ae3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616125, "uuid": "775c1ed3-a224-46da-b783-6368d4806c62", "comment": "Malware payload (Mirai)", "value": "86fb7c2c71c31ab0f70548424b0598d23bde1590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616125, "uuid": "64afc643-7ffe-4868-8d37-90193e910130", "comment": "Malware payload (Mirai)", "value": "0df3605047416d16c7d03dd0a2e59d171ccb0a8074b3666d4d86ff411aabc822b09b6ecd72ea78e2e0ed864780a8e4eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616125, "uuid": "eff94cf8-1272-49d6-9a75-bc9982f4a746", "value": "T12124728ABF903FFFD85ECD334295CB09129C491A1294BFB62A74D518B68B10E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616125, "uuid": "41807c51-3806-4d9c-a065-b378a75179c7", "value": "1536:emM6WAe51SGffJNYjms2aNK0/5dH/8FxbDrc11JRiUwuRxh4NdmhgsC8ElNVn5hX:emjw51SIJNYjrrf8IhRAQhDern5EY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765616125, "uuid": "112e2452-58e6-4c04-99c1-e026de0f9eb9", "value": 227620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765616125, "uuid": "5a600f7b-ab2a-4ea6-96ab-a31ded13559a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616125, "uuid": "d040203b-041d-4d1f-bce7-69116cdbb6f1", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a756070-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667187, "uuid": "ebe87d18-a8d2-4521-bb14-c0627d1dd706", "comment": "Malware payload (Mirai)", "value": "515b5f4680878dc9567b90316b20ba1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667187, "uuid": "8cf84e91-77fa-427c-95e0-42973be287b5", "comment": "Malware payload (Mirai)", "value": "67140c893dd15e630feb668100c61a982c14968db8ecc1869f4ce6c177201128", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667187, "uuid": "8ce10a29-a4b8-4588-bdfb-65e914180fa0", "comment": "Malware payload (Mirai)", "value": "e2f251bce01bd3478dbc79a81e9d62489548e7fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667187, "uuid": "407bfd21-ae20-4da3-9191-e15447beaf90", "comment": "Malware payload (Mirai)", "value": "6c14426ac77c9c91e3a4e0551c5fd741fea607df6dd5711f8724cd9f407ab63de2de07f9414ecddf1fb57b045621e6d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667187, "uuid": "26ad76e9-51e7-4710-b486-0c5cf57e7cfa", "value": "T1CE143A07B5C0C0FEC495C1749BFBB53AD832B45E5238B2AB6784AF222E4DE701B6D585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667187, "uuid": "8c86c674-fa83-4878-bdb5-36368c3efc77", "value": "3072:yAFBZZxJYwrmEOz6Xu83Rgj9dEd1oBbRAoV8ebQHgk8dZUeg7EJhYx1OocPi1d1:yAFBZZ3YwrmEWauzb+oTigqsD61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667187, "uuid": "db3695ac-7c45-4611-b4c5-0b4860bf8bb7", "value": 201336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667187, "uuid": "9c9c2266-8321-4968-87ac-f8ab246e2d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667187, "uuid": "c0230224-a9be-4dad-9e40-2205c302e1a1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eba10c2-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605239, "uuid": "cb9bdc57-65b2-4c99-906c-0bdf4a071c87", "comment": "Malware payload", "value": "9100fdc53082100acae225a8f17508ff", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605239, "uuid": "6cb0f44f-0568-411d-b79e-fd5ca32467b9", "comment": "Malware payload", "value": "67d09f1c76e7ac7339572899180bb98d4dee76c81815f81e803c4da556df41ce", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605239, "uuid": "b0287740-5019-4f23-99cc-d79e727caf5e", "comment": "Malware payload", "value": "928da5b00bcc4a4bd0de6c41a85afe80e96f90a7", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605239, "uuid": "e4abdaeb-a092-4dfb-8777-a3a98e872b49", "comment": "Malware payload", "value": "bae7ae323de2301c50293267f3fa1b0696f1eb740638b0b23c1d6f2ab78bf2af91498a62b469d1cf3fdf22db4252c346", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605239, "uuid": "bc8b1163-667f-4134-b50c-fa381d52c591", "value": "T118842AA3E7482404C3B846B58A2D5358BD35FB4C5B7013BB3B50A2FAAEF93544D1AF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605239, "uuid": "de882522-25da-49e0-b51d-8104963f75ad", "value": "3072:8FCm6KEKd70hmXz9m5/XZleSyg/MOHyA8uVUy0oMzraRbgqkg1+Wxgu/pFGJPHn0:traF9a8uVB9MzrU9+PHnuiuNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605239, "uuid": "d0b1a3cf-b5ff-477d-878c-8399b6073ca0", "value": 390448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605239, "uuid": "613a8748-a582-4c06-94fc-d4919824f648", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605239, "uuid": "0fd2a4d6-a230-4a25-94f5-d5e4a4fc6d6e", "value": "67d09f1c76e7ac7339572899180bb98d4dee76c81815f81e803c4da556df41ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44feb63a-d829-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765633221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633221, "uuid": "5b7dac91-e881-46aa-8f93-3f0a52083c1b", "comment": "Malware payload (Mirai)", "value": "8bad598946e73f76699f70dfc67bac8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633221, "uuid": "b77d614e-4a60-402c-b608-232facddc3e6", "comment": "Malware payload (Mirai)", "value": "687546a437a8a2d3bc41246651052fa125245405b6618cdb24903f36de23d3e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633221, "uuid": "edce6592-5235-4997-bdef-1ff24bb93e53", "comment": "Malware payload (Mirai)", "value": "b71b0208df6c0e4e92e733cbdf68c74fdb76c908", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633221, "uuid": "f7a09784-fafd-4524-94ab-b752e0a26a5b", "comment": "Malware payload (Mirai)", "value": "6b87a4c60a8bd4ce979afe5cf47114898871736eb4f2c93a30c4861ba22f3d7484ff7c7c383d6709da879f5ee459d76f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633221, "uuid": "b00a8542-0cd5-494a-8ad0-af7b0f6b3f4d", "value": "T1B2F33A91B8815A27CAD622BAFA2E428D332663E4D3DF7117DD214F2137C685F0D77A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633221, "uuid": "86cd8c2c-ec20-420d-9b98-1d01be9423fe", "value": "3072:0w21rKc6pPNu9+7bjDtnQBRIBMWA+Iei8SN76x4pftu6NU2D0:0hAbPNy+fjDtnQBR4zIrf76xwNU2w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765633221, "uuid": "bb7fffb7-aea4-46c1-8581-0fbf2d868eb6", "value": 165336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765633221, "uuid": "05be4029-1905-4afc-90da-e4dc20e08a21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633221, "uuid": "2a87f668-0933-455a-bad2-11f0be689e41", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fa9d72-d87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668360, "uuid": "35442c8b-de90-4090-ae72-b39f07b1ac40", "comment": "Malware payload (Mirai)", "value": "bd4636abd07893a5daa261fa28f46b54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668360, "uuid": "466a370b-99f6-4270-999e-f8ce963ee2d4", "comment": "Malware payload (Mirai)", "value": "69093ef0bd87f2e329863cd4d9f682d04e05d22e8f075c71d8b9bc56cdcca073", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668360, "uuid": "05a56ab2-250e-4b3f-af09-982c6248d560", "comment": "Malware payload (Mirai)", "value": "c73e9e7816ddf00b60e2157464208fe0056abb15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668360, "uuid": "8826aa3c-9e3d-4d59-8845-954f6ed87114", "comment": "Malware payload (Mirai)", "value": "13e28bb6feedcc4f96b432faf0e5efae1dfa894b5a4eae4bc1a09a2bd1ee13b774070fbc480c3b8b2ffa2123751c8d57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668360, "uuid": "eb8705fb-c6ba-437a-a1a2-0b02e705ce1e", "value": "T135048C73C8746E98D660D5B0B0A5DF385B13912A51839FFA65BBC3B04087E8DF9193B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668360, "uuid": "d103c0e7-35be-4924-b743-da7707c13854", "value": "3072:Mdsf2lb38rqps0T3uYD/NjUQwoUWuqEUrPd6hh1Mxy:MZlYrEsE3uYDZFNuarPDxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668360, "uuid": "573464d9-2674-4d1a-9e21-309a8745ecd9", "value": 174976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668360, "uuid": "735c0a86-1387-4075-96a0-e6702abedd87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668360, "uuid": "fb4fe8ee-978f-4ba3-997a-70cfc2d5f0f8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979016b4-d7f6-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765611455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611455, "uuid": "f54cb421-e28b-43e8-9db9-f2a7fe619727", "comment": "Malware payload", "value": "9bb18b91d5d9fbda79ad93105c9af72c", "object_relation": "md5", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611455, "uuid": "a15f77d5-a858-4455-9fb5-542bbebf81aa", "comment": "Malware payload", "value": "69a0707521aabe18b9f16825c40edf3aea2f84e3e0ad1f45dbe1d859e0c4ecac", "object_relation": "sha256", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611455, "uuid": "44fca78f-ad20-462a-8a8e-06674897f37a", "comment": "Malware payload", "value": "9923ba660bee02c7c03c3d51735669e7853eb8f9", "object_relation": "sha1", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611455, "uuid": "f33dc931-d69c-43bc-a40c-6b35f35b8136", "comment": "Malware payload", "value": "07871fc161e1eee0eed693a405e61561d87727abb09fa01f438441c0c6a73d1f88837c53cec67cec6328848b10686fa3", "object_relation": "sha3-384", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611455, "uuid": "03fa7533-5de8-4f0e-8c3a-947bb7b0e6b0", "value": "T131C470B85FCC20A0FC0FD5215AF9BC7A527235E7CAD555580328AE805F91FBA6F808D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611455, "uuid": "94147170-edce-4348-aadb-75fc59c77df5", "value": "1536:FjQNfQ+x3hvb26vLZjs8FQbkdl1KkY62nxWIebzGD1bx+lsorIDIGkWYqL570JyR:QCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765611455, "uuid": "f8740bd5-691b-40c5-86de-bdb7f72ece96", "value": 585864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765611455, "uuid": "e1544b80-8769-49ae-a522-5d3db6e3a7b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611455, "uuid": "19649a27-edb9-4b56-be21-dcf4bdf1c121", "value": "69a0707521aabe18b9f16825c40edf3aea2f84e3e0ad1f45dbe1d859e0c4ecac.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5ca03d-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666417, "uuid": "f37ee1be-5dcc-4c35-8dcd-1e978f7197f2", "comment": "Malware payload (Mirai)", "value": "4a063885d85c508d6ddfba44380afc53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666417, "uuid": "4d88ade4-5a42-4ec0-ac9e-5b2ae0f0e924", "comment": "Malware payload (Mirai)", "value": "69f864c47452f6f747c85c73ab7d9a62a834235e9aa5476eb78485db36526d46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666417, "uuid": "aa38e85c-a5f4-4fca-aff0-6fc5255ab374", "comment": "Malware payload (Mirai)", "value": "35223cf4872de0c86cef55c2653b548e1b657063", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666417, "uuid": "383c0814-110b-4817-8800-0349e18dfe43", "comment": "Malware payload (Mirai)", "value": "19b19e769a13bbdfbf38803cbf809cc139dd18c0d5462f42a0214d19198e37292a8e4f1d5789582e14e1b232826f5f95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666417, "uuid": "9cc4fe1d-2b9e-4168-b11e-e8341b429ead", "value": "T1F1A3074AB8819B51D5D522FEFE1E418C335357B8E3EE7212DD10AB19778A82F0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666417, "uuid": "3b673351-5c38-451b-8a2d-1fe582f27857", "value": "3072:ewl5gP2huY32As+qMjUuDwy9D7intpW6nv:ewl5u2hfmA1qMjUuDL9D7itp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666417, "uuid": "eb99a9f9-0d1b-47d3-abf5-c67f27b4585a", "value": 102620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666417, "uuid": "3d720332-32df-494e-b46d-7ad08596933c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666417, "uuid": "9b9884f4-3435-4ded-8116-f1108d4f54d4", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e79df4-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667292, "uuid": "6369cfac-cd75-45a2-bdc0-308f66796c6d", "comment": "Malware payload (Mirai)", "value": "b8e53f91d43db3dee1635d2301f92984", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667292, "uuid": "52638a77-7739-4b44-9f2e-4ede77dedf9d", "comment": "Malware payload (Mirai)", "value": "6a06ed6a3ed3f8b63bcc01077ea822334e792687a338357c02eec258417f31bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667292, "uuid": "5ddc22eb-4dff-4b47-a3b9-1a16c5eb749b", "comment": "Malware payload (Mirai)", "value": "e0d297ce994562253d0bc84d4d21093fb53ca32b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667292, "uuid": "a1846f14-db59-4d7f-9c29-d60d03c564f0", "comment": "Malware payload (Mirai)", "value": "6d12c638e1a705d02b576543d7c082bc1884ea656a52a9292372495821055342393c3fc52b42707e24889be88287efa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667292, "uuid": "75c1edcc-d4ba-412e-a268-c188ee38c4ce", "value": "T1CDC2D03002AB1951C3B10CB1C938C39BAAAA4674F27733B73D684374A4DF64A59BE353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667292, "uuid": "144c74ca-1ee4-40f2-9f87-c6c1424a9aa0", "value": "768:UsJedVbNLVszYDGJULLbTxVYIbQ6ewb1rLySkgaPs3Uozau:UCuuzY8UPbT3bQ8Fyvgz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667292, "uuid": "c12fa69a-55d7-43ec-ba82-57b8d09b7fb3", "value": 25840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667292, "uuid": "42390999-b8da-4df6-97cf-e0a1bea1faf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667292, "uuid": "946e2b3a-a068-4d51-b822-b91626c47fd9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947532c9-d81c-11f0-a129-42010a9c0007", "comment": "Malware payload (AmateraStealer)", "timestamp": 1765627770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627770, "uuid": "81875666-69a0-45da-b727-bda9eea1fc42", "comment": "Malware payload (AmateraStealer)", "value": "df1df6677e36686d37dd25a59cb016f7", "object_relation": "md5", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627770, "uuid": "d49c0614-adc3-4799-9c8c-1189d3af939c", "comment": "Malware payload (AmateraStealer)", "value": "6a12d2f58ea8d3b71e3334c649516baa373991a6d006a359f8094c4675c0ad56", "object_relation": "sha256", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627770, "uuid": "0dfb7469-0e22-4e44-b28c-b08b059bdf33", "comment": "Malware payload (AmateraStealer)", "value": "bed030eab084f68b82d068c2b29d5c73aeebdef2", "object_relation": "sha1", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627770, "uuid": "a54370e9-dcc8-4f11-8a5f-7f3ea6d4b155", "comment": "Malware payload (AmateraStealer)", "value": "cf210cb9fad8c19db887848d602f4c0c07d4cb8dac7f7e11a1cecd36883fad985c17a197eb4b13990d08f0705464b103", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627770, "uuid": "e32c70e3-1678-4a7e-b88a-44727d1a744a", "value": "T1F6D30801E511C439F4A610FAC7FA07BE6DB89B20231611C3D7D5BCF99B2A9D16930E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627770, "uuid": "b5c3b705-089f-492b-a4de-af2a2063cd17", "value": "984c01ea90b60bd6934d0bf70480b54c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627770, "uuid": "596f85cb-ba22-4d6a-8835-a1876b406b97", "value": "1536:/G94SXSVOmfchjJriSQ389cVMaZfO7cCAPAw8nwoKI4l0dkSF28z2NNvGOfJ12B5:/+0VNfchlr1bIuyAjnHy8wiUtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627770, "uuid": "b8b75eaf-7eae-43b1-8c17-5058e2c2264f", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627770, "uuid": "9331bde2-47c0-4721-b86c-b6a93a0fd657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627770, "uuid": "3a55d335-2810-467d-93ca-900a31f21c6b", "value": "6a12d2f58ea8d3b71e3334c649516baa373991a6d006a359f8094c4675c0ad56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f04375b4-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615899, "uuid": "3a557d1a-24eb-458d-bf8b-7a1508c8e989", "comment": "Malware payload (Rhadamanthys)", "value": "da0ce5d2eb328a29a5bb8b52a20f80a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615899, "uuid": "1b52b422-c5dc-4a4f-8162-6246d6e91eb2", "comment": "Malware payload (Rhadamanthys)", "value": "6a1bcf4c030fc72529b46cdfc49534d6ecf5f3570d2327e394a0bb2876b79ace", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615899, "uuid": "e4a0d69d-1e48-4b28-8bf0-d8a84ba19ddc", "comment": "Malware payload (Rhadamanthys)", "value": "47eed40970bd3f04664105edd3eb673495258fb2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615899, "uuid": "0754090e-a203-4313-a209-f850e28d59fb", "comment": "Malware payload (Rhadamanthys)", "value": "0c3bd002c782d991e78dad8a6e4f335694352c8675dc93e77e54398438dddda4d0187d99041a6f2109ede0d1388f712f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615899, "uuid": "5b779c67-990f-4536-934f-bb066a990aff", "value": "T1C7A3177D3615C4FA56A1AB9E2AB634A9E49FE49213C2B00824CFF38171F4615DCB1EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615899, "uuid": "77d2bd44-8866-4c36-b3bc-28f2701bfd58", "value": "3072:GDB7b0vCJjAo8BXyZRRA6tEYBzFdZQBOQ8QJpanlTI//sChJXDV+AsCHHhliDYmv:0mtVA1ZWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615899, "uuid": "951c6ea1-5dbc-430b-9ddd-d38d6318e386", "value": 102675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615899, "uuid": "49bdbd6e-b5d5-45e8-9b92-aad1a9ecb236", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615899, "uuid": "d1be45e0-06bb-41dc-8912-77a071a8dcb9", "value": "invoice-1637482117.pdf (15).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb029b01-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615836, "uuid": "f4cf4caf-bba4-43de-a51f-d2560e2ff455", "comment": "Malware payload (Rhadamanthys)", "value": "ca32f7f609325589fbac90be8d5bf29f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615836, "uuid": "bdc81b60-f279-4a15-ab98-5c24ccc11da1", "comment": "Malware payload (Rhadamanthys)", "value": "6adf9674e8ab3fbfd5168dce8b4e344205a07fe984e0c25ad022ed45b8b332b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615836, "uuid": "369e23aa-20a7-44c7-8531-3ebf811a9acc", "comment": "Malware payload (Rhadamanthys)", "value": "474900f1f40136bd64229414fe76f9d4b92f715b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615836, "uuid": "edb264d8-f73c-45c1-9826-f70492ec4d7e", "comment": "Malware payload (Rhadamanthys)", "value": "7a6009e2ec47a90963be409fb113fe944f23e47ec040e3ccd739b3c336555982e9824962f2061081ccb2bc2bbad2e899", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615836, "uuid": "2e18ccb2-975e-473a-84c6-a567dbe4ccae", "value": "T191A3D697CCA3AFB2054B6EA65BC168FC8EAE91849D668164CB47F331F5CD55A30321C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615836, "uuid": "b553bf72-fcd4-4bcc-8750-034c1496e4f0", "value": "3072:GDB7b011Pk38ydf7E9hRWTZo+q8bz1t/ypoRZhkUBsQB1ZvNOVBvjDPzuGOLagat:0w1Pk38ydf7E9hRWTZo+q8bz1t/ypoRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615836, "uuid": "3d5d0e97-aca1-487a-8d72-3d83e634bd85", "value": 100076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615836, "uuid": "079c842b-3dfe-4840-877b-2c4f3d66d89d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615836, "uuid": "5381abf0-f9a7-4c9f-959e-6fe0d34abb92", "value": "invoice-1637482117.pdf (26).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb5afb2-d7ef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765608460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608460, "uuid": "85d34b25-983d-4678-b9d9-00a5e4bfad70", "comment": "Malware payload", "value": "9aad46ac8804469c412adea4081dd6cd", "object_relation": "md5", "Tag": [ { "name": "107-175-76-208", "colour": "#54FA3C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608460, "uuid": "fb80d604-0413-4d62-8358-f989d58affbe", "comment": "Malware payload", "value": "6b14a1aae8339262628e56f02c1f11963d90760c339631d733fe449d536c302c", "object_relation": "sha256", "Tag": [ { "name": "107-175-76-208", "colour": "#54FA3C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608460, "uuid": "73114c66-8e36-4967-b276-8ac7ca3e0891", "comment": "Malware payload", "value": "b83d30205a6057fe78b52111775e1fdaa1c1c6eb", "object_relation": "sha1", "Tag": [ { "name": "107-175-76-208", "colour": "#54FA3C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608460, "uuid": "725f2f0d-8772-4436-b910-92afa610fdb5", "comment": "Malware payload", "value": "c46fed279f9a3e9bd5f939ba55942a8049cde9631e67a468d276d857d4af66ff83412256df128bade260969b298be93f", "object_relation": "sha3-384", "Tag": [ { "name": "107-175-76-208", "colour": "#54FA3C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608460, "uuid": "b059f9ec-0c65-446a-962f-2fb2312a5cf3", "value": "T1C0123047A2D0CE3FC8D953384467122472B794BEDF629713064915B63F427E81E6EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608460, "uuid": "81f912b5-4bd5-44fd-82f7-4dbea6a5c428", "value": "96:GqTVJWWGXzS69H5ML09V1J9G8Ymr+hrsrwegVekrf7mxaamBFBp8sBRnsH5vZAC:GqnWWHGZMWT1Ym6hrsnurfjTr8sbnsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765608460, "uuid": "59ec8cdf-27f1-4809-9bff-d601c6a515e5", "value": 9800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765608460, "uuid": "ef2d55e4-c887-436d-b99f-4eba3de1d8ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608460, "uuid": "6571a261-1a41-4057-9e65-62e04108cc01", "value": "6b14a1aae8339262628e56f02c1f11963d90760c339631d733fe449d536c302c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04068578-d84f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765649433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765649433, "uuid": "fa0690a8-5760-4e0c-b520-041ec2542e02", "comment": "Malware payload (Mirai)", "value": "c1ebf8581fb8b63669210302203e7349", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765649433, "uuid": "8b191115-394a-47f8-b7ee-93a5d2273f0a", "comment": "Malware payload (Mirai)", "value": "6b2f65d521c8878bb7a60dee392ed3dfdded528257f5820783b3afbee4e73c0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765649433, "uuid": "f7da3972-6ae7-4a7e-a784-b584ac4cdad9", "comment": "Malware payload (Mirai)", "value": "fdb8cf4c4d0869a4df15669d3fc19d008deab4d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765649433, "uuid": "99d493ab-336b-46b1-b4e1-5ac7513f8331", "comment": "Malware payload (Mirai)", "value": "73cec8d5909347e8149b716eef07b42b0d35b00aff80587f0ed8d56064ee935a34652e4536e0fed48112cebe6722ee78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765649433, "uuid": "99deec40-4d99-4682-88c1-285f09cb28c4", "value": "T1A0135CC4A947D9F4EC1106743477E732FB7BF07A203EEA87D75AA532A841A01E60729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765649433, "uuid": "d5b3bf14-f1ae-4643-b5bc-9e6d3b8e64d0", "value": "768:/N/YuJGrtAG30iAsDYLuKFXIxAppw+K4yaZm7KO3Yg9zizNULNcwB:/hYuJgtAG30iAo/KFXIxApQf3YKzizW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765649433, "uuid": "106650c2-0f21-4721-8c1a-bd796640946f", "value": 42396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765649433, "uuid": "9221704f-acbe-4126-ae84-e4adb91dde4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765649433, "uuid": "0f228653-1462-4ac3-9bc9-414e3ced85e4", "value": "Mercury.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f983619-d7eb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765606502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606502, "uuid": "5ccb4f00-321a-455d-a85d-9a78640981c0", "comment": "Malware payload", "value": "d3e8eaeeba1c1583e0559c3780d3bd76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606502, "uuid": "96472adf-2649-442c-86e4-041175ae7df8", "comment": "Malware payload", "value": "6b406379aead59573df6d5ca0eaa05966c6df67931d1d18faf4ffcf3e7ca9c3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606502, "uuid": "8d0dc696-293f-42eb-9e54-813e71f62c3a", "comment": "Malware payload", "value": "433b71b350023f4d21f69759d498f704e644110f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606502, "uuid": "e298a105-2522-48f3-aea1-9a09294b8060", "comment": "Malware payload", "value": "3879f325767161e0c46d1e10316a997348278eca017fa2f0b8e4439e3a11c2bd60ef7f957bcee313aa336af78cad2910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606502, "uuid": "fbceaa02-3eb5-483b-8980-6af88bea52c5", "value": "T16605C43AEB62C8EDC0DB91707B8785B276F5BC260230A55B419115227F0FDA81FEE5C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606502, "uuid": "02619d51-1ffb-4630-a262-eb87c9748b9a", "value": "a221404e9affc2c5a6fbc1f7c0b29a0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606502, "uuid": "f3b204c8-1beb-46bc-874a-1d4ce60cc332", "value": "24576:P/rTWJIN1XPU4T9Tf1wHfaTAmKnJo7X1/amQE:rTWJIN1XPU4T9Tf1SfdosO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765606502, "uuid": "64f7579d-730a-4809-90fb-d736ddb6111e", "value": 819816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765606502, "uuid": "b9340731-7a7f-4ff7-bb69-526cbe757cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606502, "uuid": "1359637a-dcdd-4f97-9cbc-5086fbea64c4", "value": "6b406379aead59573df6d5ca0eaa05966c6df67931d1d18faf4ffcf3e7ca9c3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ebb97a-d851-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650454, "uuid": "404ddab5-2d40-43dd-80a0-1613b243fb66", "comment": "Malware payload (Mirai)", "value": "e8ca8f3809be30cf727ba2b8cef53622", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650454, "uuid": "c8b9e3b5-dbd5-4eea-a0ca-029dc34d843b", "comment": "Malware payload (Mirai)", "value": "6b65aeccd9fd139c8b8cce78b53c1aa1f7aef08663ef727eaae9d743afe4e4df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650454, "uuid": "f4d7768b-ce51-4009-944a-49a28fa6fb85", "comment": "Malware payload (Mirai)", "value": "88337d6cbdc4f1868f89c6f6d98838087905b7aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650454, "uuid": "c37e8561-cb61-4f70-a0fc-2d263e31ee63", "comment": "Malware payload (Mirai)", "value": "d7e7af0fcc662c4abb8c39a295fd99d57e8e3b668de644cd39a31e6a74d9a04fa64e1444c8fee3712beb6d98655c192a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650454, "uuid": "b0fd1b30-54cf-4dc9-ace8-2362dd96db25", "value": "T111046D02B71C0E17D1A30AB0363F17E083BED5E121F4BA89291F5B568676E376486FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650454, "uuid": "f149a22d-7101-43b5-a2ca-3ea5d317582b", "value": "3072:kaQCSHX0JPFMUqwpsSKvQUZ5aSj+LM+fgpz9UulJ:kTCSHYhvpsZvQUZsSj+LTYpzqulJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650454, "uuid": "ad89dc2f-b334-4b9a-b85e-90ba0eaf1d32", "value": 173932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650454, "uuid": "16aea155-81c8-43a5-b17e-de5f7e6f2395", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650454, "uuid": "ae1e1d46-607f-4685-b9b6-bbdab1224439", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d206da-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613217, "uuid": "03a90a88-76f6-4b2e-b642-03ce37f411a5", "comment": "Malware payload (Mirai)", "value": "6004e31d1ba0f516d7b5b4432df4384d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613217, "uuid": "96e0b84b-95a0-42f8-859a-6f761b92c15c", "comment": "Malware payload (Mirai)", "value": "6c48f07c95250582c608e944d49146a214b409d24b5db548eb18f030c5f2f9b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613217, "uuid": "631889d7-ce1b-4084-92dc-584b6856153a", "comment": "Malware payload (Mirai)", "value": "641363889c954e05cf084921ffc2f420605b2c05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613217, "uuid": "c0d3263d-9a74-4455-816a-7f8de6b8c46d", "comment": "Malware payload (Mirai)", "value": "b43477c51c00f8db5d953d44eab135d756cdacfdd51c8b16803cba8cfe589d28635bc583b603b7428ef6eb1c329b99bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613217, "uuid": "4971c5b9-6e5d-47d0-a4d4-6f5812b0cb9a", "value": "T1B2334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613217, "uuid": "c5dfc557-fb7f-45b4-a104-41c3d88513db", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8Tw7:ivW3jdQGqt7Y+Z+zN9cGgI6b7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613217, "uuid": "6e288b38-7bf7-4b15-84e0-f505bf5c634a", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613217, "uuid": "53b5f938-8ff3-4933-b318-9e22daf592db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613217, "uuid": "13d5b426-30a6-45e2-bd74-2f4969cc673d", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98225b0b-d7e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765603725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603725, "uuid": "f4b711df-e462-4a58-88f8-a5cbf7e38854", "comment": "Malware payload (Mirai)", "value": "754bf16a2acd4e81da9b829a5a90469f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603725, "uuid": "9cadc429-b62c-4174-827d-4f62f192da18", "comment": "Malware payload (Mirai)", "value": "6c770f78982b8da968dad8e1925ef66c00276e858d13d20635bc2ca48a0f0e67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603725, "uuid": "bec680af-0620-4aef-bfb4-89d8f02b90f0", "comment": "Malware payload (Mirai)", "value": "d1bd128e719513b534578890896c407b5da9fd00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603725, "uuid": "2375c04f-681f-4152-a540-0a9d9d61739b", "comment": "Malware payload (Mirai)", "value": "61e85cf57977cd510ec7ca4e1eba4f7056910fb8ab50775828f23473964bc29d7505dc61e084344e86c23f6ed511b113", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603725, "uuid": "9b4d4520-5565-4e75-bdbc-ae226e8e9024", "value": "T1E8F35B2378351E2BC8D0987E12E74762F1F253C925E8C55DBEB20C8EEF346902657AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603725, "uuid": "8f0dc27c-59da-490d-af25-100f8cc5a92d", "value": "3072:VOPHlwzslBV0x0IRMsFr9/DyL1cMHfi30i6VpelKa2O1xXn5ftuVdE2idRz:gPHlwzslYxDRMyr97ypHqzZETO1xidET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765603725, "uuid": "acb32f03-5585-4900-a724-b592d2187b00", "value": 165352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765603725, "uuid": "2c7b0882-d792-44ef-984a-baa772d3d1f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603725, "uuid": "e0a13cf2-1759-4311-94ea-16dbda3fa347", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d91cd4-d7e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765602166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602166, "uuid": "744a6538-a6fe-4c25-9273-92a50e3f810e", "comment": "Malware payload", "value": "633a82b76d268f348b7aee7f0758e55d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602166, "uuid": "a8708350-7b58-47bc-901a-584ce86da9a1", "comment": "Malware payload", "value": "6d2faae1a76c8482bcc849d9601455f638b836cae0599e24013c8f34e54494c3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602166, "uuid": "63643923-4a51-4ebc-94e8-e46d53891af1", "comment": "Malware payload", "value": "12b082cf9ff20d2b77bd97e5b18fb23891c1dd13", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765602166, "uuid": "0a1ffb78-c27b-450a-bd71-22585a728451", "comment": "Malware payload", "value": "171f088d565cbf255d1c3191b34e801f5a05a3731cce8edfec1b6e480ee7d2ac9348bc38f4a79efb7761afd4113d0a9a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602166, "uuid": "b945358e-56b0-49d1-9e1a-62e36e9e80b9", "value": "T1BD012DD950A1AC101480CD2B72966492B813D2C71A9B0FA8FFDD197D7B9C55DB034F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602166, "uuid": "d77929d9-33f0-4d96-9178-c6b4c8b4cb9b", "value": "12:dOXOsYxPC7JlqZ1ZUJZI4WAd9AIziMWAIz94BGEAIzq3TRGvSAIzSk8bAIzexXXj:kXCZG+1ZuZI4Wu9AImDAIx4nAIGtBAI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765602166, "uuid": "649057d7-ac61-4197-a6e9-52ad9648450b", "value": 761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765602166, "uuid": "348ff326-9c69-443a-b191-5088c101c73f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765602166, "uuid": "3f1ffeda-f284-4e10-8696-f8141400e8af", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e969c2-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615856, "uuid": "0a40496c-7598-43c4-b180-13e41e44a796", "comment": "Malware payload (Rhadamanthys)", "value": "77ed86ea9f2686df33beb7302fb5c04d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615856, "uuid": "d5513ea8-284b-446a-a82d-a9b10ea068e5", "comment": "Malware payload (Rhadamanthys)", "value": "6d4791d743e150820662fa18fe44efa31cfd47ebe90fc3c2fbacdd99b25433cc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615856, "uuid": "6995c062-058f-4bf6-bf01-90c94780e655", "comment": "Malware payload (Rhadamanthys)", "value": "8ed5513b6777d486f06f86355a9ed7b2b159d313", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615856, "uuid": "9961ebb9-6e83-4c82-9981-4e63d8673bb7", "comment": "Malware payload (Rhadamanthys)", "value": "14dc711acb00fc92098259c39bc568b677ddb6f55dd1328571f34830f1dc01ca864df41b6918a02a060ef8898eda2a91", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615856, "uuid": "fc9c9f27-208d-4d0b-9ab2-0dcd9ae13f84", "value": "T1F2A3CA1C2DA7A8B53F0D72F077439BB4974A851088ED8F55D329F7B654E123C9AA28C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615856, "uuid": "7c86389c-d9ed-4bb7-895f-f0d0ad775277", "value": "1536:GDB7eKg20C7hLkAm0/2EnCq8iEIEGvbTEqT/watLAncVk2nxVXrRNdMXlqEbrMUY:GDB7b0fQ/AB8M6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615856, "uuid": "7a952486-7600-40ed-8d56-6cefa65374e3", "value": 102697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615856, "uuid": "4b8a84e0-7a2a-4727-8f36-1a8c9840084c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615856, "uuid": "f6cdc5da-7dd4-4e0d-b640-36dad5d8c109", "value": "invoice-1637482117.pdf (23).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8126537-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615885, "uuid": "9dfb6718-ebc8-4718-af34-abfd8aac2bdb", "comment": "Malware payload (Rhadamanthys)", "value": "999483d639581883a4cb633b287dcda5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615885, "uuid": "21c268c7-154f-438e-b782-ad4d705f4672", "comment": "Malware payload (Rhadamanthys)", "value": "6d6b072f6b4f907063d06c743ff0d2fabccb77841176efdd99c92246abf96e94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615885, "uuid": "b4fd58eb-e1a9-41bb-9372-15dd08589381", "comment": "Malware payload (Rhadamanthys)", "value": "55cf64b835520f479359cdef262d55578ab58b0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615885, "uuid": "d19f1b8c-e95b-4078-9d22-6f994a47914e", "comment": "Malware payload (Rhadamanthys)", "value": "0b87f2a24fc69d5d218d7a2081dc0cf6328d183fdef2f6aa9eabe9356130a50a1d7a6adc31c2daf181489b2ae355df11", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615885, "uuid": "ca698324-7f05-4ebc-9f83-5d2495d1aff2", "value": "T143A31A559A358FF215FAFC032E7148B1F9E5DA9F8508321288567712036EBBE74B28C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615885, "uuid": "b5665cfc-fe44-4181-b31d-4198e35244a8", "value": "3072:GDB7b08PcBk05o9bk6nabsKmZ1OzFBURUB97GWmry5M0NiRk1UW/UHuYl9gMUNNa:0HPcBk05o9bk6nabsKmZ1OzFBUqB97GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615885, "uuid": "ecdf4806-5c19-46bb-85b9-86790253874e", "value": 100143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615885, "uuid": "c7b7efbc-4ca9-4bc8-9dfe-955251214544", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615885, "uuid": "8310575f-6e73-4a6b-bb0e-5c3d03a409cc", "value": "invoice-1637482117.pdf (21).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b2f4a2-d855-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765652148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652148, "uuid": "823d256f-65f7-491b-9ac7-661238969946", "comment": "Malware payload (Mirai)", "value": "859cc7bc16d3b8e96d39fbf538f07c73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652148, "uuid": "94ef127a-2b37-4e51-a576-32be6bdb85eb", "comment": "Malware payload (Mirai)", "value": "6db55fb83cf4428b29da3fe8836fbf51e949be3551b7bdd77fba56516fa25f3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652148, "uuid": "b6520155-cdf7-46cc-9499-e0c41cce0b63", "comment": "Malware payload (Mirai)", "value": "cb14cd05be3a90a7b70aa3b0235617488c432338", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652148, "uuid": "1e5db742-9c92-4060-a5ce-6f8bf242d2f1", "comment": "Malware payload (Mirai)", "value": "33fc2f144e36e69ca62fac666ff7ef12f4566b60af59214ef5f33de2257de28bbca3231f3ae5dca4c08bf68756ba217e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652148, "uuid": "d26780a7-651b-4d90-b0f6-c43db9539ead", "value": "T107B3F751B882962FC5E123BAB67E628E332177E5D3CF7116C8614B603B8592F0D63F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652148, "uuid": "20b8687f-af23-4bbc-aa80-0056c1a92611", "value": "3072:MCwyvREoAdZCxZ6+bdMz4DdOKMt2h9Uu:MNyv/AdEZbdMz4DQKMt2hqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765652148, "uuid": "87983006-8f5f-4791-b542-acdf95cb39c4", "value": 112408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765652148, "uuid": "e811d526-4786-4f43-93ee-04fcc2a28207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652148, "uuid": "066d0676-b4ca-468e-beae-021c98cde8cb", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077c3c40-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639130, "uuid": "d58f3882-e48e-4a79-9920-a2a784473b6e", "comment": "Malware payload (Mirai)", "value": "1a654bfaf9306eb8c2264f50496aabd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639130, "uuid": "17dfcb65-ed7a-4123-89a5-7ae3c36bab7d", "comment": "Malware payload (Mirai)", "value": "6f1c7b34b9ae66fb39d6923981648bdb65fac411e8c4c3f326ef48e097983fbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639130, "uuid": "f0ca27db-9f79-4d49-84b3-348268150460", "comment": "Malware payload (Mirai)", "value": "a0fc714136da2c01d0faf70aaa77be4ad4e14bda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639130, "uuid": "48c021d0-ed32-46ff-8aab-82015ccc81ce", "comment": "Malware payload (Mirai)", "value": "9d15a4c2b4b16b12ba1a4ee4c9b7ee406c0b755c3b373382eea0db246c0c373f71c06681d4f723e71db9c1b70c7afc22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639130, "uuid": "7efcf17d-c308-47b8-96de-243af0c2b53a", "value": "T12F344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639130, "uuid": "17273b78-ab70-49d8-bf96-cd9c9824b37d", "value": "6144:W8tTPADOBzabKacEK1dAnJd79LfdfM/9hWfAU:W8RACBzabKacE62Jrp0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639130, "uuid": "ecfbde47-b1fa-4924-a476-3421f8ac940f", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639130, "uuid": "e0019e73-f3c8-47e9-b414-11eb0a26e8d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639130, "uuid": "1f5f3b08-549a-4f09-b09d-4e903def718f", "value": "frost.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5141b925-d7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765612196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612196, "uuid": "cf12ae49-b3ae-4a0f-abd6-9d8a41205e06", "comment": "Malware payload", "value": "4dace31eb831167eb8adbae503651780", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612196, "uuid": "9d541e61-d43d-4d08-a1e6-125da9ed9f7f", "comment": "Malware payload", "value": "6fa83b7d71aee5de0369f74ec52d7e0e5a293fef5e6993e937fd750ecb844693", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612196, "uuid": "af5c8f4f-40a0-4ae0-8779-f8007936324d", "comment": "Malware payload", "value": "a0a8c992c19370287e11d9fcbd5399c20a23df3b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612196, "uuid": "b1b42192-5bbd-4ec6-bce3-d0cdbe9fda6c", "comment": "Malware payload", "value": "ce9d65ed7348e2669f8c644a2ad1f1b8e3a80e2d8623bdd365a1ac50bc170759a7b1ad885c96c26911fb4f21ed837d14", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612196, "uuid": "e47da77d-08b0-4596-9da0-447df8a22bc8", "value": "T1B2A1F5CDB9A133B38ED4DD19F266952FB04690D081219FB4B6CDB0FD74EBD48AA00B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612196, "uuid": "6da98316-6bc2-47c3-b9af-a5fb57d26fce", "value": "96:1xeEepe1geleZce3eHXczUb57idgi4i5i1MiNiZgi3iHX6CX1+jZ6lHXGOAWg2wr:mjw1XUZuHXczUb57idgi4i5i1MiNiOib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612196, "uuid": "33c7ff6f-8b8a-4283-80c4-1ad9e7d153b2", "value": 4856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612196, "uuid": "08664825-2f69-410a-9fb5-63339bd2b390", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612196, "uuid": "06d4784b-030a-4693-9896-a80b77abbeed", "value": "e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6a8b5d-d7eb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765606633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606633, "uuid": "35275856-d62b-4fe4-b95c-7999c92b98c9", "comment": "Malware payload (Mirai)", "value": "638b461a98732fab87768dbef6fdd1d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606633, "uuid": "25e736f0-86e9-44cf-bf28-c64397afc6f0", "comment": "Malware payload (Mirai)", "value": "70471dee380ffa4dcd2106e56023501019578e66b962e8fbb3a1da83f4d0d5f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606633, "uuid": "66862144-04e6-4824-a0b8-6e3ada5e2416", "comment": "Malware payload (Mirai)", "value": "afc043f1874eb3630cfa5ceb2105a1ad0a705669", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606633, "uuid": "dbc168ff-eb34-429a-9bd2-0642b7a4146f", "comment": "Malware payload (Mirai)", "value": "5409cd5580d46b2c3a74b12569013f49264ae208b939d19e90acf967bd6e2b3b977e9b983ba879e6a6e718acf4b019cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606633, "uuid": "396da501-89ef-44be-a405-38c3b13daa8a", "value": "T189B3D591B882466FCAE223BAB67E628D332173E5D3CF7126D8614B143A8551F0D77F90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606633, "uuid": "4790ac75-b123-4585-b5ca-35ab8e87e382", "value": "3072:C/z8AZocGGZnKTGKf6kPxCNMm0Pk8x4pftu6NU2D:CL8ALGGZn1KykPxEMm0Pk8xwNU2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765606633, "uuid": "aaf5e827-070e-4708-8247-11ff70395c3e", "value": 113200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765606633, "uuid": "c4540065-c598-4fb7-96e7-e3c24c3036c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606633, "uuid": "2d7bf33f-a52b-4020-85f7-56fb3f34a640", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c9fc2c-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615646, "uuid": "6439b482-93cb-47eb-b2c2-ffbb0b43694f", "comment": "Malware payload (Rhadamanthys)", "value": "a9aa7ec9176b5feac1d1635d9dda6a8f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615646, "uuid": "c51ac04a-9788-4616-8e75-5b891978e4e8", "comment": "Malware payload (Rhadamanthys)", "value": "71069b62e59c58288c85caa398484bcac60f796431691c24afe1ae76c9c23e7d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615646, "uuid": "f2233203-1bdb-4e84-a9a4-7d915e148a2c", "comment": "Malware payload (Rhadamanthys)", "value": "0961a9c7a2879235897462a96dd80b52653bfd46", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615646, "uuid": "b28d2f10-1acb-44d5-bb18-9cc707088ddb", "comment": "Malware payload (Rhadamanthys)", "value": "f4eddedc3666ee327ac67a58ad1353dfd9b9d980ed19d9faedba4c942fb593a845159eade9a9325a323269a2263d16fa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615646, "uuid": "7008986f-4ce4-44d7-9a96-fcb5d27d1db9", "value": "T165A33B1C9CD356BE026C23D0BAAE2FF4485A2448A9551780C446F3E2ADB5FB295437FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615646, "uuid": "97e7b5a7-67c0-46d4-aa63-54736a79abe3", "value": "3072:GDB7b0TsnsdsSsUswscsRs+s3s7szstsEsNsIsdsEsZs2sas1spsUshsJsUsgsR1:0Xsmtz3LihcoQWD2fmDapluKzSqzHRT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615646, "uuid": "6071cbfb-1438-4f82-aa24-62e879f3c845", "value": 102669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615646, "uuid": "ce0c9430-2be3-47e6-9e3e-905388ec4644", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615646, "uuid": "02e696cd-6633-46dd-ab28-32e2402d2e16", "value": "invoice-1637482117.pdf (70).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b87f52-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613329, "uuid": "de1af831-a86f-4d19-b087-a9a4b6858182", "comment": "Malware payload", "value": "877b0c513924f554e4754a36333f9c44", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613329, "uuid": "aee89328-2a14-48b3-b1ad-52e54ff176fb", "comment": "Malware payload", "value": "7145b21c8fa8ffbf9e89dc3720183772b7fbc76b12eba3e3dd68079348397e59", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613329, "uuid": "432ed187-295c-439f-856f-aba13c28150e", "comment": "Malware payload", "value": "e9182adfcbbccf2cd3b46bbae212446f4ca89447", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613329, "uuid": "3756a46c-6897-4f34-b84e-c7e073578876", "comment": "Malware payload", "value": "127c8c785b98fc614146a76c91cf2ce02cd533e3d8e0f013ecaf1fe115c7a75ff153f5edb0a9e6c32bf83c85548ac323", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613329, "uuid": "dc407442-055d-4297-8891-fc9d29fa9c74", "value": "T1B383F62EE74F0965DF55A677435B4E4909FCB33DB38100B179AC87343BAD82E4A62878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613329, "uuid": "63437b39-3d6b-49dc-9058-08aa0c60e7a8", "value": "1536:uvS7HXn7E72l45Nb7+t8F0hN72oe10bH/sRoL5M9VL+/KTdq8T228fGy7r1hOj:u6j7E72+vb7+t8FUNI1KsRQM9VL+/KTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613329, "uuid": "0fb5a309-5aed-4e88-8fd7-a0dc84cac00a", "value": 83187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613329, "uuid": "3fbffb99-ab9d-4e62-8aa7-130436dfe4fb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613329, "uuid": "3ebf89ab-a134-48b1-be9d-a08c4ffde92e", "value": "7145b21c8fa8ffbf9e89dc3720183772b7fbc76b12eba3e3dd68079348397e59.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959bb51e-d870-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765663850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663850, "uuid": "9b5874b3-31e0-4b5a-b427-f05d3967515d", "comment": "Malware payload", "value": "14e05e9ae31c588e54f24d8de5ad0c93", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663850, "uuid": "6b3d7f3c-3916-40a5-a6b3-848204d72aa8", "comment": "Malware payload", "value": "72300614a5249e1be25a69bbaf18f0905a8084f0848cef9e2f97966a904bf8dc", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663850, "uuid": "8a6a3490-a442-430c-a93d-a16c78b52838", "comment": "Malware payload", "value": "1e7f364ec3f8141deaa322def3da7a63a32852b2", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663850, "uuid": "ec1067a8-8c78-4282-abbf-12a4e7ecda36", "comment": "Malware payload", "value": "f75a413dcaa609e85659341ffc3809e6cc93de466f5d14912b78edaadb5f52e82ff5a004bf5f371ddf5ed5a88adcb55b", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663850, "uuid": "0af097d2-0dbe-4a0e-8e83-4803de8221b5", "value": "T17575235B77F83055D6F6873285F217678A7274E44F3483EF13A489B90E232C1A875B8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663850, "uuid": "465f71aa-c1c5-42ac-8885-74841de1c2a2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663850, "uuid": "edc99a30-e7df-45a9-a785-ae40121c4bb8", "value": "24576:ffyZKAfcX1ooGXuiGZXsKARxjKk+8DV01Gn+xu3C8ARWx+FK1hztvmYQ+gwd9:yZZEX5GXuL5WG4Rnf3yMEKDBvmYQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765663850, "uuid": "a1dd47a2-b545-48b4-a8bb-ff2f0cad89ce", "value": 1604720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765663850, "uuid": "bba10150-c71f-4631-885c-bc08f3cec745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663850, "uuid": "58cec44e-c416-4dd2-9379-15c92306a36a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57266ee-d81d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765628255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628255, "uuid": "a2b8b8c1-1d63-43c0-bd3d-585c37bdf529", "comment": "Malware payload", "value": "d4cbfba1c722782ed67b3260a01b18f4", "object_relation": "md5", "Tag": [ { "name": "github-com--niha0wa", "colour": "#0C2D91", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false }, { "name": "React2Shell", "colour": "#1617EE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628255, "uuid": "eb222427-9d64-4b3d-99dd-c8dc5faf8ed0", "comment": "Malware payload", "value": "726fc87aad8d22f3917920bfc4238d04895649983b23c426e6366feb338ea284", "object_relation": "sha256", "Tag": [ { "name": "github-com--niha0wa", "colour": "#0C2D91", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false }, { "name": "React2Shell", "colour": "#1617EE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628255, "uuid": "6cb1a69e-e113-488b-b374-273375013ab7", "comment": "Malware payload", "value": "23867b05faeb03da3071bd0a4d595887decc1b88", "object_relation": "sha1", "Tag": [ { "name": "github-com--niha0wa", "colour": "#0C2D91", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false }, { "name": "React2Shell", "colour": "#1617EE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628255, "uuid": "36202fec-3c33-41fe-8563-56a2c45cf643", "comment": "Malware payload", "value": "4637b95539866ab97afe3e887e62d9222e4e01ef07f4a629676261b809927ae368794e630ffe1ceeee0f872bd7132ba6", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--niha0wa", "colour": "#0C2D91", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false }, { "name": "React2Shell", "colour": "#1617EE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628255, "uuid": "74bcc113-d17a-4747-85d7-60fa455028cb", "value": "T11DD2F1200B1795B4FD566EF23CC715F22F7A952B82C384A560EC2985863F0AAC9A6D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628255, "uuid": "75dd4687-6f49-4a9f-9389-f8510e7031d1", "value": "384:sQeQyRQ929QX6cwJ46MTVmndRIiKFt/sqjUz/Hh/bag8Qn1L15D5xgzGdEaPZfXZ:sQj98imLNc5UjlbeaL1B5xgzIxke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765628255, "uuid": "d9716b1a-98f6-4bca-9a2d-180f4ade1f08", "value": 30631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765628255, "uuid": "885d80dc-04d4-4e22-b33e-555a636ae3ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628255, "uuid": "2281dedf-5665-48f7-b0dc-550e951dfd3d", "value": "react2shell.py.py.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744d86ee-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765626858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626858, "uuid": "d39a8082-4ba1-4ecc-b906-cd329163d00d", "comment": "Malware payload (Mirai)", "value": "1e002ea5cef2227872be356182d49912", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626858, "uuid": "3c1e53da-ca80-4c90-92f5-6b1775412400", "comment": "Malware payload (Mirai)", "value": "72cab4d8720f06f8378e2a95d7308b2e5a63c271f32524e1b421682f35ee0345", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626858, "uuid": "02846fb5-1503-4181-b5bb-9ecf09dec8f3", "comment": "Malware payload (Mirai)", "value": "f248b60266ba3422e1f08c1dadd9038d8f2d24bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626858, "uuid": "f374e706-a112-4247-b78a-7e0ea5dbbd3f", "comment": "Malware payload (Mirai)", "value": "2a6790f7672bba7eec36531862cc11aa491e2782c7738cdf02f6e75107683745ecc6647f293199b94cdd62404001e6ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626858, "uuid": "41912e49-b6ba-4e9b-bba5-e89defc48823", "value": "T11B231991B8C29A02C5D4637BFA5E41DC372563E8D1DF33079D222F507ADA92F0EAB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626858, "uuid": "3ed4a9f9-ad6b-4cec-b996-3de45db0ec56", "value": "768:fwrkvr2RHxgrOzQkD6LOoOK0mgkCFKkRgLNdihHrxPAcKJwTTP0OdA/h28ZL1Mht:Ckvr6RgOXmgbhHFPArJOj0wA5OOHgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765626858, "uuid": "f6c3dba0-c2a4-4616-97cf-1fb564c5bde4", "value": 47828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765626858, "uuid": "74951054-9fde-4038-bcc6-2f6547219d5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626858, "uuid": "0acc7ddf-75f0-42a8-93fa-78ad001a75ba", "value": "Mercury.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab392cec-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613206, "uuid": "2f162bb8-3b30-4b82-b24c-516ffb3fe2f9", "comment": "Malware payload (Mirai)", "value": "e6a9d7d86a9f94c64782aa6be113419d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613206, "uuid": "bfef71d2-4eec-4666-ba72-84c2eb6b33fe", "comment": "Malware payload (Mirai)", "value": "733954bd9dbf3e5946461b728762abbbf9efb6c80b4202596ab4d85a1c001d12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613206, "uuid": "43eaae43-cca1-4e18-9f33-2984e14ecbb2", "comment": "Malware payload (Mirai)", "value": "aeef597cf9ef0046ab5829b2ad1909d419522870", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613206, "uuid": "2f7bea1e-4231-4c6e-bcfd-a8de6ceb2c0b", "comment": "Malware payload (Mirai)", "value": "3a8a80119b2b66c6e4cad2ca82f8179b5dd2e1bafcd68d822960ecb28564c0b05d72e8d44e2df795a4f01a8015e12732", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613206, "uuid": "b3d9f71f-cedd-4ff9-831b-e94c6cfa3f91", "value": "T1C42309C8F443D9F9DC5A09742036FB27DBB2F6BA2329DE43D7A49523AC51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613206, "uuid": "d8215406-308a-4627-80a5-169cd16b1b16", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2iQe:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613206, "uuid": "670bc267-4006-4729-aa04-080268b75199", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613206, "uuid": "2705080e-27a1-4f1c-9f3e-a3a406160e35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613206, "uuid": "10f8718b-98de-4a02-8c50-e87193e71178", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b204be2-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615568, "uuid": "083c95cf-d913-4902-9d35-ca9cdff9291d", "comment": "Malware payload (Rhadamanthys)", "value": "5fe85deba79ae30864849ef1f2862e96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615568, "uuid": "946711c4-5c89-41a2-b260-0c1fc7d944f1", "comment": "Malware payload (Rhadamanthys)", "value": "74c5eefa6d0d9f99decf8f3576606f370cb4e6713bcb003c18e798c69c300610", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615568, "uuid": "bb7885c9-d77a-45ce-9204-bc0c06326689", "comment": "Malware payload (Rhadamanthys)", "value": "1d15bab001a88d0228747e6a668d11c62e1cc64a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615568, "uuid": "7b513156-a432-47b5-84e0-6f96d069b388", "comment": "Malware payload (Rhadamanthys)", "value": "7116b8b382313d4af20c7cd6537557e9303b2267a3d5ea2c04c40459db16d0742ef23b66232308eb2773ef4b61467717", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615568, "uuid": "570873bd-5889-4fd2-bc47-cbf3a74a3f52", "value": "T166931A49CF14EE605C8EE1E8BE8D09B1EA1DEB18E817D8025E73F37416E5D0D5689C8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615568, "uuid": "889433f8-8821-460f-9860-bd782d6eb4b0", "value": "768:GDhd0i7J4sYKgY/CMNfWdeV7yF1R12JjJMU0JNcNRHfIgQ8SUHOVGOSXwbN6BfVP:GDB7eKg20Pr/rGmNSUAAwa6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615568, "uuid": "445db8b6-4e44-480f-baab-5b5ecb0d8555", "value": 97410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615568, "uuid": "cd2a7f40-a2cc-4b3c-b3ce-e44def7f87ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615568, "uuid": "16e9e3b5-8402-49a2-ba2e-de0fec740116", "value": "invoice-1637482117.pdf (91).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5293052-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765608176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608176, "uuid": "f3560694-164d-4225-b719-e845bbaedecf", "comment": "Malware payload", "value": "8ebacffc78127cea049422c08bc6928e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608176, "uuid": "e782aa9c-f9fc-47d3-bbbb-f3a9b3b5427a", "comment": "Malware payload", "value": "75b97aca4cab0539f0bf28581736ee4e19bd0acf77fcf2fad77e625b3ce99a60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608176, "uuid": "6f3ba472-88db-407e-8a49-8edf09b18c17", "comment": "Malware payload", "value": "0006ac78812ebf98e1810aaaed49cc0d74975e9b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608176, "uuid": "08fa92ea-4895-4c05-995d-60d107e08134", "comment": "Malware payload", "value": "f1cdbfc176c0a68efcc9b11808a31f2a818fb1a2f8d6ad75218cf8648696e0f78e17a3ca72e9aaf6969121c5b314eabb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608176, "uuid": "81a3b6bd-f911-4f35-beb5-bdd3bb8621ee", "value": "T1B755E062B942C0B2E49A0030A5B9DBBB2D3D35B9072490D3F7D949796A301D3B739F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608176, "uuid": "3e38221b-2bb9-4769-b912-c8a390023a75", "value": "d15363fe7543b1a474001ec498c42e1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608176, "uuid": "c5abb4a4-26c8-4f10-98ad-4a98b3153577", "value": "24576:yD5JU5xVmm+6uzofz/jNCcF0kJLrpVIiEsXwteQelECCAYu4:OJexInRofz/jt0opVcsgteQtNAF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765608176, "uuid": "11a4b22f-5504-4e44-a0fc-c8c050f99df0", "value": 1285232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765608176, "uuid": "fc782500-a823-4a2f-9955-3edb3e963e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608176, "uuid": "651b547a-4d33-44d7-a8a2-63e3753eb5a9", "value": "75b97aca4cab0539f0bf28581736ee4e19bd0acf77fcf2fad77e625b3ce99a60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d586730-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615706, "uuid": "4504125f-693a-444d-9c7f-a3747bdecc7e", "comment": "Malware payload (Rhadamanthys)", "value": "84716ef0b22f3f6f0ba536973d469aa8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615706, "uuid": "70b88c91-0a88-46b2-8f38-5289fdaabff5", "comment": "Malware payload (Rhadamanthys)", "value": "770f8efc3e26e22ca717af9e61bedde869d701b5ecc4889f65f39a65f5669a0e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615706, "uuid": "3959accd-fc34-4cd7-ab01-91111cd3dab9", "comment": "Malware payload (Rhadamanthys)", "value": "ddae7a43cbccacb10852da35d3c369022a06953a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615706, "uuid": "0b3b2a5d-8266-41d3-9c46-c3f1336f2b79", "comment": "Malware payload (Rhadamanthys)", "value": "6f7088f014e70f1dd9f58783e4d675b488f2d520712817ea4901b6635e047c414ae3efa651cf23f0bf82c5348a6f3e9d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615706, "uuid": "e692f8cb-e2ce-4a9d-82a1-2f93f2eca095", "value": "T195A3F84F092BFAF02063B295AA785AA4F0DD8B15EF375AD6404BF730548A345A118ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615706, "uuid": "f671db22-4112-4aae-87a5-905e8012a54a", "value": "1536:GDB7eKg20UiMrJrO2U+sxaQ9iAc2BKMe6BkQWJ+aY:GDB7b0UimV1UDxaQ9O2BKMe6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615706, "uuid": "b6df8bf4-80c4-424c-ab88-b852707c345f", "value": 102695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615706, "uuid": "b5a46efd-eaad-4b91-8c2a-62a22b9a36d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615706, "uuid": "438ea93c-159b-42ef-9a3d-55c47e000398", "value": "invoice-1637482117.pdf (58).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0252d768-d7fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613352, "uuid": "2de8b71a-1d8d-49c2-bca3-068fa49b9755", "comment": "Malware payload", "value": "dc601a25a354e86d7d4e7d482635027c", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613352, "uuid": "79e39f62-5840-4f8d-b230-915e9abcc5e4", "comment": "Malware payload", "value": "7733ecaadce1d569c6cb5b7700a86927951509e08aad5bbe95308e72719246eb", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613352, "uuid": "2f9285f0-c890-4670-8cfb-202e35052a22", "comment": "Malware payload", "value": "6f3f0c051651cf500dc987ef57088463aa4e1c99", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613352, "uuid": "6042fae3-a5b5-4e6d-8c73-7bcd390d34a8", "comment": "Malware payload", "value": "6970dc7d2b5af0c15e31e5659ea68ae8f122db270a475772dcbb7aa73bec51ebba17630e873670fdb934439645bc722a", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613352, "uuid": "e4f339d2-ec10-40b7-a282-318ad968b1e2", "value": "T19B93F56DE70F0915DF55A7BB434A4A4909FCB33EB38540B139AC973437AD82E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613352, "uuid": "6c12b917-2e20-4cf3-b7e3-b1b64819b400", "value": "1536:zC+f2sr5DtU1bbjerNlcejXsdmwqE4kKJ2LwC1hMvWTItN9/pve7CYzWwbMZpxlA:zC+estDtePjZejcdmwqE4bbOhMvWc/5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613352, "uuid": "3b577e00-1124-4f8b-9a3a-5c064a35d934", "value": 90248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613352, "uuid": "e398a5e8-c169-4f01-bc8c-bafe97ce99d9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613352, "uuid": "08aad191-f7e5-4828-8706-9cfd76a83d00", "value": "7733ecaadce1d569c6cb5b7700a86927951509e08aad5bbe95308e72719246eb.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab4dbe1-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615889, "uuid": "2a8db9f5-bacf-41b1-aa64-a35ba32b7476", "comment": "Malware payload (Rhadamanthys)", "value": "79b9e62be92e35bddf8416175a64e4da", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615889, "uuid": "6ea807bd-3555-4a91-9c96-8af9a5fa05af", "comment": "Malware payload (Rhadamanthys)", "value": "7777c38d49c0a32c808119cecd3573bf0f79aacb4fd7b2c0c9401469f36df51c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615889, "uuid": "f66765f7-b9a3-4afc-9e02-7bcce326cb79", "comment": "Malware payload (Rhadamanthys)", "value": "2613020e7ea0b3728b11a61f1e6dcc56a9d1755c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615889, "uuid": "2f7df652-bf8e-45d1-923c-9bbab2f9ad6e", "comment": "Malware payload (Rhadamanthys)", "value": "956b47fd5d1edefde84aba20929527b061ec509cfce55db08e03973563e171598ae287a7aaef626b871a8e126404ff8a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615889, "uuid": "d2ca2ef6-a36b-4341-b502-1780669d26f6", "value": "T1B0A3F6BE7F18EDA972D5F76E2A519E0428A6E85B589865CC6A07F53100CCBD01CC9CCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615889, "uuid": "fe77291d-3e28-4904-a8c1-d02cb7a66940", "value": "1536:GDB7eKg20T83rRr4KsXQEPxstAEDG/W56BkQWJ+aY:GDB7b0ENn41W56BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615889, "uuid": "fe8245db-452b-4942-b79b-d848171ec1d2", "value": 101993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615889, "uuid": "9e15c6e2-1835-43e2-bfbd-2fdc13de09cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615889, "uuid": "1b7e17b0-f8fb-4bfe-ac4a-e29ff6f77261", "value": "invoice-1637482117.pdf (22).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "624885b6-d879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667630, "uuid": "a4244fca-8b86-4a26-8bf8-35552941a2a2", "comment": "Malware payload (Mirai)", "value": "51fe03cb02ab3e777a6977b728cdbf5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667630, "uuid": "3dc38676-e018-4490-9247-52c4a6a403a3", "comment": "Malware payload (Mirai)", "value": "779175f295060f791a494f20961592d6f5f4c51d3adc3739487a74649c1b344f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667630, "uuid": "1f074a07-95a3-4820-8fe2-0d35c19b729d", "comment": "Malware payload (Mirai)", "value": "ea8615a0e020a691bd8e4a948854f40fe5a4c25f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667630, "uuid": "6c1c0aec-12f1-47c1-9c3e-187dce7e366b", "comment": "Malware payload (Mirai)", "value": "0cbb2c1b3b8f4023331e37c62e411a4b1953c8aee062d764e3c46310ebd662889e31a410d3391fdfaff075a47da225e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667630, "uuid": "15f8b057-b9e9-44c0-9c7f-3d86cffd5162", "value": "T13204BE63B70B18D1CC2106F807C75BAC292714136DA7D6E3ACAE36396E774CE25163E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667630, "uuid": "74c20a88-c354-441c-9f29-93a8fbeb7f88", "value": "3072:NZzLfLKSLeezM/CvCIPndW4lEtdDbECmkJagQCLKL2l4OXub01Mizq:NZzvvngmPn2dvf7J0CLKSlIizq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667630, "uuid": "1b5ffb55-7d77-4573-8484-05247467ad6d", "value": 190180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667630, "uuid": "b6b93617-5e46-4ab3-bafb-b789568be4c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667630, "uuid": "540805bd-219c-4f57-aa83-545689b77500", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081bb06f-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607778, "uuid": "caffcd88-2dda-4925-85bd-4a8486e398eb", "comment": "Malware payload", "value": "f5e262a787387355e5242e425cec207a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607778, "uuid": "9fadf27a-f6e6-4b53-a05d-106b5ecd53ab", "comment": "Malware payload", "value": "795b18f67677b126a520b06d200c592387a5185221b62328e03a5a29c9bf9fcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607778, "uuid": "6278cc7b-2d36-4692-9691-443a812b16ed", "comment": "Malware payload", "value": "5cfe1230f45e7f06a6dfb291f6bd31c2fddbcf2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607778, "uuid": "8e91b32a-b147-4b8d-8438-7777ebed3494", "comment": "Malware payload", "value": "9d18994f42d88621e6a84725fd9d01d0529cae5701222be1faf91f255e93d60e89a93c21916a612b0e5c1e77448e8321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607778, "uuid": "601d4f23-bb4b-4f2a-bb61-29b20782786f", "value": "T18DC6339E1DDB00D6E98114F4E72BABF733F351E5498A883165C4B944B6A2FB7213F482", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607778, "uuid": "dd74b4fb-6dc0-4e46-ab73-3939a506cc3f", "value": "60ec15e026bf65a85f800463f7bec122", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607778, "uuid": "7be64d62-5167-41d2-837f-e522519087da", "value": "196608:PQz4r5UpP33EDHc2Vuov9llsb6DhYrgBEhRVB1txy+csR5e+C2zjXCpIV1BBABX2:PQ8OP33kHcOFllk6DhtGhDtxy+cjkzjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607778, "uuid": "5a569dbc-aaed-47cb-baf6-0b61e749ff8a", "value": 11996496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607778, "uuid": "412426db-d5d0-4cf1-9175-35f300c77d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607778, "uuid": "af453c0e-c7dc-4b7c-85b1-19989ab0cdac", "value": "795b18f67677b126a520b06d200c592387a5185221b62328e03a5a29c9bf9fcb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a99f79-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605217, "uuid": "9612b6d4-2889-47a4-9bbc-31643faf304a", "comment": "Malware payload", "value": "00ebcbab6a600fa21c63df4b42ff0997", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605217, "uuid": "0822545c-f35f-4d38-a95a-7d4a27f7a61c", "comment": "Malware payload", "value": "79d8554d13131d30efc149fdd4ca6e79943dbe5d0b5bb3f164db7d5a6f69b28f", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605217, "uuid": "058fe060-b79a-42c5-8d1b-92a73838a6d1", "comment": "Malware payload", "value": "38f4087c63aa715e66416e115b88beb198baef6a", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605217, "uuid": "29971168-53d4-4dab-a311-d2f2eca5a2d8", "comment": "Malware payload", "value": "81418bc1aa5c7cb21265fcfbf1c27c32b3a0311193b7834874d05f57780cd708ced8bdcfb0c42e9e98421083a479d472", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605217, "uuid": "e9b3a729-aa10-47b5-bc19-cc35c62125db", "value": "T15F843B63E3682404C3B842B5CA295358B935FB9C577003BB3B90A2FAAEF53545D1BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605217, "uuid": "183cd7d1-0800-4952-84be-7a3a96418675", "value": "3072:4FCm7qEq970hNXz9H5/AZtBSeo4fkyiGh3VUyW3uRfaRNYf66xUWxp/GJPbPjges:RS6o9XGh3VBbBl+PHdyiu/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605217, "uuid": "ffb3c665-20c6-4c3a-80dd-b81c534c70f7", "value": 389984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605217, "uuid": "60d96886-2cf0-40e5-aa6e-e2f07f4a11f2", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605217, "uuid": "d50c5904-c804-4e7b-a26e-449c0ce793cb", "value": "79d8554d13131d30efc149fdd4ca6e79943dbe5d0b5bb3f164db7d5a6f69b28f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8886e01-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666459, "uuid": "d733bfe7-8675-4d10-ba1d-37282c932de9", "comment": "Malware payload (Mirai)", "value": "3acd9c88452c6ce29e68cd7378a899e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666459, "uuid": "091f95e0-b04e-461a-aeea-bad73a7d1e2f", "comment": "Malware payload (Mirai)", "value": "79e9eccde2ccf7a41c97d05ec96a549e5ad792f7854c0dbedf5a79c7e51f8ea2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666459, "uuid": "1a0357b2-6bc6-41f6-86f3-e72cdff70193", "comment": "Malware payload (Mirai)", "value": "03e9d99401c1f200952a3a152f834fbf48742368", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666459, "uuid": "11e61233-2c89-4a37-87e1-dafb5c2b8a99", "comment": "Malware payload (Mirai)", "value": "78f6689b6ccdc0c76e40c129e8e5a55a49191bf2410eb4665907a3574156dcd96f2ff30cf1c1a1ac90ca5decd6acaad1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666459, "uuid": "51f738f7-05fc-4503-8d7c-c1d582eac879", "value": "T101933952FD818613C6D122BBFA6E428D3B2613E8D2EA7207DD215F2077C781B0D77A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666459, "uuid": "8a84cf32-fb4d-41a2-b37b-cb50f49125cd", "value": "1536:0F2k2R4FQ03ovHfcqJ5N2OIKaCZB9LQG7Do8zgOMBpU8OYuxc/XvP7:y2k2ROIkU4CRLQGXuUX8P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666459, "uuid": "8bc04e8c-58c5-4d65-9ba3-c83b3da95f0c", "value": 95864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666459, "uuid": "613d6dda-edd7-4fd3-99ae-989bc85f34d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666459, "uuid": "eca2df7b-0fc5-4e44-a8ad-52ae9963b670", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecfe071-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765627009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627009, "uuid": "c854d41c-569c-4b61-8da9-379055b89503", "comment": "Malware payload (Mirai)", "value": "0a419a2415aa640b4bbff3eb168f282b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627009, "uuid": "bb0afc9a-6d23-4619-a308-a17ca35994fb", "comment": "Malware payload (Mirai)", "value": "7a13e367161b5e3d338d7ee7853a2b89658184c4c4d1a18042d7dec4d9f49531", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627009, "uuid": "24e397f1-4c7e-4a08-8b54-891d73d7af84", "comment": "Malware payload (Mirai)", "value": "5d320ed0f78e8c44404afbbb7fb2069fb966fa9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627009, "uuid": "725c2762-8788-432f-b97f-900018aea780", "comment": "Malware payload (Mirai)", "value": "e764684454887afea6638b0faa68b3165f9607ff57070b5f51167c4364e3c699ae4fb751341b2832f0d296b61595efd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627009, "uuid": "82ecbb66-613b-42fe-9425-b7d6c1b25eed", "value": "T1FF233AD6F800AD3CF94FEABE84174A0DB621335490930B2B67B7FD935C721949E26E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627009, "uuid": "40287416-f0e6-430d-b036-810a532f8040", "value": "768:MotelDpAR/tTNYMey8UVv/yGYJdruTWe6XpxWhJT6Tozmbc8g/:M+QDiR/LXGovLYJdyTpMxWhJFzmQ82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627009, "uuid": "372ca4c9-3405-4efd-93e9-52b1a9e96b3d", "value": 47860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627009, "uuid": "f9982f37-bac9-497d-b434-814fc29bc81a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627009, "uuid": "6a0596c3-3763-449e-b7a7-4371449777bd", "value": "Mercury.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f8c6e0-d81c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765627778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627778, "uuid": "b38a240d-4d98-4993-9be9-fee97d2371fe", "comment": "Malware payload", "value": "9fe7793cc294e3716b3f9a0050bcedd6", "object_relation": "md5", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627778, "uuid": "5fb9e873-2e1f-45a1-9384-26f65b79037d", "comment": "Malware payload", "value": "7a6c08d6ab4df9eb4d67ad41ece5dd824f2d12a73ffece98546648e5d3433b84", "object_relation": "sha256", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627778, "uuid": "b9b6cf8d-16e3-456e-986b-7fef26090199", "comment": "Malware payload", "value": "559c305a595ddbc61b0c0e0a9687c89312ac6361", "object_relation": "sha1", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627778, "uuid": "9976a77f-4acb-4231-91c9-f69da5009293", "comment": "Malware payload", "value": "f41b48b46bd287a9435e733fe1a3869366ad83658f7d25ef92ab6052761c1e270158a4032ee9fce00b4ee48c5b29a13f", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627778, "uuid": "1d202baa-29c4-482d-a02d-f229fdf34939", "value": "T14545F125F8C9193AD89B04758266F1FD36F16B2103A04C87E7CA5ADD99B37842932F3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627778, "uuid": "3f1f4bdc-f11a-46da-9261-18e574f0be50", "value": "8b14bd13bfc9c07b6c8af09a21f2824e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627778, "uuid": "5f64ebfb-2f0b-4dbb-a3ba-177927190014", "value": "24576:1lpRW5+8sIOc50mxCt9BCtlUM6OsgXS42AAo9YlhxRCc7r:1FrIVBCt9BLrgXsNo9mr7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627778, "uuid": "67c275b0-e023-40db-83be-a6f2b3215040", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627778, "uuid": "b992971d-8531-489a-b051-f75a7d9c940b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627778, "uuid": "cce41ee3-5204-41f7-8797-066520d5c784", "value": "7a6c08d6ab4df9eb4d67ad41ece5dd824f2d12a73ffece98546648e5d3433b84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1da21b-d830-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765636214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765636214, "uuid": "603a2293-a866-4cc9-83a3-6b5665d4827d", "comment": "Malware payload", "value": "1a55fc085063b6e48f6ecd6867f9c139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765636214, "uuid": "a61a537f-4f6f-4b5c-9b9d-2f2280332ee6", "comment": "Malware payload", "value": "7a804c51be230074557baa34d0b53f6c0ee6e76271fceef6b96f4c7646fba934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765636214, "uuid": "b6ea8ebf-6b13-4933-b55c-d77da4e2f2ad", "comment": "Malware payload", "value": "fce06d3e352a3ff1efe89af63b371540d9c4dcbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765636214, "uuid": "4c2aa314-8def-4b87-bc7e-1ed1b9524331", "comment": "Malware payload", "value": "857da502614027728123c50c8935b0d53064214c42f8440041668d41509134c2d90ca6fc13718d10f9875d58d7d94a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765636214, "uuid": "e605b217-35e8-4228-854b-7c3b18e748ab", "value": "T116063320972440A1C76D23705811F99A5E558F3D42E6B8CEDA38BF366B395C3C9AF38D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765636214, "uuid": "62563ac7-14ff-48fd-95cc-7d4c62580a1b", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765636214, "uuid": "29907114-1f54-4bec-8b3f-0b8db9e16875", "value": "98304:d2gTf82ddMA7CvBi95sxIWIFlGSBa3dlv:dd9dP7CZi9mxIzGSBqbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765636214, "uuid": "9a2d10a8-8b1e-417c-ac49-6bdc3c4c9672", "value": 3947597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765636214, "uuid": "34a66fa1-faed-4555-b95f-0155c0a62ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765636214, "uuid": "4240926c-51f5-40fc-9434-6251bc70a135", "value": "\u70b9\u51fb\u5b89\u88c5\u7b80\u4f53\u4e2d\u6587\u8bed\u8a00\u5305.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2822b3de-d7ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765585498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585498, "uuid": "2ae81a73-404d-4da8-b90b-8a4c8aac1e30", "comment": "Malware payload (Mirai)", "value": "6f18968404f8c2e0cdcc9fe6eb455038", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585498, "uuid": "939ed5f8-22e3-49b0-92ff-b1c40ecd9fe3", "comment": "Malware payload (Mirai)", "value": "7b1c67147262e23887fda5425c97a6acbdbe2411009696ed182311b66a695af1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585498, "uuid": "626633ff-f8d7-4e57-9e44-19e726153be3", "comment": "Malware payload (Mirai)", "value": "cb7b036160eaac7bb8ebe7755989c598952946ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585498, "uuid": "679b057c-af93-4ada-adc1-150146159e0c", "comment": "Malware payload (Mirai)", "value": "6b8eaf08baa444cff0940d7cd35b006178f09cd2f391e53da254a654ca72ef927226bd0c90f1f3789a27eba891cd5a0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585498, "uuid": "0b811373-ed6d-46d8-853b-4931da85ad42", "value": "T1D7F36CC5E683C4F6EC17057110B7AB36DE73E13F202FDA82D3B99A22ED51641C61A66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585498, "uuid": "ddb27051-5de7-4094-93e1-7237eee75b21", "value": "3072:zCb5I7AAKJ9O+wmeYZC6HqKMWsNf9ZoH0iIdyrh5KK6JhIB1oprz:Gb5GtKJ9OeE6KJWHtIY/KK67prz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765585498, "uuid": "d58a2d64-b5fb-430f-a3d6-26ff2cd692c7", "value": 158216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765585498, "uuid": "5d8d3eb7-cb38-4bf4-9077-d1782a343777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585498, "uuid": "8b491f54-5bb3-4922-8263-54a88057f229", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea52c58-d7f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765611145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611145, "uuid": "884f9701-e821-4aa0-b17d-54daafb99826", "comment": "Malware payload", "value": "3a51c40c19dbb3d1fc866f6dde937b89", "object_relation": "md5", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611145, "uuid": "1b952ffe-bb98-4a13-bae3-d7db9a63a6f7", "comment": "Malware payload", "value": "7b43437d384e07803df1b885c879843e6b23725fd0dcfbe276871d22bda5bb13", "object_relation": "sha256", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611145, "uuid": "efa3c814-4b8f-4d5b-8857-8ce364ae57a5", "comment": "Malware payload", "value": "14c24d1b4454d180e2a637459265cfb3cdda7512", "object_relation": "sha1", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611145, "uuid": "015c5c39-313c-49e5-8e5a-d70c6900a73a", "comment": "Malware payload", "value": "b4229202ba3be58120f77e91c3990964db19754403561b9560e8866ae96e3ffe17bcd28d14f1fbb6f232062eb8f1a751", "object_relation": "sha3-384", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611145, "uuid": "c9640d1c-6feb-4e70-9888-302c5cb4fc8e", "value": "T138F0A38B618C46D41C1549EF949CA7D988C8D94D93621190D3F2C6A0D0C8BDCA60877E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611145, "uuid": "2a4e654b-259e-4058-aad3-35b3aa44adc8", "value": "12:lajr4sM4K6E2im6KUmB7vE2noGob1cgal:lOK6EmIw0blal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765611145, "uuid": "01252d94-bd6d-4c17-bad9-d7963211e462", "value": 446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765611145, "uuid": "af5bdc5a-c4f2-4e56-ba74-a18233a4eadd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611145, "uuid": "2b917b8d-cb88-4280-9ef7-a94164942256", "value": "7b43437d384e07803df1b885c879843e6b23725fd0dcfbe276871d22bda5bb13.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e998f0f-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666415, "uuid": "20533c1d-18b6-46e3-b288-859e4a2b023c", "comment": "Malware payload (Mirai)", "value": "750a3ac00e291c7eed8605842992add7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666415, "uuid": "55e492d1-789c-4c88-a78e-a8991d30b6a9", "comment": "Malware payload (Mirai)", "value": "7b98b9af5b0dc9e36f73b32f4d802ddceb0a0d688d6b53395b896ec087fc77a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666415, "uuid": "9eeaf826-c6cb-4acf-b27b-d2df68514844", "comment": "Malware payload (Mirai)", "value": "f17372de652355d7292eecb09a008c68107ce83f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666415, "uuid": "0f845c6a-903e-47dd-b223-3885051d5e62", "comment": "Malware payload (Mirai)", "value": "1574b6c4b0aefc303d50ccdf083b926ba6bb81d5f3ce3369052c46f330a23a96b2bf668c83d4861f849eaf337ea426c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666415, "uuid": "af9412db-a627-4858-9332-740f766bbca4", "value": "T1FA130151F8E82EE1CB74E032C9E9460A955997E49177201B5F200AFEEF831B935F84C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666415, "uuid": "6e6eee8d-6540-4bf0-a0ea-417557055e8a", "value": "768:O3CQd8Ux3RxeFCXaSE8ehrIMgiLgH6txncvMTteNwnhL/nn2Qgs3Uozw:O//3REFCXazrImLgH6txcvMTsOJ9Vzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666415, "uuid": "1deca912-7b08-45a5-b5ba-37d85301ad1f", "value": 43300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666415, "uuid": "0c07f390-9557-44f4-9ab3-825d8b9d95ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666415, "uuid": "c04bfc7e-681a-43be-9ca1-acc470fc6acf", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fa3e45-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615610, "uuid": "978dc441-1c9d-42ec-9ea1-184e5a49ef65", "comment": "Malware payload (Rhadamanthys)", "value": "aa2c50922019884d6557a0e666b19f38", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615610, "uuid": "7dd67a31-79ab-4f25-84c1-295c764b35f9", "comment": "Malware payload (Rhadamanthys)", "value": "7ba8a0a3a4dc8881cda52f9778fa572da5a44c768cffd138b4991668af7337f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615610, "uuid": "7be09433-72eb-495f-8c44-7dcdb755f076", "comment": "Malware payload (Rhadamanthys)", "value": "e6367eba7c51edd97c799d51a112e56a851f49dc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615610, "uuid": "920ec878-2f27-4a6a-8ebc-53bb780d4720", "comment": "Malware payload (Rhadamanthys)", "value": "01de0b96e4ce64cf015e9bf511d57346c20296d9c1a459aca3155c62f27a72f78eae34c4c3acc6135d8b51bc63c813f8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615610, "uuid": "2a51bd85-348c-45aa-aac0-54a8f75c8d6b", "value": "T120A32A45DD5A74FC2B40359DBBC82D9BC83DE4530A67B0A88117B2C3AEFDB8D6804667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615610, "uuid": "7d3497e0-11dd-4c2e-8668-f1d9386d07ce", "value": "1536:GDB7eKg20usr3rGe2hLAZexE6BkQWJ+aY:GDB7b0lbRcYe66BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615610, "uuid": "24cdc9c2-82fb-47cb-b020-0ce110ce4faf", "value": 99408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615610, "uuid": "8bfde41a-71d5-48d9-9736-0c00d295a966", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615610, "uuid": "15477a3e-6763-49e4-b2d6-73a87a6c2d69", "value": "invoice-1637482117.pdf (76).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437f50bd-d846-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765645674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645674, "uuid": "6d1e383c-a6de-4fb2-b762-852e8c47a72f", "comment": "Malware payload", "value": "e59d08c96d9491b4a8cf07d0957e669c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645674, "uuid": "15c5b679-0bec-43a6-98fa-2950136241a5", "comment": "Malware payload", "value": "7be46bf5d6f94592f1a62e1943b5127a9e6c664729ba509c3e286d01270f2325", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645674, "uuid": "cd0e98c4-9fd9-453e-98e3-a54b7ddfae19", "comment": "Malware payload", "value": "fee7abb1a26814098f4188b599387df811518770", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645674, "uuid": "7298f9fc-3820-4911-a5ad-cb187f09eece", "comment": "Malware payload", "value": "317c7863836e7bae284b5571d37658a8e7eb3b5e4d2a4abce5138213145fdcd6b6bcd71af13e84b512488c5bd2e68ae5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jopa", "colour": "#9FA4C6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645674, "uuid": "c6365f19-d590-4b93-af1f-88e3fbcc2760", "value": "T1BE865C93ADE84769D4AFF3399CA1614162307C44033A25D7AB9427E50E7B7C41A3BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645674, "uuid": "c490063d-6b2c-4bfc-b6df-06caaefebda7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645674, "uuid": "c9632383-53ce-4fe6-912c-776182c7351c", "value": "49152:dX8sk53zp0/8Iro9EWFkorsuvsa5NxrgalEfJs4XcjhnvHa3IGhgPYd394SYSFqt:dqZCfJs4X2hfa3IGTd394SY43tc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765645674, "uuid": "adcaa6f1-f693-455b-970e-f9537bddf62d", "value": 8334504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765645674, "uuid": "8a364381-5e79-483d-93b1-237b64ef65ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645674, "uuid": "777956c5-dcbf-400c-b742-c31d84d3e7ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86a3ce5-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615912, "uuid": "48e23a31-9bc3-49f2-b476-10dc8ef25244", "comment": "Malware payload (Rhadamanthys)", "value": "026d5f73c96d4bfa3a4ec473b563cf8d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615912, "uuid": "64b7533f-4059-4a0c-979f-900b9fef0c8c", "comment": "Malware payload (Rhadamanthys)", "value": "7cfbf1d4571667ca770a08945f28b4dfc5c484db8882d7d16bb2cf0c7043c744", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615912, "uuid": "4632063e-1512-464e-b856-1d1f1129f6e9", "comment": "Malware payload (Rhadamanthys)", "value": "2e8c25148fca5320bca6927f74ea38e037da0f0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615912, "uuid": "e1053a0e-6a04-41b4-8d8c-ee04052bde78", "comment": "Malware payload (Rhadamanthys)", "value": "6bc82fb8ec61835c2089c8591f0f39ada5fa66fdca422f7e5cbcf5a4bf90dc4ced4c500b853e7b50c84ed217f0f09e7a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615912, "uuid": "c5b6dc6c-115a-4953-b378-598aaba2c3b2", "value": "T130A30A45492F7CA947967FE16A40CEB6BD18D80382A21EF77DC7F7211440F4DA8AA0DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615912, "uuid": "95634989-20a2-4a28-8133-19299baf342b", "value": "3072:GDB7b0KqctCilKnafxQYB1TJklcBsFSuWnAWrL3oREYRdwa+g2QgX6AZqEGZQ+sW:08L+/qWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615912, "uuid": "24a6ae02-d079-47a2-9864-92e575659ab1", "value": 100076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615912, "uuid": "fe2a9b2e-8793-4410-a4e6-069d798966a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615912, "uuid": "17ab934d-5be0-4c4e-9530-269d126abde7", "value": "invoice-1637482117.pdf (10).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a7c417-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765626860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626860, "uuid": "b6b25d18-e58f-4b05-8413-219601cc3c51", "comment": "Malware payload (Mirai)", "value": "bf689932372f17907793f90b23f80888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626860, "uuid": "678b01fb-3336-4653-af90-fbd11b04e310", "comment": "Malware payload (Mirai)", "value": "7d97ed27edfab9ca8e2c729a2bf6970890561bb893cbeaace55f00e9cd4b3d2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626860, "uuid": "52c02ca6-8c5a-47ba-a883-15c3953967df", "comment": "Malware payload (Mirai)", "value": "c91201392b254aa64434f12c2496ebfd377b7ede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626860, "uuid": "82bf88e8-5e36-49e0-9c57-4fff5fae6f3f", "comment": "Malware payload (Mirai)", "value": "e0d62d86bbf995fe139c5e23285e3930fd4b857338110645271d326c5c22c84cb766916305d4d526ca635769657abb65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626860, "uuid": "4d3a99da-283d-4a60-94d3-41d99c6fef76", "value": "T192231942721C0A47D1A65EF0393F0BE093FFE99010F4F5896A4F9A568636F321586F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626860, "uuid": "b8f95999-94dc-47c9-bc46-e891cb89534a", "value": "768:y8yWQvT+P1vNc2ZSRakEbf1ir7DrqCaRa9RiV+KfL+XA5yG/:UWuCP1vCkSwi/vDaU7peaX8H/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765626860, "uuid": "69a6cc64-3982-4060-b8e4-d6d230178fbe", "value": 45988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765626860, "uuid": "ec7e633e-6986-4170-881e-31b1071e7121", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626860, "uuid": "0cebda6d-d3da-4b03-aa22-4947c8661f9b", "value": "Mercury.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141ff626-d7bf-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765587612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587612, "uuid": "9b79b02f-3c9d-4d61-8467-7f10f39972a8", "comment": "Malware payload (XWorm)", "value": "3e148182552295d2725bb68de5d5a1d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587612, "uuid": "3102402a-3e94-4eb7-97b2-6fcec89b695f", "comment": "Malware payload (XWorm)", "value": "7dae70f040b7ff11b7f3bd92f78e409d88a279a593990beafe8208a2df86d5c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587612, "uuid": "72ed50b6-7e4c-488c-980d-5e442bde6638", "comment": "Malware payload (XWorm)", "value": "67df65c0784fabe8a165904b4ed3bddc77d3af12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587612, "uuid": "7c8e3a5c-407d-41f5-b7e7-3ff7cd3e7719", "comment": "Malware payload (XWorm)", "value": "d461d031966fa6d86f37c5459b2955675e659dbf7c6a76235134a2b5a53d534935cdc76e8426c19b43da3d985e572c86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587612, "uuid": "65505542-768d-4e67-911d-bf57ae405e62", "value": "T1D5E5CF091B342524CA455B75A631D5B643022F49EC37A2AAA9CD3F4FFC31913DCA9CBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587612, "uuid": "3ab8da9d-1b7b-464d-af55-783b09186f7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587612, "uuid": "545adf9c-1038-40a5-bfe0-7efaf4930ab9", "value": "49152:F9ob10vG7y5RtMF8cr1FuplaXCG/qjD/B+Jw24lOkYPRyPS/w27iz:7oJGGWRtbcQqEd2kYkqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765587612, "uuid": "ffc458ad-fc2c-48dd-8929-53dadf4f751d", "value": 3085824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765587612, "uuid": "49da6082-e004-4706-ba6f-52289dc74e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587612, "uuid": "50b193dd-85a3-473f-b72a-acae8928775b", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531fad78-d7e9-11f0-a129-42010a9c0007", "comment": "Malware payload (Adware.Generic)", "timestamp": 1765605757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605757, "uuid": "2dafef19-5c6e-40da-ade7-5f418110f7d9", "comment": "Malware payload (Adware.Generic)", "value": "c7de7c76642924efeebb9c3e7f675520", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605757, "uuid": "3c79b25c-389e-48dc-83f7-294834a0a1ee", "comment": "Malware payload (Adware.Generic)", "value": "7df92dc03d933b839a7b7858764c625a063771ff97aee79ef05f45fd1e3c9d30", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605757, "uuid": "2fe324d2-c40b-4a27-b94d-256680daaa32", "comment": "Malware payload (Adware.Generic)", "value": "45028a4e4cf3a05049a44e9fce8676ea1697bfda", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605757, "uuid": "99b4b30d-a283-4e83-818c-5b7851a5f0d2", "comment": "Malware payload (Adware.Generic)", "value": "b402e07d7de8b08fab4052bf1f55d8a6ec1a02ca8efd4ce1b9dbb883f3e3c003bc11298bcc7d77dcdbed58432fde7ba3", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605757, "uuid": "7089ad00-7faf-4605-a869-170a43347b99", "value": "T15477333BB26C763EC29A4B7248B39240597BBB916523CC1F47F0444CDF678A11E3BA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605757, "uuid": "7100fcb7-4e25-4218-b2e0-4b3401de8dd6", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605757, "uuid": "460df476-21c6-4745-804c-8fe0812c1cd7", "value": "786432:YSykUmGjSXAz4I7u8VJyXFsUnIL1adGXjknfvnL+tqcU:YSyt9fzhYnIL0GXjkfvL4rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605757, "uuid": "37d21b54-c326-46f5-aec0-1021ad3b74da", "value": 34121246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605757, "uuid": "e128ba65-1519-4dcc-b89b-dc3d06015596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605757, "uuid": "01f0f6a9-8b3b-4d4e-b75c-42fdec6bb1d6", "value": "7df92dc03d933b839a7b7858764c625a063771ff97aee79ef05f45fd1e3c9d30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a93356-d846-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765645833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645833, "uuid": "c5e1f34a-e5b3-46f3-8e9e-43048c3c0feb", "comment": "Malware payload (Mirai)", "value": "2c308c9e0e230f395973d77881cd2f55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645833, "uuid": "da50aefd-d2fb-45dd-a095-3df7a66a120e", "comment": "Malware payload (Mirai)", "value": "7eb83c7d456fde68fa9bdcd220005320e182106161f90b8213077d3eacb0d041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645833, "uuid": "2a6af761-385b-4c2c-bf1c-910598a302c8", "comment": "Malware payload (Mirai)", "value": "ce523aadf7479153e94864124194dc2f5ccd1990", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645833, "uuid": "b61bfcb4-6bc5-4e84-ace1-e8daf9aafd9b", "comment": "Malware payload (Mirai)", "value": "3e3d0ad25983922e7f4b9b2f304d371b6d8311a9f7efadffb51669c7a35c29505e73d41244cc49380001383a0a431d85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645833, "uuid": "f34172f4-66d6-416f-8b79-9c0c94084c98", "value": "T192C33C46EA818B03C4D617B6BAEF41493323E754D3DB730689186FB43F867AE4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645833, "uuid": "408fc63b-eaef-42a5-a782-508a8310931f", "value": "3072:BTWyvCHi9VZrB3HX0RsCahOzqTrDV+IbUM/9WxGVA:syvCC9N0RsCahcqx+IYM/9YGVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765645833, "uuid": "562f7d10-0c03-478e-857f-1b7aaddbc213", "value": 119061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765645833, "uuid": "bcfed08f-1f8d-46af-b1bc-c3f7658603ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645833, "uuid": "2ef5c820-19b4-44b8-80dd-cb7a93d5c19b", "value": "Mercury.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6485b6-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615813, "uuid": "0c6fbe66-c066-4760-8926-6365d74b3328", "comment": "Malware payload (Rhadamanthys)", "value": "6378c9b3845d6b2f8983ab1ac5a2dc5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615813, "uuid": "3baee3ef-96fc-4dce-b9de-1ccf9e5dafbf", "comment": "Malware payload (Rhadamanthys)", "value": "7fb9f332564d0ea6de7d10bdc66e76d22a1533bc90458ec4016772bd99fd0568", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615813, "uuid": "4f770301-6bbc-4d21-902d-d503bab14135", "comment": "Malware payload (Rhadamanthys)", "value": "950fe4202ec1104fe9f713fcbdb4cc136cae7a79", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615813, "uuid": "a591bab7-9bcf-42eb-8271-cdcff6cfe7f6", "comment": "Malware payload (Rhadamanthys)", "value": "84b253b8cf568caf08c164ed046bcf52147bde36e1b342444fe01cba090b21907aea2bd93a57ec870fbb7bb8a59634ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615813, "uuid": "84e600be-1d65-4e29-b012-1deb267bf818", "value": "T16AA307543F7B7B66201BB8124DD0EAF4CE498B16A71DE181A10DFF2340E5FA982E45E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615813, "uuid": "81dc803f-fb86-4bbf-b384-c0fb9b766954", "value": "1536:GDB7eKg20N/Tr3r+4njTWxczJAvcZLGD6BkQWJ+aY:GDB7b0N/vbPnPWxcz+cZLGD6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615813, "uuid": "2219499f-4c5a-49cf-84e8-179bd6b0eb6a", "value": 98797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615813, "uuid": "f5b1f412-23b7-44ae-97fe-431fa408f195", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615813, "uuid": "3d746ea6-f800-4da1-acc0-3b1cd5eee5a0", "value": "invoice-1637482117.pdf (36).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dbdbb9b-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615545, "uuid": "5f15ab5d-052c-491a-af54-2ecb83bb4eb0", "comment": "Malware payload (Rhadamanthys)", "value": "470e43c3862fed93d9cea4d4b3d18589", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615545, "uuid": "2843e12c-9072-400c-b333-3a3ba6e69a23", "comment": "Malware payload (Rhadamanthys)", "value": "7fcffaf720e653db57ed593af81e90ee939e066229a46022e7501c86dca3fa77", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615545, "uuid": "c01f7512-1be7-448e-9da9-0343fd6d05de", "comment": "Malware payload (Rhadamanthys)", "value": "f4a662dbddb82683694c8fda61b769b495c8dac2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615545, "uuid": "f0258359-5285-42fc-9f60-28deeb7ff7f5", "comment": "Malware payload (Rhadamanthys)", "value": "f9f17ba3ce66259a6c931c76dbe82762b271bdfa2469c119986d1519bc507efbc1289e87d65088382a5a7f79a046776d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615545, "uuid": "45a11425-b360-4a4d-b1cf-0e32471f5e68", "value": "T1D0A30A002E43C8AD20DBB16E7F8494ECC5BA8F2F29117158D879773562C6D676F828F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615545, "uuid": "c8f4b21b-d0dd-41b2-a5de-05a5e1356209", "value": "1536:GDB7eKg20JP229aHOidVYn97Jg+yv7QHIhHLVjReG+161n7TD40NoiDFrvBafIra:GDB7b0wj3m8a06BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615545, "uuid": "54ccf5a1-c734-4575-9fdd-daeeaa47a4cf", "value": 98800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615545, "uuid": "ef4c79bb-6dfe-4771-874c-0f8ab018b65d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615545, "uuid": "b4ebfbfb-9b8c-495f-833b-0e2683ade9f1", "value": "invoice-1637482117.pdf (94).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1008d46e-d7fb-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765613375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613375, "uuid": "e681306b-9027-4961-9b3d-79cb6d4ad716", "comment": "Malware payload (XWorm)", "value": "fcfcda1a3c8ded71dc4769c63a0c2e7f", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613375, "uuid": "0ccc6edf-34d6-4fc9-bf0a-c6b8545c4b7a", "comment": "Malware payload (XWorm)", "value": "80231ef9f60026fb63d364b5371bffa592d01306da64f5af8e3cec2fd8680677", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613375, "uuid": "eae19a6c-7c7a-456b-b3ec-4ea792414874", "comment": "Malware payload (XWorm)", "value": "d7c5d2cc0faa728e395a0930666fbf7961928590", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613375, "uuid": "d4648a29-63db-48fc-b050-6be9d673dd3c", "comment": "Malware payload (XWorm)", "value": "140a644558b7bc6bf95f3f696b7bdade794f96096a0d3f41863aab49a0dbf79c0b8fcfeca7588f75220207ca990d5892", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613375, "uuid": "634e9785-c18e-4c8a-94cd-53c656616e88", "value": "T11E0608FCC2CC2681EBAB55AFC7063AB1A7FE06499B56544D40FCE5D62903BB4C327846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613375, "uuid": "7a01823f-038a-40c3-9473-0046731288b0", "value": "24576:qamna8Z8YXSEBR81r8BAfXtlXstXc0iT50ZM5BzPjHzv/XDM5YdFTDQfQDz2HU2J:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613375, "uuid": "9c302ff9-fc77-4d23-825b-6e989ef27380", "value": 3732065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613375, "uuid": "d943f3b2-9b64-4ca5-b440-bbc9fe34b120", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613375, "uuid": "6683afdd-1c21-42cb-bcf5-c41997b10263", "value": "80231ef9f60026fb63d364b5371bffa592d01306da64f5af8e3cec2fd8680677.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326b8adc-d80e-11f0-a129-42010a9c0007", "comment": "Malware payload (Sliver)", "timestamp": 1765621593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765621593, "uuid": "1a43476e-df92-4471-a317-327a91d39ee1", "comment": "Malware payload (Sliver)", "value": "1f0f95451783ff3460337e32a46a9e3c", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "pcpcat", "colour": "#CF1D55", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765621593, "uuid": "de00fe0a-41f6-44b9-8324-4978cb2fbbd9", "comment": "Malware payload (Sliver)", "value": "80729e37f797da2b5a177867306318626e52b675f44fa441c256d139e88f69df", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "pcpcat", "colour": "#CF1D55", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765621593, "uuid": "4962c265-e8d4-42fd-b1ed-f3ce43d091c8", "comment": "Malware payload (Sliver)", "value": "7b74e3d0201c6409648300e176abd0c2803ce9c6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "pcpcat", "colour": "#CF1D55", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765621593, "uuid": "4cddd5b1-ec6f-4b5d-b7d5-cf12bdd8d638", "comment": "Malware payload (Sliver)", "value": "f4a97f697fda705c2d11ae0d62204bf5eca7383c1d44c24c338353b2d8ec7653b656b90fb78e13b14e420eeab95857db", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-55182", "colour": "#999986", "exportable": true, "hide_tag": false }, { "name": "pcpcat", "colour": "#CF1D55", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "teampcp", "colour": "#E7960A", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765621593, "uuid": "4fe0e43d-0c44-4223-846d-85d92d428891", "value": "T1180264A09A70E4B67DCA1479473B1246396D704A530D31359AF26848E0FDBCF837DE3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765621593, "uuid": "f6fe0711-72d0-4e5b-a7b7-142802586ed8", "value": "192:e8GwY9+TaXeXP/gsIaV0g6ztdSzaVQqUx3gFaVuDksIDoEx1dpUvihPEMDWE+Lc:LKRztdSzaVh4gFaVuDfIx3EeWE+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765621593, "uuid": "24f5e554-fc09-4431-9429-df04241d50d0", "value": 8477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765621593, "uuid": "eeb81102-eb01-4d10-a05b-b729822df75c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765621593, "uuid": "e8569f6b-c927-466f-a2cf-e79ac3fae622", "value": "proxy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2a4023-d81c-11f0-a129-42010a9c0007", "comment": "Malware payload (AmateraStealer)", "timestamp": 1765627782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627782, "uuid": "2902f9fa-9fed-4ac5-9d66-929caa9f2a6c", "comment": "Malware payload (AmateraStealer)", "value": "2d595dee0b6f8af2710b168b6cca5e0f", "object_relation": "md5", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627782, "uuid": "7c8e5f5f-2b78-49e8-a5a7-5b7f4ed5cd67", "comment": "Malware payload (AmateraStealer)", "value": "807b0d05d54d12aaa24df4488eb877a0761b45e3aee944cd45ca5a8f6e4411be", "object_relation": "sha256", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627782, "uuid": "0c41b603-6169-4086-a5ed-35c2edc0de0c", "comment": "Malware payload (AmateraStealer)", "value": "bcfb277e4176376f07f49fd7345b87c1b574db9e", "object_relation": "sha1", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627782, "uuid": "ac7a414a-1db9-4185-a468-978c99b2cf6c", "comment": "Malware payload (AmateraStealer)", "value": "7ae5de55d891e8fc524ca549dfa367d7144d928600d9699f920607d53c4da546f8af7021a22522e7c3a75a946901ec87", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627782, "uuid": "b8b90e2e-ed6e-4a51-944a-2e3dd96c491f", "value": "T151146A10E5408935E9D600FAD2BD177E657CDA601391D2C3D3A0EDFAEA59AC12D30AEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627782, "uuid": "61da3d10-a4d5-455c-98b2-6d9f2f771783", "value": "984c01ea90b60bd6934d0bf70480b54c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627782, "uuid": "80b7d414-c0b2-4ef4-b132-69a2eb00b907", "value": "3072:G+0VNfchlr1bIuyAjnHyvA8pgSH1/ewSp+SA6nC960Bbv230p1HF/:G/ulRbeg7wSJCsobvrHF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627782, "uuid": "8ee2bb2b-d3f0-4b31-bd78-56a955de3a7a", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627782, "uuid": "b7c89413-aa32-40b4-af1e-3b30ba3cf2ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627782, "uuid": "bbfb8159-9414-468c-8ad6-a1ef85a8411a", "value": "807b0d05d54d12aaa24df4488eb877a0761b45e3aee944cd45ca5a8f6e4411be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e6f97a-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607014, "uuid": "8cfd0b54-05c9-4504-977b-3b352487df09", "comment": "Malware payload", "value": "79650e6ceb70ad1c9dd377ce925f2be1", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607014, "uuid": "f0885b75-e9d0-4415-ae8d-b2a7ae65ef7e", "comment": "Malware payload", "value": "80974a5185337b4f471cb328b84f8244dedd480bd9d108681eb2b628a70f0a78", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607014, "uuid": "3efb5cbe-a6ed-443a-b3c4-a7772ed1983e", "comment": "Malware payload", "value": "07c1fef1288cb6906b8d595e8723f75e5f8e3983", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607014, "uuid": "58389cdb-22ac-4b3e-a89b-6b101843c641", "comment": "Malware payload", "value": "ba29f988ab7cfe47dd9343cb8d1c724719b87b8081a6eb44bc23f6beff035cd5f11dd3b15b37cb30126679e4bbbf6697", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607014, "uuid": "ef9c3bd7-5c39-454a-9852-b07e240f934a", "value": "T1B641ED562AF91336E2B38E7615327330CBB7FC00ED024BDE409103884826B109E65F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607014, "uuid": "fdd1c296-cb36-4edb-9673-6c9c9f455a12", "value": "24:8SJcHmdU6AxAKBPK+/g0uzlGG6kadd79ds+u7dabsmZ:87H1ComladJ9Nu7da4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607014, "uuid": "1eb8d1f9-e751-48a2-90d8-0b325ce0d7cf", "value": 2077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607014, "uuid": "34b2eeeb-ce4f-4fa9-9f35-4a5c997b6d49", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607014, "uuid": "ad93f274-d5e8-4d84-ac39-e62520dc4ee3", "value": "80974a5185337b4f471cb328b84f8244dedd480bd9d108681eb2b628a70f0a78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c93a95-d805-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765618047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618047, "uuid": "0c4376b3-0b26-464a-8c79-4f5ab6094aa1", "comment": "Malware payload", "value": "7ebe38e1b239b350cad79f2d3ed372d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618047, "uuid": "0880232b-27a2-44b9-b183-82b73259c362", "comment": "Malware payload", "value": "813ff17da3ada8a3da4102594e4206f1f21d7950b70c97c6e57b895e5d46b920", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618047, "uuid": "e37069f6-597d-462c-84a4-418060a389f2", "comment": "Malware payload", "value": "26e87d8804fe0af7b42eca2a4c4950169c2dd063", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618047, "uuid": "8b44cd3d-7329-4935-bab8-5bda3dc71562", "comment": "Malware payload", "value": "5029ecccc03cabceb9fbb069d82a71b6bf09c875faf8ec2019bf8bf21232bc1dbeaefeefe02d517fb9a47d51f9361ffb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618047, "uuid": "e6cb94c2-e780-44cf-976b-9b6216eaa78e", "value": "T185D533D899C00AB1D91217FDD31B0E526AE35B2752422176F3CEEBD01A3B769E5F9302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618047, "uuid": "eccbb1ae-6e07-4142-9000-1a5fafa73c41", "value": "49152:GM/6zyU33rlPEvfJ5owG7d3otmY33ltES+BESEUQS+oJ5MjxorPDb:b693rlPefrG7Rotn3ltESiwUYK5MGrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765618047, "uuid": "9bc4a8b9-c15a-4a06-8bc6-273c1a868cb2", "value": 2877348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765618047, "uuid": "f571a9dd-0bb8-4c23-b2b8-80947d78af6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618047, "uuid": "353f6840-2de8-45a5-ac07-4b57d07eb350", "value": "shell", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34462d1-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613219, "uuid": "5093219f-7475-436a-9e5d-c5b85d89e69a", "comment": "Malware payload (Mirai)", "value": "54dc2847962c8c0cb3d1ed577e58c88b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613219, "uuid": "71b61744-37bf-4323-9be0-cea998e558e9", "comment": "Malware payload (Mirai)", "value": "8364030e0ce68b7b135340e178fa180e19759e47690bf1682ffdf0c626ef0881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613219, "uuid": "231b1389-1f24-48ac-99c5-815a5d567d7d", "comment": "Malware payload (Mirai)", "value": "45cfd53fc396aa82757d2a7936974eb9b2d7986b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613219, "uuid": "f91f0816-1aa6-44a6-8794-262ed8c6ca84", "comment": "Malware payload (Mirai)", "value": "d55cb7c36301ae9a8333a87303d766c5996662f299c12e24da52d2fb2ef4fbeb47313b28b965d748cf01f472d4eec22a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613219, "uuid": "1089c43c-a838-440f-bff4-41ddeed288be", "value": "T1EF230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613219, "uuid": "64c86b38-06a2-468d-8573-6737e38f4d4e", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THB:5DmKF7Gxyk8cqoHAmWurAufsG5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613219, "uuid": "9a87069d-77fb-4ebf-8d8b-41a13dd06a4e", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613219, "uuid": "62f9e255-b739-4498-b779-b89f206b57a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613219, "uuid": "c2d65a1e-53b4-40b8-bd8e-23b71381e6a5", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ae1c1a-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765607930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607930, "uuid": "8497f362-2de1-4991-bdda-0843896667bf", "comment": "Malware payload (Mirai)", "value": "fbdbbbb17b8bac5d8423791b803f2c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607930, "uuid": "c9ab1a9e-bd70-4f63-9374-beccaa3ff9b9", "comment": "Malware payload (Mirai)", "value": "839b2165be165e248ce6fc39485ef9f7f0e3f281ec13abbccdf4311d9ab3e79b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607930, "uuid": "05a7ea0a-5c26-462a-bab9-87ab560fbf8a", "comment": "Malware payload (Mirai)", "value": "60a219159e9ab8aff68c2058ecf1e5242340658d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607930, "uuid": "f16f1ddc-a167-49e6-925f-4478f913d46e", "comment": "Malware payload (Mirai)", "value": "cbc3b92e3aef0c2733adb1cd86585f2fd35a39373b52a39f34320a0815578d609e2ad083e8594adf1a87ea5fefda3741", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607930, "uuid": "9a6daa45-2cb7-477c-a289-a69c09f23cea", "value": "T16D140816BF110EFBD89FCC3B05E9270124CC581A66E97B76BA70D918B94B25F1AD3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607930, "uuid": "d7bb4e6c-9269-44ee-a6fb-e00c101f3ea7", "value": "6144:RTDerUdtzEFlq41zx7K6MX64JTuSwTu+xwNU23u:18l7USSwTWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607930, "uuid": "84ed40bf-633e-494a-b519-f31370780921", "value": 205620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607930, "uuid": "6b443cbc-7026-4269-91fd-4b1b7636fffe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607930, "uuid": "a89560f5-73d0-413f-952d-0e1e9bc38dc1", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39746a1-d7ba-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765585732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585732, "uuid": "3fde4987-25ba-4788-869a-e012bed8fd52", "comment": "Malware payload (Mirai)", "value": "21f407f0e279157440971871a6b2dd2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585732, "uuid": "31443e92-63b3-4916-becc-275734c6444e", "comment": "Malware payload (Mirai)", "value": "841c81cdd81e892d646a684ec01f3a24581d597e2855690e800ae386a2a63669", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585732, "uuid": "354ae9a8-a9ec-4063-b310-7fbe884eeb11", "comment": "Malware payload (Mirai)", "value": "1949e3d1daf2ec147ba8e0d9b302ef82d59f06c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585732, "uuid": "e26cf72d-3034-4133-a21b-4e3566cdc46d", "comment": "Malware payload (Mirai)", "value": "2637f951fef63b8cd6a89fceb6bd37693da61fee8bff16cd3cc3d4203c96cd4b0d9846080e85c2812114f6a9cd89cac5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585732, "uuid": "5b395e65-3137-4868-a455-02b15315f2d2", "value": "T19BF33A91B8824A27C6E623BAFA2E428D331663E4D3DE7117DD214F2137CA45F0D77A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585732, "uuid": "a92ef58c-8781-4b51-821b-22611c294c84", "value": "3072:1hhw1sIIFaIjdLMc7Mx+kdOePqIKvOYZGqp804Hx4pftuZNU2DL:1/pFaA+Tx+kdOePqvLGUh4HxfNU2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765585732, "uuid": "45db4493-789c-4eb1-941b-455c98a010cd", "value": 161240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765585732, "uuid": "05ef8d21-7d2c-4f99-8e7e-54b486526d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585732, "uuid": "f2e65775-e1a8-441a-ba82-e7433b6e8969", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a7a1e5-d7cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765593300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593300, "uuid": "bd780bdb-2205-474e-b661-20637dda3101", "comment": "Malware payload (Gafgyt)", "value": "3953b0d953bc8824f8dea56ab8a5c07e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593300, "uuid": "562c3c49-52ac-4f4f-8f2c-5670f9fbc439", "comment": "Malware payload (Gafgyt)", "value": "8436e9fc86edbd9ade63c6a8bf00b4ae4470cd27159417d0ff62955365f5857c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593300, "uuid": "5660f7d1-588b-4a95-8936-aa4745ed66fb", "comment": "Malware payload (Gafgyt)", "value": "a1e287887d806c38c5881280bca60674ee9e22fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593300, "uuid": "e5ab6ebf-aa7d-4e9b-bba7-e20c1e201b0f", "comment": "Malware payload (Gafgyt)", "value": "8cea2e700657b81949612930c5770e73f6e85aca905d7fdc2c02025f0f35b0348be5e24381bf9eb13fbf312b9de9d961", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593300, "uuid": "9094ccdd-a2f9-4cd7-b695-4d666dc276f6", "value": "T17911FB8B90B146715C52B913336A76047CB090A7B88B5FFEA8E9FAE644CDE647418543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593300, "uuid": "d210816a-828c-4902-9212-35219ab9212d", "value": "12:q0FnLGUMEef0FnLGo2qWYFBo0FnLR/nsdjfX0FnLKKNITqLFhNkX0FnLKVwFTcXz:vR95JosGKNIT4hNksGVwFTxGC7UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765593300, "uuid": "bc824b8c-1e81-4704-82ca-9dd87b1f1c6b", "value": 1010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765593300, "uuid": "6f612a85-aa32-4f1b-b684-296ec7e149c2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593300, "uuid": "1d625845-cb88-47ba-ae8a-d288b5e40aae", "value": "zzh.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98be8f6b-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615752, "uuid": "e9b25e50-c281-44ca-a433-a3cf0ab39eff", "comment": "Malware payload (Rhadamanthys)", "value": "c4c68faf310258759a7acd5917451f41", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615752, "uuid": "f48c8305-82ea-40ab-b43b-cc0620592f39", "comment": "Malware payload (Rhadamanthys)", "value": "843c134ba78c4acffff9f47f32fb1debc423351e2278a34116472dc690caded6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615752, "uuid": "77d8d31c-bed6-4a17-9e0f-089f6775aaa0", "comment": "Malware payload (Rhadamanthys)", "value": "d12e090f0cfc9443efbeac0514be2d18761d2f97", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615752, "uuid": "d8db14df-acd8-4633-9fcb-656251f4bb6e", "comment": "Malware payload (Rhadamanthys)", "value": "b76bfd24052f0bbc9ddc6ae191ba53396a766c893e403a56ddaeeef79d9c544b287a8be6afe1f4fc912a2144817351da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615752, "uuid": "4776e3aa-f9fb-4ad5-b2d2-6f0c86b967af", "value": "T143A30B3CA877EAD1095B2471AF9454F1D71F3B0B538571B37A4BAB98D1B8A782CB1083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615752, "uuid": "1d82c993-f30c-4e73-b17a-37d29c06b498", "value": "1536:GDB7eKg20dwtrurOZYwd2oGQ1AwdWe0H6BkQWJ+aY:GDB7b0dwV0yYE2oGQHdWe0H6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615752, "uuid": "b17473bc-b654-42db-b647-4524c98a1b6a", "value": 105339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615752, "uuid": "1b6657d6-b2d3-47bd-8332-096200030646", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615752, "uuid": "cbce5c7f-29ae-4b7d-9e1d-356745d8dee9", "value": "invoice-1637482117.pdf (46).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2fd91b-d820-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765629319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629319, "uuid": "1074b4a7-2885-4bca-a655-c19e5a783b84", "comment": "Malware payload", "value": "53285e4030d9e005d9bc81c0346544f1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629319, "uuid": "55562268-f808-4dae-a60d-4059691119ed", "comment": "Malware payload", "value": "8463b3eeebaa6f67a566f7acd9e3bb2aec73eb9130d8fdfafb56c3dc5078c004", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629319, "uuid": "3b881cb0-0389-498e-9ab4-3749f7a115d3", "comment": "Malware payload", "value": "c22dcff90a250763e97f493fb4ee847d7cdd4f84", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629319, "uuid": "09cd9454-0181-4a41-9c79-24895f206e25", "comment": "Malware payload", "value": "01ab91e38881929461ba6195dc9f8ebb6adb3c895ed4d13bfb16c5ba86655147e97ec445f71d4a541ed24493f85193ce", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629319, "uuid": "a390b9c8-2ebb-4028-b2ea-1900da0ce221", "value": "T12493625C48DF00E78A177568AB1F58129FA3A44F1A0EC620B75CC65C2FD992390FEDE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629319, "uuid": "c3114593-9503-4ab2-9286-84170a521709", "value": "768:Y5v6XI4Bhmzjzn52F3y72fFWNyCphtwWmHS4lKFmKFA4v9Ispbt+TMcw8qsbCYz8:mpD4B4v9Iox+XIuKSnrq+e9vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765629319, "uuid": "6adc2ad7-cfc9-4ab4-8839-c8f1745d83ef", "value": 89354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765629319, "uuid": "0fa007b6-fc8e-41df-9759-58702acd5d46", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629319, "uuid": "ac6a6d67-1e45-49f5-b42b-2e11453d55f5", "value": "Python2[1].hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f705bd-d828-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765633054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633054, "uuid": "843d2db3-3d12-4541-8850-c1aa692e914f", "comment": "Malware payload (Mirai)", "value": "c676a82a753c054597bebbc7aa249196", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633054, "uuid": "c377d10d-6540-4f24-a3a8-d8a3d8d84328", "comment": "Malware payload (Mirai)", "value": "8529fd55338771716cd4babdae0ca65b368d89301d1d5112cc19b6ef18fa8477", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633054, "uuid": "35997375-ac3d-44e1-9b97-4e307e8d3936", "comment": "Malware payload (Mirai)", "value": "f5868c3af81edb2ef5a337fc444a5138802222d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633054, "uuid": "cf9ed8a4-4b80-4cc6-91c4-bff1bf8717d1", "comment": "Malware payload (Mirai)", "value": "d273c3a556e97aba0b8bd28fc693a9743fe1554873ea93b10eba1006607da28786b924abe219d758d511a66dc6e681ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633054, "uuid": "9f873844-8259-47e6-a82c-4e18faa4568b", "value": "T136F35B2378351A2BC8D0987E12F74765F1F2539D25E8C56DBEB20C8EEF342502A53AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633054, "uuid": "77520f47-142b-40e9-a072-34b8d9464e01", "value": "3072:EAHlXzuz6jRTiUh/IYMmMSCQ0bR630Cs8XlKeL9CqxXn5ftuVdE2iI++:dHlXzuziRGUhgJmM9IDEYCqxidE2C+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765633054, "uuid": "a73c87eb-4b6b-422f-bb11-5963f18e86b5", "value": 165352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765633054, "uuid": "592d2ee6-11c9-4751-9abe-06fb07073ab2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633054, "uuid": "fb2f1c49-d1cf-4ea8-98a3-bc3c454bf550", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eebae89-d872-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765664698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664698, "uuid": "49ce1504-e9cb-4318-ad3d-059efbb301ca", "comment": "Malware payload (Mirai)", "value": "eecfd728c6e99f2806e399cbb401c76e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664698, "uuid": "0b61f433-e04e-460e-a3dd-79b4189a7156", "comment": "Malware payload (Mirai)", "value": "852ebfeeb6efd83ef01cd69b591e8af9db14daae14e4461b090761a77b87284b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664698, "uuid": "e71ba5a1-caa1-4083-9a73-51e4eb249db5", "comment": "Malware payload (Mirai)", "value": "cd5d4dd86b88e2062fbf646643bda72ec3dbfce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664698, "uuid": "1b001c45-a0e9-4cb5-89a0-2509c51e49da", "comment": "Malware payload (Mirai)", "value": "4344ab1349670cddb1e6c43a74ff8f7e37e9dcf7c4f3d9ecb204c1a9762d0f4b9f20046a1996f78bdff34242bf22fbdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664698, "uuid": "d216d04f-f45d-4667-80bd-79fa1dc63c59", "value": "T1E85301A5C6E747B5FEDD60BA0DF3B2172696610A9214CDA3BCC3237D64C8353923D286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664698, "uuid": "b4dd1394-b830-455c-afca-e9545a31f878", "value": "1536:pY9y2bkZv3yjS2bAkHvCjtAGrNiOuGIBTyt2kv41nouy8Hy6:L2bkZ6jRbpW5BIpBO/AtoutJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765664698, "uuid": "f6ae14d7-a6bb-4117-9bd1-0a32df6b6aaa", "value": 63836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765664698, "uuid": "1d09aaa0-6981-4507-bb9a-69b8a400871f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664698, "uuid": "65ef36a7-8bd3-468f-8e2d-8cd46942066b", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd039b3-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607008, "uuid": "15e6aa80-0f36-4951-a8c7-582270385c9a", "comment": "Malware payload", "value": "7a4defbc28e0a0caa55a29bd5e175d4a", "object_relation": "md5", "Tag": [ { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607008, "uuid": "be7633df-143a-4516-9145-5615d0f4697a", "comment": "Malware payload", "value": "85d1aeb73ed26b803e9250872df0212da4130bb0a4dccfb39ab2991b2fbef99d", "object_relation": "sha256", "Tag": [ { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607008, "uuid": "949c6f8c-fede-43ee-8947-767928d7ba55", "comment": "Malware payload", "value": "4bfaaf57209e418cfd768e7e9e44b96c89c9b5d7", "object_relation": "sha1", "Tag": [ { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607008, "uuid": "75a7f90b-00b0-4cad-a247-c0f874de4ea4", "comment": "Malware payload", "value": "60909b57772d212d59e547a3a2c0498724b9458840ea5a9d6394dc163b4e13150f586f8fa0dd334ea63afc2b5fca8014", "object_relation": "sha3-384", "Tag": [ { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607008, "uuid": "0890b815-c749-48b7-bcc7-4ed4db637ccb", "value": "T10C76335946F08703B3A592D8E4036672FA7AEF42F5F49C8A0465D3CB4A564868EFF01F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607008, "uuid": "41d67156-97cd-4412-bd51-008e97754969", "value": "196608:0NgPYToq76wep7LTPa6q7+CMD0jZ3LUSqviKGujHbTn3qtGOcWhzfg6q3oOUmdjf:0boq7HepLPa6q7lM4j5USqvDGu/Tn3qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607008, "uuid": "957975e5-6f90-4cb9-8359-e517a77cab50", "value": 7253331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607008, "uuid": "5352b691-a397-45a9-8817-39ce40732ce2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607008, "uuid": "7f002427-342a-49c7-955f-a639a76eece9", "value": "85d1aeb73ed26b803e9250872df0212da4130bb0a4dccfb39ab2991b2fbef99d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02bed72a-d81f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765628815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628815, "uuid": "2190ed41-2d06-4c11-9e72-9d9fb0f433f7", "comment": "Malware payload", "value": "9534c3c9ec549e492e899d25eba2ea90", "object_relation": "md5", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628815, "uuid": "81a2bb3b-ca35-4cdc-aeba-edf9b0fac834", "comment": "Malware payload", "value": "85dd698f27442b933aec6056cf8ff4f3d99e3eb6e90a428b8b5edcfa9ffb797e", "object_relation": "sha256", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628815, "uuid": "e5ced19c-b6a4-412b-951f-a2de576a88a6", "comment": "Malware payload", "value": "27c0f81862b834dfb822ca08c66871e2a1999539", "object_relation": "sha1", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628815, "uuid": "7645fe12-7387-421e-9d2d-1928cae218cd", "comment": "Malware payload", "value": "14ff6653eccf515bf9d04f77e76595e737bb0d906b9a5881bcb80888fbeb6ab05fc5c4f95ac654736fff79ccdba87106", "object_relation": "sha3-384", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628815, "uuid": "5515de95-a9fd-4005-8efa-cc85a371be20", "value": "T1F0510B6A65221458F48474FB20A113E8F6E6D34F2597CCCD595D48647C4D8B01F37BE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628815, "uuid": "67b9821d-2dea-49be-bf10-921102bfa381", "value": "48:9YUE0XPSvH+O7QXtz+n4ifOwWljWvagfSKQ8Y2fxtbhoQLW1WLMrGFuN0hfFjZ:XXPSveO7c8GjWt5fxtGQS1WQCjpFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765628815, "uuid": "98f8a4b0-8266-4ef0-82fb-94c46385528d", "value": 2639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765628815, "uuid": "7c7b3efb-e895-4438-a715-32ac38dbff13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628815, "uuid": "95f1a5af-93a5-4bda-bfde-de0a0faa3f20", "value": "instagram.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c20293-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667184, "uuid": "ed7d990b-e8ce-44db-8b94-75cb9fe05123", "comment": "Malware payload (Mirai)", "value": "0eaf73d5af6063f64360b58de1c810b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667184, "uuid": "7ad443e0-cfc8-4fef-a447-c3ccd392bb0b", "comment": "Malware payload (Mirai)", "value": "865e686aa2811d01816f90541e76489445153f34858ea5ac42fcaeb4d29e6542", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667184, "uuid": "d891938f-07a0-48e3-916a-4e679438e6ce", "comment": "Malware payload (Mirai)", "value": "a22135dddb8d3679bd0dbda794aa0162eb977586", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667184, "uuid": "61679213-fe9f-4ea5-bc4b-e8325b251e33", "comment": "Malware payload (Mirai)", "value": "038a3fd34da45fdf12193dfde265e801f9b04275e99a30a62e018f1d8af5138b1b977c05f3a7985130cf59edf3ab8d81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667184, "uuid": "a22d71bb-ed90-43ea-b638-fe3906199628", "value": "T1F4833A07B58281FCC48AC274175FBA3AD932B5FE1238B15B77D0EB122F99D611E19E84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667184, "uuid": "9479ffcc-787a-49de-b150-09cb996e8de5", "value": "1536:pYKXF1IskP7DbSusZqxovRp+lfOYw3194A31/0EtTbBwIOMD57yjVGs:pVLIpTDmt/vRpwfG1911/0EtvCIOMD0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667184, "uuid": "28f4826d-c7ce-4226-a523-db5be66fce1b", "value": 87424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667184, "uuid": "86718f75-b8b2-45e0-a57e-564690b04e80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667184, "uuid": "2595fe35-85bb-403d-b0be-599fbfb0fc8e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb859527-d845-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765645472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645472, "uuid": "0bfb357a-935a-4401-ae80-25fbe88caba6", "comment": "Malware payload (Mirai)", "value": "0f0c79a54fdbb309761d3eb5ee95899c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645472, "uuid": "c75fca2b-297a-4103-ad9b-b5ddb8d8eea3", "comment": "Malware payload (Mirai)", "value": "86da5c01dd038b50e4cae3fd8feda896415204a5364d0f8d92540b96bad84593", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645472, "uuid": "57131512-a8c3-4944-8fb0-e86288789c2c", "comment": "Malware payload (Mirai)", "value": "bdfd0bbfba2e7cb0cb36fc6b6e4076e6ec996085", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645472, "uuid": "cd0ca1c9-21fd-4c20-aeb7-71bd0f6986ae", "comment": "Malware payload (Mirai)", "value": "3413e5f873d06810b13c0e454335802e81f38a300bc913187417060610a5b3feb214348efe642314b0255d7b50981f61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645472, "uuid": "861f79c9-c707-447d-9538-ab24f36b6430", "value": "T1DBC33906F58180FCC58AC2341B6FB63AA936F1DD1238F2E76BD0AF123E4AE615D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645472, "uuid": "437c4d3b-9b34-471a-aed6-317a08cccf2d", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmcGHzNzQSRN6Fpjygmjc:jrguLRkHQo8SsGT74p1oB4n2pvalIBzL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765645472, "uuid": "10e7de0a-e47e-4b19-9747-bf3c0993206a", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765645472, "uuid": "2136a11f-d5f5-49d8-bf22-758a5b60f32d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645472, "uuid": "179390c6-0dc4-40a4-b319-413bc86115f6", "value": "frost.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd43c37-d807-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765618763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618763, "uuid": "e3d12852-1034-4955-a3e9-2b197eb97207", "comment": "Malware payload", "value": "11d0e2504a528e8ca04ca448736258e3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618763, "uuid": "762a3ed5-f7ed-4bf4-a681-825cff2a22fb", "comment": "Malware payload", "value": "86fc9cde275dcb6c6d6f165cf563bd42e95511c8fa5dabe9104bb8a183a397b1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618763, "uuid": "cf39286b-9aef-4497-857f-be3d7f12c10b", "comment": "Malware payload", "value": "722aabd7e527885384470f94317f466ca5934ab8", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618763, "uuid": "c77e719a-a7a4-42fd-b531-1645a064139e", "comment": "Malware payload", "value": "dd711b58441a2860a4a668f0a9406c5b0b0d35639e06b8ba7260ab676a86ceb9e6eec11d27ab4349c645f41a0d4675bd", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618763, "uuid": "9abe0a57-7d86-4a82-b901-085cc66ea55d", "value": "T1541585E61F1E1247DB8324F318103693CA4C691C63E7C0356AE6925FD24EDBC25A6EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618763, "uuid": "a51ba66a-3c24-4d1d-b91b-159d3f4e83f6", "value": "3072:jAdqZ96yGrLAzUSFe5j0Agv2hpIUBwWuzHD3ozMz3jRI+C2n3QD5TctO4e0kvcdb:jwMJPeNWUzDX0uDxMSecbuzllnZNa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765618763, "uuid": "835b2808-5a64-4ab6-8536-bfa9c3fefe04", "value": 944192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765618763, "uuid": "70c3d49f-0207-42b0-9c26-f8579bafd7ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618763, "uuid": "bb4b4abb-c215-4792-a1ec-7bb53148f08c", "value": "86fc9cde275dcb6c6d6f165cf563bd42e95511c8fa5dabe9104bb8a183a397b1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0356f8-d87e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669797, "uuid": "1ea7afde-136c-4bf0-8daa-37ac7a4cebc6", "comment": "Malware payload (Mirai)", "value": "8189ff67e862e2e666ef597e5d06ee9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669797, "uuid": "b9c42161-00f1-4b90-8370-dca0dc5355bb", "comment": "Malware payload (Mirai)", "value": "8728bebf4405e2d004aa7b2bfb6161c9963987aaf35822cdf4f851ea939bc0c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669797, "uuid": "08b28548-09b2-4a8d-ad54-ce06b295cffb", "comment": "Malware payload (Mirai)", "value": "34dfe9f448e4c1c8229fdd9619ec45bd9cad54c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669797, "uuid": "4b3ca243-75e5-4d7d-adf9-dd0a63ad13db", "comment": "Malware payload (Mirai)", "value": "e916504c86470eb1b6f563e3c2e564a444b677797e06204ca6ed304fe3b9fd32f045b351aa90fdd1ce85eb92084c2a5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669797, "uuid": "eb538fd1-0742-47db-9204-05bd8766c221", "value": "T105330781B8818A23C5D4227FFA2F428D372663B8E1EF7217DD215F15778A82F0D67652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669797, "uuid": "8971fa89-1987-44c9-9c26-e9080a96daab", "value": "768:FVUghTbQ4YILc85xnkrfIm0x2SadUdTTp4HW93WMRkmPP4JNFf72KoPnK:0gNbjxn8IsSC4mike49knK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669797, "uuid": "21733962-0f79-4b5b-aaf4-781cc754524c", "value": 51516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669797, "uuid": "7bef513e-a2e0-4181-b23a-d42f05d34db5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669797, "uuid": "d3394e1e-0097-4019-addd-8f38bccdbcec", "value": "zerarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9865d3de-d7b9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765585257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585257, "uuid": "d78725e9-4624-42c3-9f87-16aa7d70123c", "comment": "Malware payload (Mirai)", "value": "a54481c9cf26b9b5e9b14b49512e25b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585257, "uuid": "ef3db5a1-15e2-47f7-a544-8f437e8b1aef", "comment": "Malware payload (Mirai)", "value": "873590d09e7b8cee4ccd50e4625f50201005415db85c2ba34e66db0de434b289", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585257, "uuid": "3dde55e7-768e-4220-b23b-29a4426a27c9", "comment": "Malware payload (Mirai)", "value": "6bdfcfbf0291c4fe22f28e0a39e1b26883547ad2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765585257, "uuid": "2bdf2dd1-e058-4321-bbb8-5efa62d2c132", "comment": "Malware payload (Mirai)", "value": "5ff25ee4980f882d95226b3ae1e712e521921e30ca31abf979755bf39783edd78e920bea8cce4eb64bcb8b03bad50b62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585257, "uuid": "02b9d2eb-e525-47c6-a7f1-6014cac5502d", "value": "T130D39D33E4297A84C1808475B076EE794B72A09492925EFB7AE6C4B540C7CACF61F7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585257, "uuid": "2ae5f550-7679-43e9-9932-beb91d236478", "value": "3072:GTaWbquh4ItWt/lJIHmCVf4bWBFSed4C7Jx4pftuZNU2D+:GOWeTItHxf4bayC7JxfNU2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765585257, "uuid": "1b8df590-f649-4a64-a0c8-f6b482c5b964", "value": 141144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765585257, "uuid": "2ca642e9-d068-4b6e-95e7-5608aa39a6ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765585257, "uuid": "84b64ee4-fa3b-4012-98ce-bf09a88b0084", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da8a3bc-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615975, "uuid": "d95371cf-aa5c-4af8-8e9a-e09c70c89334", "comment": "Malware payload (Rhadamanthys)", "value": "f091a25d5617dc619dafc04a18f0813b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615975, "uuid": "662f38ec-837c-4d67-9e48-c9c4abd8de22", "comment": "Malware payload (Rhadamanthys)", "value": "8743265d4e5236b06f5162906aeb5c2db995625cc75abb9b7123be924a049127", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615975, "uuid": "4aca1501-04d4-4430-abb7-c47630407993", "comment": "Malware payload (Rhadamanthys)", "value": "f61d3e950b483fe04482ba6e8e06b817bd72bd11", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615975, "uuid": "4db56f31-486a-4d7b-8a4e-3f3738ba96dc", "comment": "Malware payload (Rhadamanthys)", "value": "0266bd576cd3ec5f4ed61183fb3ef9ca6eeab3c304075134b936bfe9be6a5a7d231c17f7ddc806741336612fa658bc8e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615975, "uuid": "e1c88301-c479-4fc6-8b7e-52ee9c08b9b2", "value": "T1AFA3F9877C91ECF053DC75D2A18782FDDB048994A697A3D23836A73685C533BA648CCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615975, "uuid": "890a7709-7392-4eee-bce6-72349d27cf6c", "value": "768:GDhd0i7J4sYKgY/CMNfWdxWX4PkVk3RFO1Q7uNsW+igkvnKAZSe4smndJvOFLxFY:GDB7eKg20fNrSrZ46b4Atlj6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615975, "uuid": "b9118aa2-01b0-408f-ba06-ed0ad81f8b25", "value": 102772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615975, "uuid": "55a664d1-60a6-4898-938a-cfef27330463", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615975, "uuid": "93303327-6805-4a25-b314-60b086cc9fc6", "value": "invoice-1637482117.pdf .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95210c3d-d841-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765643663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643663, "uuid": "929762c7-4cdf-4806-9c68-eece1bf2785e", "comment": "Malware payload", "value": "de44bc2da36ea4bee9cea7400ac8abf8", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643663, "uuid": "7415cec2-ae61-46a2-bb08-1281c057fe20", "comment": "Malware payload", "value": "8748bdca4da79a648c861baa16fbdb07c46fc058db89df6b46ef7ec2ca60d869", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643663, "uuid": "1b1100c8-9a19-4c02-a8aa-2cb1472b5f79", "comment": "Malware payload", "value": "c692d65d9bd71ef2829a60b807484051b270bed1", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643663, "uuid": "7016842d-149a-4722-9ed8-f5032cf3deba", "comment": "Malware payload", "value": "8aeac1d304ce71c8bad27f12750323e55e18ca5ee9de50167ef20afb9c13b7ab817ccdb8b30fd3ae1e46eee169a549d6", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ONE.file", "colour": "#35AF49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643663, "uuid": "52ab8edb-9a65-4ba2-aad1-d97265f7fa40", "value": "T1179523A7FAC4A4A5E8B5177190F306271777BC79DA64479F23A4B0348E732825C3BB06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643663, "uuid": "bf5ffc98-7487-4a30-ad8c-c68ab6519a07", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643663, "uuid": "28da8972-f021-4470-acf4-f33f5b393311", "value": "49152:qwLYE0iYSXbVZEX5GXuL5WG4Rnf3yMEKDBvmYQ:1NbbVZEEuL0G4tfCPOBvzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765643663, "uuid": "0554b41f-abbd-4cf8-b877-b4bda6a2e82d", "value": 1892864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765643663, "uuid": "122c5c8b-9183-4529-b9c6-377442e7673f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643663, "uuid": "e431f0e6-8061-468f-9a6f-f0585d2508f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aaf089b-d807-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765618735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618735, "uuid": "f45bd209-9df7-4d09-a407-4b0aed252045", "comment": "Malware payload", "value": "c419c1de2c645f0a885bd411dc81e7e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618735, "uuid": "16e9dbf3-345a-43db-b276-c3ce3b5a6b87", "comment": "Malware payload", "value": "875cae7d21269956ad6a03007bbe6d9ec9294e6dd2c0e14e7dd3768741469c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618735, "uuid": "0e00b9e3-a499-4d0e-a319-37f0b0ff1380", "comment": "Malware payload", "value": "24cbbb71b51a8317f4f3ca35e303dd8455267399", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618735, "uuid": "9aa7b482-1f1a-407f-9393-26ece05f4393", "comment": "Malware payload", "value": "b6b5da53d2c0f857e61d0ed0f4b51e1f4ea375e1957a49cd81a3d306cc32f1fab21a394e03811b989c9ba95b26b17a32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618735, "uuid": "b0bce0ef-ebe2-483e-866b-a41b151cc9bc", "value": "T1FF086B4267EA04C4F9F7DA3589E69217D673BC166F3085CF224C172A1F736E08976B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618735, "uuid": "0d5543b2-85a4-4eaa-8a5f-5a3eae88e402", "value": "e05e31a5063c852520cc6950fe83ad1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618735, "uuid": "643cd311-2ad7-4699-b2c4-cf36a3999058", "value": "393216:DTI3xpBpYeoGmZcpmjz5GZd93ULfBPLoIJBsIyNOnS0B4AycWMCY6+Y3xjtFRYVP:DYrO/sJY2ByOjR5rs3wbvEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765618735, "uuid": "d455b02a-6f91-4473-8af9-aa7aa013831c", "value": 78115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765618735, "uuid": "b1c6c7d4-f3bb-4f54-8a4d-536d537554bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618735, "uuid": "9eb8bec1-02b8-4075-b935-50b055d0ac3b", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3accda3-d822-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1765630507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630507, "uuid": "d1712f0f-f423-4a76-abcb-f77033d6f68b", "comment": "Malware payload (ValleyRAT)", "value": "80d6d61be5ac3d38f253935d57317f20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630507, "uuid": "a1b2ef9f-ad75-4184-94c3-82700c2b133d", "comment": "Malware payload (ValleyRAT)", "value": "878c8ad84959973f301a6e50d90b219567ba666da71f2a1eab4aae891f67678f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630507, "uuid": "57b04640-4418-48fd-be8f-603e15e972bf", "comment": "Malware payload (ValleyRAT)", "value": "d99e609c4bf0480c4ce0b6aced5c6fdf12d22b1a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630507, "uuid": "d18ae290-0c05-4fb9-a74f-24448a5533b0", "comment": "Malware payload (ValleyRAT)", "value": "fe5b470a633fa929b4fb83fb2d71ef02f57871aad8df82b2f01ccf60170d8c3bcc90e6db5447a6bff1ed0a0ce349821d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630507, "uuid": "d1a414f5-38f8-4ccc-8103-1436af8d43a4", "value": "T132549E00305DD9B7E38D687561299BDD29A6653F4E8CB4361306933B4690FAB8C3E72F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630507, "uuid": "9d9b2b25-d62b-4571-988a-6af1489f2295", "value": "daa978a312c19389726daeeba5c767f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630507, "uuid": "19808036-0049-4a69-a781-ef0a6d14c703", "value": "6144:u6TfCigliCGZOY1wgSPZvi5Ek7sGymOZlnAzV4/0:B7CigQHIZab7sGyJZlnAzV4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765630507, "uuid": "9afb9268-6e14-4028-8cf4-10fe1bb458f3", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765630507, "uuid": "5722603e-a8fd-4f58-91df-b179d5436b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630507, "uuid": "2c352f9c-2bdd-41b8-80b4-49efcd423abd", "value": "LetsVPN.msi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dfaddf-d7e3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765603256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603256, "uuid": "8c9d093d-ef4a-45ce-8965-9d7c9e1c4732", "comment": "Malware payload (Mirai)", "value": "399b051f393cba5a598da61dec6419c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603256, "uuid": "7b1241eb-b35d-4474-9985-7f73b0fabcf7", "comment": "Malware payload (Mirai)", "value": "87a988b28fd2dfd3c8c6bd3f13c3b61c22b5b6dec8077c68858dd5e306df4a98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603256, "uuid": "8d25cfec-43a8-4253-8821-8dda0736fb68", "comment": "Malware payload (Mirai)", "value": "2d369caf2543382f51858ae187a970b28ec81479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603256, "uuid": "ae24d5dd-2eb8-4b7c-a3a3-04a4f934f0f1", "comment": "Malware payload (Mirai)", "value": "9e2b3abb60986e7683a20d3f7c6c5174443712b13bab07cae7a3ccdf3c32212ccbe9cc98a7e448417e31b1ce47d88bc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603256, "uuid": "c9dfe3a1-7902-4a1b-b7ad-4494c368830c", "value": "T16CF36D8AF4029D7DFC06E5BB84674E19F931D3A672830B2962DBFD53BC311990D1AD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603256, "uuid": "d067d8f5-efc1-47e3-aa3a-7bc047bac5b5", "value": "3072:YilVRysc3Gr4FIFl6Xf+umkLxMgw1uIOP8I8Q7FsmBRpftyqVWWzR:rgseGr4fm8+5OPR7FsmBbVWWzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765603256, "uuid": "9b5f01d2-cd17-4397-8fee-5b677f07bd00", "value": 168660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765603256, "uuid": "0ed98c38-2dea-4a80-93c2-d169ebeb1c34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603256, "uuid": "29048084-d2c6-45b6-b8ee-a4ee5d920b3c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de1d195-d7f4-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765610526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765610526, "uuid": "761a7c31-f33b-447a-8c79-258100ac6d6a", "comment": "Malware payload (Rhadamanthys)", "value": "7038f7ee76988159ec2b88d449ed5f1a", "object_relation": "md5", "Tag": [ { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "hotelsep-blogspot-com", "colour": "#E59F69", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "potalgonabunbunsed-blogspot-com", "colour": "#18E445", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765610526, "uuid": "9d27135c-ca63-447c-9b5b-539a87a9aa82", "comment": "Malware payload (Rhadamanthys)", "value": "87d674063d15945014458eed20889b1732e0532b39b054744bfe3f27a2025771", "object_relation": "sha256", "Tag": [ { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "hotelsep-blogspot-com", "colour": "#E59F69", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "potalgonabunbunsed-blogspot-com", "colour": "#18E445", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765610526, "uuid": "a5a2a754-3bb1-45c4-80ff-bdc150302e83", "comment": "Malware payload (Rhadamanthys)", "value": "a36ea34ed0df6a7dc97b5dbd59cbd6c0b5cbc86d", "object_relation": "sha1", "Tag": [ { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "hotelsep-blogspot-com", "colour": "#E59F69", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "potalgonabunbunsed-blogspot-com", "colour": "#18E445", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765610526, "uuid": "ea697951-103a-48f6-8a6d-d22ddf0ea1e3", "comment": "Malware payload (Rhadamanthys)", "value": "9df065034c7db81f3b67a40000d6c87393f00a70c2c374998547119da44b483429684b22282e2536c5721f2cdf2b8905", "object_relation": "sha3-384", "Tag": [ { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "hotelsep-blogspot-com", "colour": "#E59F69", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "potalgonabunbunsed-blogspot-com", "colour": "#18E445", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765610526, "uuid": "51983266-d1e5-4f71-9a05-a1c3afeee07a", "value": "T123A3C695BC976DB509876383F649953AED6E060985231D30D10FFAEF8CEDB026D13A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765610526, "uuid": "11ac6fb1-9ed9-4727-962b-26b6fc2149ef", "value": "1536:GDB7eKg20peAe+eNePepeseJeMe2eae6epeteKepe8e5eCeWeXepeaeseceFeceM:GDB7b05dzEXVvDLGYplIF8C6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765610526, "uuid": "5f9dee25-ff7d-46f8-8930-82a7b1285935", "value": 98903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765610526, "uuid": "fbe07dbd-98ad-492c-b23e-18992d0d8a63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765610526, "uuid": "35c980ac-79fa-4acb-a73b-ff01f3cc185b", "value": "invoice-1637482117.pdf (100).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78ec57df-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765616128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616128, "uuid": "f0a6ce54-8a1d-44b2-b5ce-abe25c6eb6d3", "comment": "Malware payload (Mirai)", "value": "44e94d02fad1acb5dac7c0b6eb9e37e0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616128, "uuid": "7d94a80f-c9b7-4993-8155-d2617c5e8d96", "comment": "Malware payload (Mirai)", "value": "8898a5f34400ad65ccd9bfb9d3f7badac37ce47596cb62908e8b46c28941c5b4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616128, "uuid": "90f53572-131e-4379-85d3-a7182db6dc7e", "comment": "Malware payload (Mirai)", "value": "182a1da589042a357cff64168c90ceb066225f0c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616128, "uuid": "3166a382-7f38-4c93-8b06-10080347a0a2", "comment": "Malware payload (Mirai)", "value": "537a09a8c3ef3d6429137bf8c52804ffc5cc56b09a34eed74323a58777ac81d2d95f7dbdb3ffd2badafd62273d7721af", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616128, "uuid": "e0b0b7df-0d38-4c46-9d4d-7bb89a5cb494", "value": "T10D012DC8430477EBD30C8E1FB39345BE1720E2CD58072BD4B38556588685FC5B438962", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616128, "uuid": "25af88ed-aaf2-4c61-b040-df7f7ae4ccae", "value": "12:KhI5W3CtI1/TbNMYwBwBtMYtX1npLOhcMY926M0liAE/MdqlHWMYKoJi5ME3bQA:KOQyS1bbeNBTKX1npLO9gw0liAjdqlVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765616128, "uuid": "f238149f-f5ff-487e-b902-0242de67888f", "value": 705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765616128, "uuid": "5609699e-a2a4-4a74-9377-33e8ae9caeb5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616128, "uuid": "c3695e0e-d2a3-4058-973d-43a9dac9d7d0", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6b1597-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615674, "uuid": "0210bc86-26ab-4f42-8296-506a4e7bbb40", "comment": "Malware payload (Rhadamanthys)", "value": "ff14cf54ef41745c726bb890058ed095", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615674, "uuid": "e8589141-4558-4e8a-bfc7-f19de3adcf28", "comment": "Malware payload (Rhadamanthys)", "value": "88a44a0c9cc413cc3ca65fc3178ce3c960215861169bdfb3a2af143e51d88a2c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615674, "uuid": "f695b22d-8ae5-40a9-b5af-4862567459a2", "comment": "Malware payload (Rhadamanthys)", "value": "bc789640abf20cfc9d9150fe4871a9d5e8aac060", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615674, "uuid": "29fc468e-943c-4c99-83ee-e309b7de01a4", "comment": "Malware payload (Rhadamanthys)", "value": "c40c174e6807437996e734a017f3601a00f3f250e600c4666854e3eba05a4c356a94b3bfb1691fb7f0206a7ca0a60865", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615674, "uuid": "25e1209e-b07d-41d1-9bad-97328ecde3e3", "value": "T1519318109520DEA04950BEA33E651DFDDF2BFA1029A272906A0F77339075A339F695CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615674, "uuid": "f00f69e4-5036-4a76-91d1-530d2cbabe82", "value": "768:GDhd0i7J4sYKgY/CMNfWdn+OJl4rXyurKQNJH24AA1OFESLAuAAroQW+FF+Ec+0G:GDB7eKg20yrbrKQNI4AA8a6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615674, "uuid": "c84b77bb-ea3f-48e0-994b-77077b65fbfb", "value": 96067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615674, "uuid": "e4b7de0b-2584-499a-9e9d-c6c1679294cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615674, "uuid": "ee775ba3-9e5b-4a41-9b3e-3015a64fe133", "value": "invoice-1637482117.pdf (65).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622f1b5b-d877-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666770, "uuid": "8b95de10-cc9b-4d9c-9e85-0c70221fae44", "comment": "Malware payload (Mirai)", "value": "65271094634c5de67308356795acca6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666770, "uuid": "c6337597-6dc6-4a32-a0c5-d51b58daabe4", "comment": "Malware payload (Mirai)", "value": "891e5d686a3ee066391c79c5a2a91907ea0a61017d56f94274698908205cc8ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666770, "uuid": "6f1837ae-84e4-4020-9927-10fde6f733fb", "comment": "Malware payload (Mirai)", "value": "27898c4769a4a3750bab533356015a5c6d548b40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666770, "uuid": "878e9990-96d5-4fde-b851-2f15a11b95dd", "comment": "Malware payload (Mirai)", "value": "991804cfde636f245dc0b424ea5ecc9987559404d5e2e2af6df8c8f89be99d9a89a518dd766fa3d4c403ef4434fdc979", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666770, "uuid": "f0de2cf3-8906-4c26-9204-e01500f59d8f", "value": "T1DC435D4373094C13F1675DB0393F2BE297AFAA5012A4B346B91EBB8941B1E329547EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666770, "uuid": "71ea1518-c318-4e80-8a3d-ce10e6c703fc", "value": "1536:wvk+crOmaPBq6z4csPWFxRZVE/oGnv8VRKQ:wlL5syRVenvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666770, "uuid": "766957b3-31e7-4446-a6ad-aec43d4186e1", "value": 58820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666770, "uuid": "8e5565c7-c410-47bd-aa50-9f003e8baebb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666770, "uuid": "013cc971-0799-4634-b484-040621607272", "value": "nabppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af75807-d7fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613393, "uuid": "f92be2e8-c06f-4746-8b04-1998e99a9eaf", "comment": "Malware payload", "value": "3dc14e500b95410d472ec6ed1caf1c7d", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613393, "uuid": "446c92c9-b89a-4a86-90af-259e9e3e7da0", "comment": "Malware payload", "value": "8923491df5fde3200fc45101e16ffa1a4a814db01ea7d5c803842077a4bdef15", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613393, "uuid": "03143b3e-5333-4edc-897a-ac2e76c3ffe0", "comment": "Malware payload", "value": "46af5e52d1560501a1d6f5176828fca5dd6f9599", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613393, "uuid": "38e90379-b81f-4519-9ea5-1efc890e0e3f", "comment": "Malware payload", "value": "4678612e042ab8dcfe494049421e8fb2b729ef15f77c367ae8842fd8f521c9bd696d39085b6ef5b55b62b53cbd571890", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613393, "uuid": "d4acfba2-0880-4a4e-9785-0eb940e19a3f", "value": "T12533D6073D47A1A8847EC9232DFAE95DE3A01BA78557C4C037AC44A21F361EDDAD48ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613393, "uuid": "0830814b-8c14-41e7-8733-159da18a2b11", "value": "768:AggfsNh8qkg+hz4PVKtxDQxCb7FznnUbOVc4h4RoWMOKmA26EYYIMQ4m3vP:d8kx27FzngD4h4RoWMOKmA26EYYI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613393, "uuid": "782c9175-f147-499f-9815-e4d3bd8c68e8", "value": 55085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613393, "uuid": "80b88ddb-7ae4-425b-b613-6dba2d430897", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613393, "uuid": "35db3931-1ef3-4baf-97b2-f626aed7e01b", "value": "8923491df5fde3200fc45101e16ffa1a4a814db01ea7d5c803842077a4bdef15.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a26434c-d7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765609983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609983, "uuid": "bedf0f52-809d-44a3-ac2d-41de825c29b1", "comment": "Malware payload (XWorm)", "value": "700cbd58707a5f859a6b0767953aeabd", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609983, "uuid": "b9134df2-61d9-41b5-bf08-8807b71974f4", "comment": "Malware payload (XWorm)", "value": "89ba6584811ee707fc6511fa30a8837e2b116dbb69baa6b651ff733e06e85166", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609983, "uuid": "66628e09-cab9-49f1-a085-065e6a570562", "comment": "Malware payload (XWorm)", "value": "51d25cf93bdd9e394ca3409d467f3f5163931fd4", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609983, "uuid": "b493793b-a208-4ff6-8dd7-206c9e15636f", "comment": "Malware payload (XWorm)", "value": "0dabde9895d0fe637fa0b8203794a7badcd1c41923d23d9fe26510788de50c1a57c40521f0364b67a76cd7bc10c36265", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609983, "uuid": "ff9a8168-2fd6-4d87-8ea2-340b2ccbc9bc", "value": "T19FE23C4877E04312D9FE9FF02DF271095274E11B9923EF5E0CD4899A2F67AC146507EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609983, "uuid": "1db443c2-0238-453f-8906-89d3da8a4715", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609983, "uuid": "33fc5ae5-d281-4f46-a924-90c67e99cfae", "value": "768:m0dT+x9p94IvGFbO75SCVFo9jCOjhVbeV:lT+xt4I+bO75SYFo9jCOjbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765609983, "uuid": "acc41e82-1cae-4aea-8dc7-aa5e66e1309a", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765609983, "uuid": "08a1c859-1724-418e-a997-72c5be4d9fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609983, "uuid": "606496fe-aaeb-494c-8f02-c3002e779192", "value": "89ba6584811ee707fc6511fa30a8837e2b116dbb69baa6b651ff733e06e85166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfc5ccd-d87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669099, "uuid": "2a6bed02-ae80-45ba-9bea-67dd9626aeaf", "comment": "Malware payload (Mirai)", "value": "924a7113fceba76ef0c011cea0a3002a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669099, "uuid": "86df0afc-2083-4f7c-a514-4054f974b018", "comment": "Malware payload (Mirai)", "value": "8a0b5edb815f273296b39a82f72ad400c37865dfabccb3d472ae8963ba300074", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669099, "uuid": "dc5f91b2-ad52-4c5a-b9bb-a1357c32b3fa", "comment": "Malware payload (Mirai)", "value": "68006a15a5b12e4168f6eb306139e76ffe36ac31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669099, "uuid": "6e598589-e7aa-4309-86bc-72d6af4b6765", "comment": "Malware payload (Mirai)", "value": "7611168278361c778d366f11b29a34c9fc0254ffdfcabb2f5d8464effb48aeae517a9ab1991455711adc3d1dc0c63240", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669099, "uuid": "8ebeaca6-afca-4356-8a44-57a48891b984", "value": "T1C7833A07F58580FCC48AC174176FBA3AD923B1BE1238B15777D0EB122E99E216E1DE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669099, "uuid": "fb674104-e9be-4aeb-8eb6-6b0126c1deb6", "value": "1536:tLTm7waIzerzviesibxGCKDSdOFjzzsAbvUpe1/7jfnvfkccJ4qWl:VAIzgzadbCKDSU3sw8e1/7jHfkccpWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669099, "uuid": "9c1430de-f05a-49c8-9f4d-e9814a222dac", "value": 87232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669099, "uuid": "fcafad35-660e-4eb4-8b82-0e633edd3913", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669099, "uuid": "17b1b20c-3c30-4b70-b1d0-850ffa2955bd", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef260ac1-d81e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765628782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628782, "uuid": "15aa4592-8e8b-4f9d-9cde-9647c18ff2b3", "comment": "Malware payload", "value": "df15ce854fe3246fab5cd9b8941f34e5", "object_relation": "md5", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628782, "uuid": "eb45325a-5e5f-4ecd-a39d-288cb4ff7301", "comment": "Malware payload", "value": "8af73c7ba0556c2800e994eab4526b70e39b5e7ef023c1f72bd2751a49a8c7a2", "object_relation": "sha256", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628782, "uuid": "5d86cca8-6a77-4eef-b3e3-386ca4236902", "comment": "Malware payload", "value": "1a00ef16d456fcea890f39127ee9ebf5faeaa497", "object_relation": "sha1", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628782, "uuid": "f31374b5-489c-47ad-9d4f-a3477a264a70", "comment": "Malware payload", "value": "d06f58b7553655a2d5362e22d0da4e4aa577cbf3290ce02a8a31eac2e442941da6857a891110a3d8ffeac2aa640b1e7d", "object_relation": "sha3-384", "Tag": [ { "name": "spyder-osint-main", "colour": "#F5AF32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628782, "uuid": "cca74492-e4e5-4b41-9d77-c9e829e0b0bd", "value": "T1A60523DF591C0624DE592B3EF628A909BC9BE39B4444EF09DF2391A0570D17E1F78E18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628782, "uuid": "b9b493de-0769-4ef6-96b4-88d1326fa1fd", "value": "24576:f1XqMvpO9SoPgDocq+O/WeP5LeqwwrzwovbwCjk:f1XqMvpOgo4ocqleeljlwovUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765628782, "uuid": "b5a3705b-fd0f-4a7d-ba5a-eb20c3d3070a", "value": 835249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765628782, "uuid": "4748d9ca-a760-47a7-8256-4b4db866b58e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628782, "uuid": "840e703e-5696-4da0-a64b-b6560ba826ee", "value": "8af73c7ba0556c2800e994eab4526b70e39b5e7ef023c1f72bd2751a49a8c7a2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5836062b-d7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765612208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612208, "uuid": "94bd29b2-3670-44b5-a7fc-3de5c70c3ffc", "comment": "Malware payload", "value": "7d937a7242fb21acfa44594e458f9786", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612208, "uuid": "d076edcb-de71-4816-9965-5151bf6247b7", "comment": "Malware payload", "value": "8b0168bc82de4474ab817f559f3450a7caaff5daa05e327800712775c059f310", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612208, "uuid": "21008ea1-8c50-4974-9247-5c6149bd64ea", "comment": "Malware payload", "value": "09637ba05c8126ce40116fed69bc705e495acb35", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612208, "uuid": "a5abc689-5e36-4374-9868-a4ff8b451c82", "comment": "Malware payload", "value": "69f44e38812447abc6ca95fd0e7dae072dae427e908694ebb71648b1b01db61a8deb9963cd2719e914d96f544a30dafb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612208, "uuid": "cc31b805-7cf7-48fb-8bd9-e2887b757e6b", "value": "T1ACA1A0C9BAA1323389D8DD9AF61785AEB046E08082215FF476CD70FC78EBDC4DA80245", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612208, "uuid": "2db86a12-93c8-4c26-97fa-b5b77d47b361", "value": "96:1xeveoe1beEeqceyeHXn8NkCELdwIifiki1ji4iqgiOiHXwSdm1pCq6gHXd/pnJY:mWv1KjQZHXn8NkCELdwIifiki1ji4iZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612208, "uuid": "709d9498-1389-467f-9e51-3b278f6189ed", "value": 4807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612208, "uuid": "647fdcb8-7f54-481d-a63c-c50445d64bb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612208, "uuid": "be79735e-e671-4637-a717-f81c7b247dd4", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c50e53a-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667995, "uuid": "3c57f4f1-6d84-4630-8210-385c73a1fe58", "comment": "Malware payload (Mirai)", "value": "f7c21c458eeb23552a8b821a87975bef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667995, "uuid": "2a9fd13a-a056-465c-aec0-8a75d3c61c26", "comment": "Malware payload (Mirai)", "value": "8b18ef22a30a4f912885eca8825eb3c153c474472741600b338dad630e3c7927", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667995, "uuid": "b40bb018-01fc-4ec5-84eb-02f275bce064", "comment": "Malware payload (Mirai)", "value": "d97fedbf06b35dec5ffdf0388dca0253db26ac39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667995, "uuid": "c16df655-07bc-4755-a9df-abf9b4c189ba", "comment": "Malware payload (Mirai)", "value": "694155ed3712b70f3ada410bc33697b4669423824427756c0b7b8f856cefcd834dce4bd0bd23686de93c2747b5fd3cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667995, "uuid": "b5747ade-24ef-40af-a06c-e3375e19ae14", "value": "T15313F240A01E5208ED5E21F6FAAFFBAE0CA4E521D544956B9F6031B719C562B3D3C3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667995, "uuid": "513c40e8-c8f8-49a2-86f2-7571ab7b8a2b", "value": "768:Cqk+aTcf1dBGualaeocwb9iV7tLFMcybqkfaPCaF3g3/agFTnbcuyD7UHQRjA:COrfHBGuKwboMctOaPCg4Cghnouy8HyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667995, "uuid": "5a4ae870-9db5-41fa-b0c5-a97df5d80f02", "value": 41808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667995, "uuid": "d7372882-8aa4-4606-9b4d-0779c59baddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667995, "uuid": "dd9cbbf2-3f34-4c6f-88bf-fd0d37d6f602", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a9f43b-d84c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765648356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648356, "uuid": "b63776aa-50c3-4547-9776-9e1afafa4085", "comment": "Malware payload (Mirai)", "value": "aef0dccd6a447c6f7c01fc26d70296cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648356, "uuid": "ca7826af-5178-488b-9415-d387a24738aa", "comment": "Malware payload (Mirai)", "value": "8b7b0e4377e7adbf9a634ecc16df0f70c074fe41b813d86af9a7d9f73f82b5dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648356, "uuid": "5c18b77c-974d-4841-8c59-1e17b5059845", "comment": "Malware payload (Mirai)", "value": "493716f82ffa2414199fe32fab43466d3a701439", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648356, "uuid": "bba14c0f-71f2-427e-8b8d-1e3f7d25f926", "comment": "Malware payload (Mirai)", "value": "2916ded35a1155ffed9186da982fe5bc9271cb4d76d8754ac0706b6ea939da4be79bd0bd191e61c6eaf290847a5e7234", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648356, "uuid": "fdec90e1-929a-44b9-bd0a-c80844ee3129", "value": "T155045B2279351E2BC8D0987E22F74761F1F257C925A8C94EBEB20D8FEF342502553AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648356, "uuid": "941b18a2-8c94-4d6b-96c4-a923710acdf8", "value": "3072:SjArLhkLCGYGVmDDdRbBGcEb8139S58iFeC30R0o6V9ltU8r3ZktU+GV:UArLhkLCG5kDDdRNGc/1tS5rDxvUAZki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765648356, "uuid": "5d784850-8f18-4804-9d46-1e1596fa0ca0", "value": 175084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765648356, "uuid": "b47fd8b7-9edb-4396-8d01-5d96e0a93986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648356, "uuid": "6062d4e0-0c33-433a-be2b-1a2c0c75bcbe", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db88eb14-d856-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765652801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652801, "uuid": "fc46f11f-4b5d-455a-be25-8ae5bd7c960a", "comment": "Malware payload (Mirai)", "value": "cbfae7e5993850fdc84a1bc195991a83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652801, "uuid": "f29a0f77-ef05-4756-b791-0e1458969fd3", "comment": "Malware payload (Mirai)", "value": "8c481910f2385970d5fc678dc89129d57eed2643c8e3c83f2aea3436c72c1a59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652801, "uuid": "773ec010-338a-4d52-8b55-3d5cb237a731", "comment": "Malware payload (Mirai)", "value": "58c3b2fcc1a46bf4d06e68d9bc1e6814f27bc690", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765652801, "uuid": "36dc2798-ac06-4298-9c25-dfd5a9832978", "comment": "Malware payload (Mirai)", "value": "c014ed6d6735d3724f848a0ccb879107f1e0dcec47339cf61faa83236762a3ad9467b0d18e4116c41319d984a63f21ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652801, "uuid": "bc05211e-3a8a-423c-af14-f5b680263076", "value": "T1FBB31885BC82456AC9D503BEB67D168E332533E5D3CF7223C8514B657B8AA1B0C67F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652801, "uuid": "745d5e4a-b001-430a-b262-21b76d3eac62", "value": "1536:XemWVZrJVM2BMSyHytYPpH4vcq6b0ufQdS25+mVo5faa2nTatWEp7lo1npHUbkhl:XepxDbIWByQ8b07MWEp7la5Ubk9Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765652801, "uuid": "4e4b3103-15fb-483d-aa90-eac4421edf24", "value": 112524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765652801, "uuid": "65895a37-4958-4ea1-ad2d-fb040962a165", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765652801, "uuid": "dc4490e3-41dc-47b0-9149-31a68f05fe78", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c3af70-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765627013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627013, "uuid": "218c1d24-92a2-468b-94a9-103d7f3e8616", "comment": "Malware payload (Mirai)", "value": "cd21b7a2c1b22f22b9bfd575d9c9d7c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627013, "uuid": "7d069966-677a-4817-a084-0888969d0fb9", "comment": "Malware payload (Mirai)", "value": "8d6a765f173af548ec6c453870b2468e29733fe93bcd43cd1ed367a600b13a38", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627013, "uuid": "e60fbca9-5b49-4b35-a524-ad51ba8e8ea3", "comment": "Malware payload (Mirai)", "value": "3b488dce0bd3733b5fed06eae60eab73359029ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627013, "uuid": "e350bc2e-c1c7-418c-bf02-bc27bad03e21", "comment": "Malware payload (Mirai)", "value": "57056c8144daf15eef24b79154767f17398302ff458daed7dad2d0464d05004fff55ed61310ef57dca79317397169840", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627013, "uuid": "824dca74-aada-4100-8c70-366e6e1b9b71", "value": "T1E603F992B8D29F9AC5D06376BAAE119D3321A3ECD1DF3257CC245B007AC952F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627013, "uuid": "59c80c17-53ef-40a4-9ff9-e1e7d6c21984", "value": "768:31VhGI7IFxBmCiD/N0Z4IZX20m4w6rDp/2HrfRsLYDtQswTTPpC+xC/hdAxLY0mk:3R7aACXm4ARsLCtjOjp3xC5D/tLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627013, "uuid": "3673c1a6-ebce-4407-a7be-816a6961151d", "value": 40384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627013, "uuid": "d55585db-46e1-416c-bebb-c1f7f2c29794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627013, "uuid": "a6c4311d-377f-4566-8baa-0926fd476f40", "value": "Mercury.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8affbbbe-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615729, "uuid": "b031d5b5-e4e0-4022-bfa5-3f2a44df0575", "comment": "Malware payload (Rhadamanthys)", "value": "573ca0e2e6d221f4322c9c5a32d1e6e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615729, "uuid": "af9dac4d-8f22-4755-a3c0-fd84a9bdec6a", "comment": "Malware payload (Rhadamanthys)", "value": "8da7bce77ac77616b858c31cfb805dc2cfd00538c0a924b9af6bf489fdc928eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615729, "uuid": "fa79d585-1f1f-49cd-a2d3-015afde9a719", "comment": "Malware payload (Rhadamanthys)", "value": "f8cdf969909b16a339fda9fbb9e74157f2c85d70", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615729, "uuid": "f46dae23-8e91-485c-886e-fd1087700049", "comment": "Malware payload (Rhadamanthys)", "value": "45e4eaaad90716c966fdfe6a5282c90597638da354a5757a318fef4906d295c9bfb1fc99c29460274a0a26425e2cfa3c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615729, "uuid": "10b8b0bf-273c-4817-a589-596dbff564b3", "value": "T162A30C489E52A4A791FF6B937E9843F3CEF052682905504D1727BAD2B12A7D20CBD3D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615729, "uuid": "7db6608f-1409-47e7-94eb-66dc609d1cf2", "value": "768:GDhd0i7J4sYKgY/CMNfWd+xi9rJKrrXpVrXDG8d3HuMTHKAu8DqWWiSLAuAAroQD:GDB7eKg20NwrnrXDX0TAiLi6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615729, "uuid": "0c0efc2a-bd6d-40fc-ac55-08915896004a", "value": 98805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615729, "uuid": "4ef64c76-81fb-43df-97c9-f7523e53a65a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615729, "uuid": "3725da6a-377f-4c5c-be4b-cdf673ae48e4", "value": "invoice-1637482117.pdf (52).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561dfd6f-d7c1-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1765588582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765588582, "uuid": "cce07bb7-6a07-4436-9886-9c6043e4b33a", "comment": "Malware payload (AgentTesla)", "value": "faa879ae38d051863227cc76922d2aaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765588582, "uuid": "80fa477e-4347-4e0c-92fe-c4501a4eb05d", "comment": "Malware payload (AgentTesla)", "value": "8de453e90993fba024766075e3f04a39b5315d8eec1067bac49875fcb3e3127f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765588582, "uuid": "af5ec961-3b7b-4fe2-9b17-5cfdb6457c53", "comment": "Malware payload (AgentTesla)", "value": "80d40a2d01560f909bb4a5a7dd357abeba31bfde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765588582, "uuid": "3fdf7d67-7c6f-4d80-b3ac-7193c033df19", "comment": "Malware payload (AgentTesla)", "value": "6d20aa3444a7a023ca5667cd307ea82265ed6a003d8d7c5fb42f86f93294498ec08a2f8bc453bdbc3c9c68d2829298d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765588582, "uuid": "dc5086bf-820b-491e-adb5-38e3b2bd9a09", "value": "T1D2F433CFAFB0382B1A5304E2681FA2F5B25E5952D2534B3DC539B28DCA750F499188EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765588582, "uuid": "c836f2d7-909d-4cbb-9eaa-77aa8a08160b", "value": "12288:XE2J9j69+zSAgn1ILl4/bLME3ir5rIxlXFDjJ2l2REESLncxGvWaCPq:XE2J9jHSw4nMei9sXXFDIkREEqcsoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765588582, "uuid": "d3e95cab-359c-4f78-993f-16560cadbd23", "value": 731697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765588582, "uuid": "4686c84b-b0ab-4c19-b87d-4288c92218b9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765588582, "uuid": "4d4e2f9f-ee89-49dc-9b60-e8aec0afd9f9", "value": "New purchase order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9236d797-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613164, "uuid": "cdcf9401-3210-4447-92b4-316b1c404e78", "comment": "Malware payload (Mirai)", "value": "44ac4a405ebc9207cdc19a5329c08cc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613164, "uuid": "8d4b5e3f-bc15-4449-b147-6156c3856c6b", "comment": "Malware payload (Mirai)", "value": "8de7e0685f86f208dd090a55ba4c53e9d1369afec97817b28567244d89406528", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613164, "uuid": "cf15d2c2-f00b-48df-a390-a91fafe0822f", "comment": "Malware payload (Mirai)", "value": "33ce10bd05495af89d603e3b1767149fba8a304c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613164, "uuid": "bfeeef11-ca39-453c-85b5-540572f43564", "comment": "Malware payload (Mirai)", "value": "181dd47eb1de5b26502a78ab91885e71040c042e9b026e0220c5b71e3175af281d3505e604ecc0aef1652c09e67f2723", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613164, "uuid": "ff27a32d-b497-49c5-9e63-63c1238eb9d7", "value": "T185336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613164, "uuid": "bfe64836-09b7-47a2-bf32-406acd646452", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613164, "uuid": "e4e401bd-e075-4e45-852e-e0a3f776d772", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613164, "uuid": "836c938d-56ff-4f13-ab3f-4933e3e9d94b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613164, "uuid": "9b695ab9-47bd-481e-9036-616fdafc81c7", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdaff95-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615683, "uuid": "192b6b40-cacb-4bab-b025-11a2c88ebebc", "comment": "Malware payload (Rhadamanthys)", "value": "5055639a4bbf03fb49c11adccfff08dc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615683, "uuid": "a9b3ef39-ad72-4158-821c-3a680567dd9e", "comment": "Malware payload (Rhadamanthys)", "value": "8e483413382b9c02944fee2dee8b4530e3050bdaeb7ceca3f1a633b389aebbbd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615683, "uuid": "56bc3de8-c3a0-470b-ae76-4a21ef885dbc", "comment": "Malware payload (Rhadamanthys)", "value": "899f0292faf25dbc6525f44f15056fc780ae8906", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615683, "uuid": "aaec4627-1bbd-422e-9c5f-f5f4daf83a5d", "comment": "Malware payload (Rhadamanthys)", "value": "a0c78f496a04584554051ff2ae39d07de0668c2af71b996d5189ec1a231815f946457cd7d07ceda85e3d68c96264103f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615683, "uuid": "1e4d859c-4b75-4d05-963e-0c98eeef7ecd", "value": "T181A3D7096C1A9DD033F6B1057DAC2672F60B978B5836D1DD1217F71C02AC678ACB2BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615683, "uuid": "cb30a0b5-6f82-4aed-9960-7f665364332a", "value": "1536:GDB7eKg20Fd7LrvryV/gaA6Ec6BkQWJ+aY:GDB7b0FxjS4oEc6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615683, "uuid": "ad04c8da-e359-4a05-b4f7-b9e6cf02dc79", "value": 99351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615683, "uuid": "ce6f8217-2c2c-470b-9080-02ac9e7cc997", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615683, "uuid": "f18ce702-5410-4e99-a87c-545a71e53238", "value": "invoice-1637482117.pdf (61).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90aede89-d876-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765666419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666419, "uuid": "85cd541d-c96b-44de-ad41-093164f1207e", "comment": "Malware payload", "value": "b0e262be3f79b90a428f500ef70e9623", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666419, "uuid": "96cb53df-6592-4c55-8e03-a28ea37e60e6", "comment": "Malware payload", "value": "8ec000f834c9fd1d52c2d08e85a25f813594423ebb0c43c89950909a7f6eb963", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666419, "uuid": "98d610f9-4952-4da8-9aa0-c0fa061cfe46", "comment": "Malware payload", "value": "14e684cc44a28fbf36d88c93496acf878c4ae918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666419, "uuid": "bfa6baa2-9670-4dc4-bf97-758556669708", "comment": "Malware payload", "value": "1a56883c453c5c9c95b1dc01c52e5589c4b33d2c78d6e0f10de82bc76388cbb99349f16a7074015ebe9eda3ecde100f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666419, "uuid": "723125ba-43ac-42c2-ab1a-7a6f857f21f5", "value": "T19C43F786B851CA56C5C5917BFE4F82DC372A13A8D1EE73039E14AF653A4B82F0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666419, "uuid": "f13d575a-3c52-43f1-a316-eb821caf91f8", "value": "768:6Y4EoCke1WYQ3KMCkTH0nzeNEbGaBnkqo5yvbYntYlk2NdE0vunv8VRW8:zo0AYhkTH0nPbZOUBtk0vunv8VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666419, "uuid": "1d891c69-d53e-4979-ba58-c60078cddb52", "value": 60112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666419, "uuid": "d7f355eb-37f8-49cf-a343-f03f3784059a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666419, "uuid": "fa02664f-b66e-497d-a999-eb33f3152659", "value": "nabarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2a8ce2-d7f2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765609557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609557, "uuid": "e1b3e744-33eb-40c9-8bd6-7ecc1508250a", "comment": "Malware payload (Mirai)", "value": "26507848d319920b63babae8f83c8777", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609557, "uuid": "a7196738-ba2c-4bec-a5a1-838a110ab443", "comment": "Malware payload (Mirai)", "value": "8f26fdf48f9e5c9c314ca6b14cb3dc0fc5f5ee92f1eb53739a28e18b494b61c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609557, "uuid": "3dc2dbf6-9fe1-402d-bfdb-d48b436480ee", "comment": "Malware payload (Mirai)", "value": "ae3e7e16672d987df6a922b37cdde4df5997c3d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609557, "uuid": "6a6e043c-05e6-4db3-944e-71f814de37b0", "comment": "Malware payload (Mirai)", "value": "613e2dd2a69cb874003ce16846347f6af85c999bc83e77ef959ec4eecb81fe69002991b2b480252074a05d4080fdbdea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609557, "uuid": "dec3a72f-9e84-4aea-b3dc-d1f9b8982bbb", "value": "T1B7B31882B882456ECAD103BEB57D12CE336573E5D3CE7213D8514B617A8AA1F0C67F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609557, "uuid": "46e8d546-d1c7-4e33-8994-85d840831f13", "value": "1536:xgen0I8rl70Y1Da34KF+nT3l5VeRYCDwH1856bgyqdsl4nH4AtKUTRK2IQmy9KQO:xyll1sRSEyqdsl4VKUdx4pftu6NU2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765609557, "uuid": "8133cb92-d748-4835-9113-f1b20e147799", "value": 112260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765609557, "uuid": "27c96e5c-19c9-49ce-9a1a-006bb161fa9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609557, "uuid": "e34c1e45-b880-47f5-b35a-f7c5c5a1cd5b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1810a674-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615965, "uuid": "9c8c8b93-5c2d-4088-b0a5-0031c55ededb", "comment": "Malware payload (Rhadamanthys)", "value": "ec3176d42b698a5d6a6bdd284c5dd1c9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615965, "uuid": "0753d7ba-aa2f-4605-bcad-26332ae1a491", "comment": "Malware payload (Rhadamanthys)", "value": "8f382b037453011efc30ee268b3d92192a3c5026693284f2dfdb06c8544a21ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615965, "uuid": "ee6dcc03-6131-4340-ae70-88e2775a18cb", "comment": "Malware payload (Rhadamanthys)", "value": "9ba69aa5f46a4d088589fddcc99ffa45d68519ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615965, "uuid": "892f49dc-d989-4c3b-926a-dfaef2192ecd", "comment": "Malware payload (Rhadamanthys)", "value": "f6f5aab17d30d92bcb5033149c8d1c91e2fa7139fc04edfc2312604fd4b59ee9a09370ef83d18956b380797b1dc96887", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615965, "uuid": "65b17439-c923-41af-a1ff-082bfcd706d4", "value": "T161930953A5E7DCB6748DA0E27CAB26D2CE3E00E3685570982107F3101A6FF641EBA5D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615965, "uuid": "3061132b-c880-410f-a0d2-fcc86cbcd847", "value": "768:GDhd0i7J4sYKgY/CMNfWd62E2QrXq8r0+hLHkOA61K76SLAuAAroQW+FF+Ec+0FY:GDB7eKg206ZrNr0+hYOA6ce6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615965, "uuid": "e212c1eb-76d9-45d5-81de-506df095ba88", "value": 97446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615965, "uuid": "0e6bf7e5-4503-45a2-ada6-805f9d643480", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615965, "uuid": "4386ec4c-0058-4d71-9dfb-da49d2947073", "value": "invoice-1637482117.pdf (2).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac71962-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615701, "uuid": "e00f7863-c076-4ea7-ba0f-28e2a61b35cf", "comment": "Malware payload (Rhadamanthys)", "value": "82b934fecbdba23f011cf9153d500aea", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615701, "uuid": "b5778d63-856a-45cd-9adf-5c1683a6525d", "comment": "Malware payload (Rhadamanthys)", "value": "8f99116181dd8a4afd00e2b891c85a3511f221b75004628c340f6914861721f5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615701, "uuid": "2c305ab3-43bf-4c27-900a-19144d09a182", "comment": "Malware payload (Rhadamanthys)", "value": "4661b05b28b324fda250f6560645b182a4c192aa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615701, "uuid": "6476a0f1-d812-474c-b264-e565131e240f", "comment": "Malware payload (Rhadamanthys)", "value": "8260ad6c7d60881da1b8b91f94ff3c9f3883818f835c02e85bd14c2a3af2a3bf2f1bf0f52d0bec91a4cad0d0a4f2fe81", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615701, "uuid": "13fc2f34-3660-47df-85f0-d58246b0f242", "value": "T176A32C912C217C7E265B57A4BFE089B0C02589E5852A04D8F14FFF2A48D8B579ECDB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615701, "uuid": "09ffac18-a49a-401b-b4ea-35652ebf0576", "value": "768:GDhd0i7J4sYKgY/CMNfWdfgQNrTfrXfjrtxT1XyHjsTpzALEvpM6LSLAuAAroQWK:GDB7eKg20Dr7rtxp4AAgxL6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615701, "uuid": "12613c4a-9a82-4058-af6a-7c764127bcc8", "value": 103429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615701, "uuid": "422396e9-dce4-4ade-88e8-55b1bb186bf1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615701, "uuid": "3f82c85f-9417-4713-8c49-632ac79b3982", "value": "invoice-1637482117.pdf (57).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893e9b66-d7ce-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765594251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765594251, "uuid": "7c366c8c-3e31-4081-8110-091d9d1ac321", "comment": "Malware payload", "value": "431da47a6b8e30bd7d01fd28fae83cbc", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765594251, "uuid": "ef3ef7b6-c681-4109-b4bc-f4fa4f96d341", "comment": "Malware payload", "value": "8fb876fd7e52699fe2c6f1bbc8e70552e06eddd813e9e5ce165fea3d6c354c9f", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765594251, "uuid": "7af5b62a-d855-44bf-a397-75b9204b333f", "comment": "Malware payload", "value": "b111ededcf379236bb7e88500e6c3577500cf465", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765594251, "uuid": "46559756-92cb-472a-9684-7e50e1d2600e", "comment": "Malware payload", "value": "1c21d48986fc1175682d1a810bee389a6e55c128636dd4b17369990ac5c0034a9d9c43d3b3aa56f57c59ccba436ce0ba", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765594251, "uuid": "c0b4668e-19a4-47f0-9485-8e563ac7f7f9", "value": "T1621121CB49B61601B2C140547EA733922A94562B810AC560B10CB099DFC9F2E86E37DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765594251, "uuid": "4352f64f-759a-497e-818e-de8f1dbfdabd", "value": "12:F6QclfhE0evXSJ+kJAxmkNjkYkRgHe8dLN3DHgXocB14zSvudJBr4olf4x7RHts8:FspENMgYgFNMNBqzSv3olfALs1BzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765594251, "uuid": "cf63af78-4007-4404-a294-7b071fed9aec", "value": 988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765594251, "uuid": "591bc021-5474-407a-8ec2-f251029eeb7e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765594251, "uuid": "366dc6b0-415b-492a-b058-724fbb8bd18a", "value": "ie4eri45uie8rruerj484reurjhjdfgu8g43fdgh34gngfdi34dgj4er34dg43tgde4.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe409932-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615922, "uuid": "6f6dcde6-03e5-483e-bc1c-e66c395bb913", "comment": "Malware payload (Rhadamanthys)", "value": "9762b0bbd06c13a7e59696ac13e8628c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615922, "uuid": "0a1aac3c-2a2d-49d7-bef6-b1379927213f", "comment": "Malware payload (Rhadamanthys)", "value": "8fbc5d12d3be76d7b0dc269b01dabcef4aed40af04f6a1ca376a52add2933057", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615922, "uuid": "c44ca949-8a87-4577-9555-15fa5d279b9b", "comment": "Malware payload (Rhadamanthys)", "value": "4fadad1c4217255976b7ca209ec65cea1029e7ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615922, "uuid": "aad64503-84d2-4345-b96f-5efe377d379c", "comment": "Malware payload (Rhadamanthys)", "value": "a48a9ab5b936494a1f8eb2757332920a50f7da96619d167d4c25d73fa788fec9ff6d0fc7637d6d4df72ef7992983bd21", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615922, "uuid": "0742cd38-64fd-4e93-810c-9c5933df56cd", "value": "T1D79308078922E4F43E1973348E8F63F45939809D89C933D8781AAA251D6CD361DBCADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615922, "uuid": "d28cab5d-c3be-4dcf-9367-96dc540f5a2d", "value": "1536:GDB7eKg202dOrkQX8YAYN5cU6GfWJ8466vFEhDEQx58mbVGd2o+ge9L6Gr1Mf2ns:GDB7b0DD/M+DN6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615922, "uuid": "762ebabd-c4c4-4af2-8629-fc73fddbc195", "value": 96806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615922, "uuid": "027857ef-315d-415b-9e8c-38076350ab2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615922, "uuid": "3ddd9932-2e7d-471e-ad0d-9d18892d8fac", "value": "invoice-1637482117.pdf (12).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050e40b9-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605196, "uuid": "3fc04225-f910-46dc-bd28-9c410c0d358e", "comment": "Malware payload", "value": "856285ce7f81f5224d4c653e6bcccafa", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605196, "uuid": "948bd27b-28e2-42de-8ab0-d712cf722e38", "comment": "Malware payload", "value": "8fc8d04cb141da47f4758017db7d6a01fb62e6d4ee45f32c34549f3124cfceb6", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605196, "uuid": "92930fd9-fb83-430f-91e5-0bdd97b65322", "comment": "Malware payload", "value": "1c4b9ff7937583d05e63ce30cc283360abb1d82d", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605196, "uuid": "ad5fa744-0b21-4c58-9eef-695482af06b2", "comment": "Malware payload", "value": "4a89f51921d8d0ef314b290d417af6ae9a7030df284f1a50e2408e28a576eb261a33bab7aacfe082815f9c85b830e173", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605196, "uuid": "7e23e16d-bf9e-487f-a1a0-f03692b93e7f", "value": "T16B843BA3D3682404C3B842B5CA295358B935FB9C577003BB3B90A2FAAEF53545D1BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605196, "uuid": "915d530d-69a8-44e7-a0c8-8196ca111deb", "value": "3072:4FCm7qEq970hNXz9H5/AZtBSeo4fkyiGh3VUyW3uRfaRNYf66xUWxp/GJPbPjgeP:RS6o9XGh3VBbBl+PHdyiu/je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605196, "uuid": "81291bd9-6028-46be-9d78-6628e6c1ff9a", "value": 389984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605196, "uuid": "17109c09-e570-44a9-8006-f639136b9ca2", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605196, "uuid": "9c4fbfb6-500c-4406-aa8e-b370d29f4b9c", "value": "8fc8d04cb141da47f4758017db7d6a01fb62e6d4ee45f32c34549f3124cfceb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53d3a61-d866-11f0-a129-42010a9c0007", "comment": "Malware payload (N-W0rm)", "timestamp": 1765659608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765659608, "uuid": "3a31aa8f-8253-4c5e-bb67-b4d7d71a17f2", "comment": "Malware payload (N-W0rm)", "value": "0a20ebb879c141b3d3017af7ea3d2f0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765659608, "uuid": "4c50db65-5083-4465-854d-5f106ef63b8a", "comment": "Malware payload (N-W0rm)", "value": "90ea17ac6a4f81bec11e988df387eccf0f27d7ecd5bd486d009bed19028fa0da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765659608, "uuid": "c34b1d4c-a22d-4b4e-b6d6-0ab17ef0dcf9", "comment": "Malware payload (N-W0rm)", "value": "44047c10795073aaf8e19c332c2d609afec2181d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765659608, "uuid": "9adca998-8498-439a-9e9b-feac27ef0a68", "comment": "Malware payload (N-W0rm)", "value": "b389f18f5e32a8809d17a17cab2ffe236d63ce8914250f8505f5b5a8e56bdcbe14947e31f436f1ce6d4557bbfb54c7eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765659608, "uuid": "1e3a7933-529e-45ec-bc7d-51c7f48911e0", "value": "T156F47D1AB3B86174E1ABD1798D864916E7F2744613629BCF03A046AA1F277F07F3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765659608, "uuid": "3750bb2d-249b-42d6-ad1c-e05baa738580", "value": "ca077a601f863201fa9366a44fc113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765659608, "uuid": "096f9537-68e9-4dc9-a4ca-9505235cb157", "value": "12288:Sq9bpSGGcRTsll9O5ZPAWY0+Iu6zMCLS3KzhXb1S:Sq99pTsl/Ku6YC9XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765659608, "uuid": "f5426e90-de5b-4135-95a8-ed93d689f227", "value": 725916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765659608, "uuid": "c6fc3fc9-9cfc-4ae0-9fcb-d8a004dfb37b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765659608, "uuid": "5d268f7e-126f-46ba-b920-175d9d10df82", "value": "0a20ebb879c141b3d3017af7ea3d2f0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6e8967-d81c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765627542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627542, "uuid": "b7ad217d-6852-4526-a488-d2896039e885", "comment": "Malware payload", "value": "635dd3d016c76f5c0329d3fcfd3c2005", "object_relation": "md5", "Tag": [ { "name": "162-159-36-2", "colour": "#34EF10", "exportable": true, "hide_tag": false }, { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627542, "uuid": "f2a8bb07-c2d6-401c-a72f-d0708afb4549", "comment": "Malware payload", "value": "915f6e13af630895c22a85df0359da4e4741dca017e1892d16ecc46b40afbe03", "object_relation": "sha256", "Tag": [ { "name": "162-159-36-2", "colour": "#34EF10", "exportable": true, "hide_tag": false }, { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627542, "uuid": "9ff8462f-fbed-4786-b01c-576a3466afb2", "comment": "Malware payload", "value": "6dfd2ea41d7b940752de5c69b7576734e6bc4212", "object_relation": "sha1", "Tag": [ { "name": "162-159-36-2", "colour": "#34EF10", "exportable": true, "hide_tag": false }, { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627542, "uuid": "ba45b7d8-2384-4f81-8053-e8e5c5b3d2df", "comment": "Malware payload", "value": "c3f57e37591d1d73de29dfbbd742197023af330bb90f2fb96e41f36dc09de57d02279c496d1c24c9923f5cf18bac394b", "object_relation": "sha3-384", "Tag": [ { "name": "162-159-36-2", "colour": "#34EF10", "exportable": true, "hide_tag": false }, { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627542, "uuid": "dd5583cc-7465-48c2-93c3-14fd02c82611", "value": "T14783845D9CEF70CBA663B424822BDA83C95BA60B6509CE36751CC3309F9653881ED7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627542, "uuid": "3ec2598d-7208-4b5e-9713-5ba0aa80efd0", "value": "1536:hIp8e3gD4f2ibF7yQ4126qUPRrT5m4tIRtW:nL3vT5ft/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627542, "uuid": "3f994b76-82e9-4be2-81a7-8c68b5355459", "value": 88686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627542, "uuid": "65bfb25d-534e-40a4-9736-f3242b5812ac", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627542, "uuid": "393e3c41-2ed0-4d45-bc42-ffe36cf3d140", "value": "915f6e13af630895c22a85df0359da4e4741dca017e1892d16ecc46b40afbe03.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703c32d9-d7ef-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765608382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608382, "uuid": "b894218c-2b18-4c7e-920a-22ecbf0db9c1", "comment": "Malware payload (Mirai)", "value": "51fedd9065a12ccdd6f1a4b07976f96f", "object_relation": "md5", "Tag": [ { "name": "43-152-234-213", "colour": "#CBA4D5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608382, "uuid": "9b4d8886-5caf-4824-839d-0e14dee6e392", "comment": "Malware payload (Mirai)", "value": "91cca9db00070f0ae92ae8bc14306b10fbd54e1bd5fe785c0e62cfecd92afa1f", "object_relation": "sha256", "Tag": [ { "name": "43-152-234-213", "colour": "#CBA4D5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608382, "uuid": "8a10d40b-5cf1-477d-ac9a-937c82a40fcc", "comment": "Malware payload (Mirai)", "value": "14136369b03ad3df6fbf91b9460ea8c4b8d39fa7", "object_relation": "sha1", "Tag": [ { "name": "43-152-234-213", "colour": "#CBA4D5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608382, "uuid": "bd5e2999-b914-4fc1-91ce-bc93266d97e4", "comment": "Malware payload (Mirai)", "value": "36914363ae33265091d4511cc6767a95f2b15ffc65f29db7a36ef0f7fde1c208ef689bc47e17b9688380baac3d51e18c", "object_relation": "sha3-384", "Tag": [ { "name": "43-152-234-213", "colour": "#CBA4D5", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608382, "uuid": "958853e6-bc42-4777-8ce2-95677ce08600", "value": "T1E6125047A2D1CE7FC8E813384467122472BBD47ADFA29713050C65B66E923DC1E6DF8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608382, "uuid": "c6ad6da9-b1aa-458c-8fa7-652d4d77c84f", "value": "96:GjOTpJ4WHbHf5AlTTej6TNJ9VmNddfs2oYJYoBSf7meaamBFBp8hBdZvZ4:G6z4WTcTTfTpV6dfs2So8f2Tr8h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765608382, "uuid": "60e55a67-5b8d-4011-be08-421261886c3c", "value": 9848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765608382, "uuid": "caeca1bf-0828-4d36-8876-311eb717339b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608382, "uuid": "b235ce08-fe0a-415d-94c2-54d11651d75d", "value": "91cca9db00070f0ae92ae8bc14306b10fbd54e1bd5fe785c0e62cfecd92afa1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6fe654-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615946, "uuid": "75a6f830-710e-4365-9dcd-f32117df8af8", "comment": "Malware payload (Rhadamanthys)", "value": "565cc5b8b0e7fcda01b81049acc984a4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615946, "uuid": "d9d247e5-738f-481b-bf79-5cfec59016bf", "comment": "Malware payload (Rhadamanthys)", "value": "924dcebfb780886cb368eabb0db10aaf1469d834dfa19f07c275b36a207eb77c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615946, "uuid": "deb9dd5b-6fc5-4c89-a24a-5cf710c22d72", "comment": "Malware payload (Rhadamanthys)", "value": "2e09a4d89496bfc500af8644e9f685647c2aec37", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615946, "uuid": "5038836f-7bc1-49a5-926c-048a343270cc", "comment": "Malware payload (Rhadamanthys)", "value": "2a0ad5fa4f95a244367ec2e52e7796aee252fa69a43738d3d9bdb3f80e71a0a03665eb3f363a6696f005864486c383ff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615946, "uuid": "693036dd-bf99-48c0-adf7-e212a8ad5611", "value": "T185A3D80C84436EFD7D230366AF520EE5B52DE21B7099A6F9B119F3924858ABC38355F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615946, "uuid": "bc0f5805-486d-4a9c-954e-f8fe58566e84", "value": "1536:GDB7eKg20jsmVh+Y1uKMcaJKJfIn2euNMN0iOMlBDcVseRGe6n1qTXPQLmkF7Yr4:GDB7b0XDxym2I6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615946, "uuid": "75b6fdde-33a9-43d6-be6e-88723894e6e4", "value": 100096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615946, "uuid": "5aa052b5-43a5-4f67-b9a7-438b76d29221", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615946, "uuid": "184929f8-57ee-4baa-ae10-c310fd249e54", "value": "invoice-1637482117.pdf (3).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a4cd22-d87d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669252, "uuid": "9f9851f4-3641-4a60-b22e-a2e07a1ea3f6", "comment": "Malware payload (Mirai)", "value": "4515c8e8bd28c3b801199ac282306e23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669252, "uuid": "3be25d73-7a14-4488-80a3-3bc1399a99a0", "comment": "Malware payload (Mirai)", "value": "92c767f660f4e3262c755d7a7e7e6846dc768c92103b41418b758f3a394eb4db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669252, "uuid": "3a712cf7-3bb3-44a5-abab-6742bed245bf", "comment": "Malware payload (Mirai)", "value": "e235db383bae15fe84f280353be9b2a4aba8ab22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669252, "uuid": "2668d635-067c-4c4c-9a4e-69ab04004719", "comment": "Malware payload (Mirai)", "value": "cf0660cb27c1fa21d66a75fda72dc72c36d4f6fd4406d4659091cb853f41c2648f83ecc6841cb342af7ffa6aef5815d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669252, "uuid": "d427ee65-c07e-419b-a8f9-4fa636a201bf", "value": "T100635BC99613D8F9ED2A09316073F7329A36F535403AFA83D7649636F852B02F60639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669252, "uuid": "2b3138b7-1bc1-4045-891c-1cd1888724f8", "value": "1536:NdcEBA5SLejo6p11xQ9JqhozFy2YsgwMNBb7cwRfgC8sLSOxG+xgqGRRy:NdccISLeM6rvQ9AhB2Ysgd7cwJFt2yGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669252, "uuid": "2b6698a6-ceb0-4993-8f78-f7504b6fe7df", "value": 71536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669252, "uuid": "46534187-ee93-446a-a7ae-eb20965107d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669252, "uuid": "fe03ba6f-6f90-43a9-965f-ea4bf3df0d7d", "value": "splx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28442da-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607232, "uuid": "c617186d-2f42-4f94-8459-79422ebcb8c0", "comment": "Malware payload", "value": "9d90e34207f56d44c5ea6e68563b8642", "object_relation": "md5", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607232, "uuid": "c498355a-18e2-405a-83da-58c993764676", "comment": "Malware payload", "value": "9383c992abecdab53cc798940d296c0f8a5c0efe5ee8161d7c71a2dd23e374e2", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607232, "uuid": "52f5112a-3f35-41c8-a9c3-9a376deca33c", "comment": "Malware payload", "value": "70e506e6e26d6fadb73f3c55d77b18605e459932", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607232, "uuid": "9e923264-1cb9-4c34-a845-d4d15d5f4a87", "comment": "Malware payload", "value": "a9d4e9f9cf84cb7d7da9c921a5fdaa6a025e5abb00b09c1a1e5a6fcef03f796f97e9a240542870ff43589c8c89fecb21", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607232, "uuid": "eae93e4e-ff9e-436e-92f2-dd2368c6e905", "value": "T11AA3714027C0E562134787F73316F4E4E80CAC9D72E946AEE59A7E2DE65BE71E2E0131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607232, "uuid": "94e5538d-edd7-4c5b-956f-a3b097bb8638", "value": "1536:LOTjxV4UyZhQdzagsKk678TPEtzxSY5ONYXUTJ:LOTjHkKsn6VtkY5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607232, "uuid": "2f2350d8-6c24-4d5c-83a5-cadc22e8bd31", "value": 101598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607232, "uuid": "a08d02d3-1768-494f-8ca9-9121534aac01", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607232, "uuid": "b56cd29f-43d9-40ef-93c8-4d5a2482eaed", "value": "9383c992abecdab53cc798940d296c0f8a5c0efe5ee8161d7c71a2dd23e374e2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313b6a07-d7fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613431, "uuid": "6e090363-efa9-4956-88fb-e269f2a7aee3", "comment": "Malware payload", "value": "9302c7d6999dc71bee552f65e6e42c48", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613431, "uuid": "42599325-21c0-464e-bbc1-a257eb816378", "comment": "Malware payload", "value": "939638a9b7a159325819a18b0a8d5d707341967f2aa88ac7f9bbe9a03df8ebff", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613431, "uuid": "05968a15-d825-496a-aab0-71866d142443", "comment": "Malware payload", "value": "48d8e6045c782f2b6ee4246e2a521c9905686903", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613431, "uuid": "531c9630-7fb7-4a59-b3d4-3a506ec9b707", "comment": "Malware payload", "value": "0f1d3ada7b4f52dc2fc49eecbf3cd55cbcba0d517ae0c5a7a8be10f0fd2c942f4704aa63e1e285d87828d7e15b135585", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613431, "uuid": "789dc899-c36a-4b5c-8f83-c7258ca9b6af", "value": "T13401FE3AB210B6BAD9D924D0F0611CC0A92905DF90239A0456C085595A452FFC23A2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613431, "uuid": "8f31a3ec-1af1-4612-8efa-79d58f32aabd", "value": "12:/8nnI5edGpKvhCkG1oCdzFatc8Vj0/QAYzYvQx98XhJQAYUqvOBIMW75:/8nnLcKa1Fzz8V+MYvi98Xn58QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613431, "uuid": "1cab501d-6c0b-44d8-a182-18a23e0093ef", "value": 664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613431, "uuid": "1397aef5-c2c8-411f-a1ba-39c1651f20b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613431, "uuid": "a493c234-0cd6-4dbf-98be-bc4724bac67d", "value": "939638a9b7a159325819a18b0a8d5d707341967f2aa88ac7f9bbe9a03df8ebff.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1682568-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765608170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608170, "uuid": "3a5669e3-d55d-42ec-9272-dc15517486c2", "comment": "Malware payload", "value": "1eb3f0af2e5391cdd811acd30ba59e2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608170, "uuid": "f2ab5b34-932e-4b0f-871b-e0df6335e49c", "comment": "Malware payload", "value": "93e7f6ef4b57d4e22362bc0075240fcd769aa4aafde06495699255640594cec2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608170, "uuid": "d48d4175-5d13-493e-8255-442457a17f1a", "comment": "Malware payload", "value": "f4de179394f527fb8859f1f660dd71eae65d293a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608170, "uuid": "b6488fb6-da8b-4efd-a86c-521bab98e784", "comment": "Malware payload", "value": "5adbeda8eaa5df75276d751871998b991b652c0958ceb7c542f54e02e63e08cf116325def87f4785e7ac15f4b86449eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608170, "uuid": "529597fb-c782-44e6-bfb2-4e54c484f03d", "value": "T13C952382B7A009B3DCB5AB75CACA841EE7B1F820435797DF065881510B337D52AF93E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608170, "uuid": "09728ef3-92de-447f-9230-7a60d17e9b8b", "value": "e0500d7e1368e04fc0ab271b00d1ce2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608170, "uuid": "0d33848e-17ac-418e-aa2d-64f632a201be", "value": "49152:LmjTwT6k+/xBD/8huYEyI7BrUYtuVg/s0ZmI1aCqz93Dj:L3TdSBr8hnOCQGMzoPz93P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765608170, "uuid": "e97ae117-e352-4d1c-b783-0de8a184314e", "value": 2019952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765608170, "uuid": "636c7531-0596-4cb1-9132-42f5c811f0e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608170, "uuid": "857bf9d7-8e77-42fd-bb20-9dd1d1ac4ca4", "value": "93e7f6ef4b57d4e22362bc0075240fcd769aa4aafde06495699255640594cec2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccff322-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605370, "uuid": "34f4a226-b4de-4de1-828c-5bb6d5ad32b1", "comment": "Malware payload", "value": "818d66be3aa61faf5fd7744037a0e98d", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605370, "uuid": "b31ae525-f90a-4a1f-bb0e-4d2411f4c28a", "comment": "Malware payload", "value": "946b2295d0c28b16cde1ba70fa3b6d14ffe08bea6bb178c96747c77b09332a81", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605370, "uuid": "856ebb6d-4f6f-4364-ae85-a96fae328928", "comment": "Malware payload", "value": "90aa436c5138c37cf67383c41547cf15e60b8ebe", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605370, "uuid": "a9c85cbe-ec75-491b-a564-730ba9015a9e", "comment": "Malware payload", "value": "f03ba6d70b76489ea82a47ad05a823d0457758046ad621485050b2b3bcfb82d16d13afee5f11d6be3a50f38b42614722", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605370, "uuid": "7007317e-dfe7-4d7d-96fe-23694d932576", "value": "T1E786F70B3F9E543AF11FE2FD6672A1173426B8E1590C40E07971DB0789C6B1EAAD4C7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605370, "uuid": "51803c45-af9a-4971-aee5-011de5df3a55", "value": "98304:jMLj34G8LfUxCdKV1bz6pLxbLKE8ePyXWw:jMLj34G8LOn6pAWymw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605370, "uuid": "4bfc365e-7f16-47e8-8a39-f06041b58810", "value": 8254416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605370, "uuid": "93c07637-57b5-43cd-8028-190019da68c5", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605370, "uuid": "25fefe85-139a-4c2f-acc2-cb7e04f83ffa", "value": "946b2295d0c28b16cde1ba70fa3b6d14ffe08bea6bb178c96747c77b09332a81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cffa42-d7f4-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765610752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765610752, "uuid": "144538d1-feb8-4e92-b2ca-8d424e3fae56", "comment": "Malware payload", "value": "8b6119700a251ff4b2a43398483c4958", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765610752, "uuid": "bd11fe61-3ac5-4e35-9982-787a4f6931f5", "comment": "Malware payload", "value": "94e36ec9daae10cb1a4b475b33c7ccd5716db73d4cfad2312c12acaabac9a238", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765610752, "uuid": "baf0a2eb-0eca-4b3d-a6d9-d3c331c6cf3d", "comment": "Malware payload", "value": "17fcecf88d5581c40f37539e56dd232526d1335d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765610752, "uuid": "b4fcd2e1-7855-4d38-9754-5ccdb3876491", "comment": "Malware payload", "value": "4a40f5f3ddf9add82be4ea78deaa2d5af42a63bb7891511f7dde0c81c23339c12005aa61230d624bb8aeee99645e253d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765610752, "uuid": "c75d6586-b43d-4108-a452-253c0387ddaf", "value": "T189B0927907073907803DDC3B72B10FCC70367B4E104BBB843C82602FE0844D42022D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765610752, "uuid": "7a2e2a43-b864-4da5-a44f-38551ff0938e", "value": "3:haX+v1FjX+v7Xyg/K+vaGN3zSTASUKoS0/eXIFIXWX+v1Fg:WGrkX5//SaqA54X4IXQGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765610752, "uuid": "7406fbec-fb53-4f03-b0e1-f824943eaa7d", "value": 129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765610752, "uuid": "c26d3fe1-891d-4d02-92fd-e25740d082a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765610752, "uuid": "c053b7b0-d71d-41ff-aaf0-02ff0cb94b66", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b59837-d7f3-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765609977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609977, "uuid": "757d9b10-dfd3-4f4c-83b1-6a9cc823d436", "comment": "Malware payload (AsyncRAT)", "value": "b46a2c1b65ba691a858e22718e1ee69b", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609977, "uuid": "581b451f-9ca1-46cf-a637-048d9a29f25a", "comment": "Malware payload (AsyncRAT)", "value": "94e6cf4122215224008285277ee1f4df61a7739c8c85ed569f112d70ce8b998f", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609977, "uuid": "81252192-94dc-4d38-b5e4-2fc2d8f652a3", "comment": "Malware payload (AsyncRAT)", "value": "ebae9eb1cb2bf3aa2df66b0054ca4e43ad104b47", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609977, "uuid": "65990b93-710c-43ac-bae0-287531c90d1a", "comment": "Malware payload (AsyncRAT)", "value": "bbbfb46149b71ed8b92602c92af54797f50580c3f8eb6d258ce8ad90ffac8465f79857c08ad2cc7c58137b8326a1ce68", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609977, "uuid": "64cf3a96-1a84-419a-ba1c-aa2612ab0d07", "value": "T1EBC50A43A9DB0DA9C9D277B8A1D31335B774FD348F2A1E3B6A58C23119536C4AE1BB40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609977, "uuid": "e770e855-e0bb-40b7-b18d-07180d292d03", "value": "96ea0a05de9bd8786a471a32a5c6040a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609977, "uuid": "ca0d3162-bfd6-45b3-af39-2d4b23b9ca78", "value": "24576:5vd+yrfkLcIv8Rh/xZryBSHzBswyrsk2kOoArcIWJ6clMi81s3Adc+zM8f:5vd+yoLcIv8RNTryYHCOvcAc+o8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765609977, "uuid": "1b47c753-8acc-4643-8bb0-0aa44eaadf84", "value": 2616690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765609977, "uuid": "cc1bf5f4-207e-48e6-9bd3-4b917a861f75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609977, "uuid": "55001dc6-f628-4b15-8221-8b48468c2ac6", "value": "94e6cf4122215224008285277ee1f4df61a7739c8c85ed569f112d70ce8b998f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c50157-d871-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765664057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664057, "uuid": "17490780-5834-4524-8415-b064c5309456", "comment": "Malware payload (Mirai)", "value": "b98467669d3958759a3d6e8ff3af627a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664057, "uuid": "53605c6c-af66-4c05-8a47-abba91ea199d", "comment": "Malware payload (Mirai)", "value": "95ce83252db9137abee750105fb8b2a7a143663d3cec3ff230ccdf8a5886edf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664057, "uuid": "db93aaf3-3b20-4742-8363-1e56d1d3a521", "comment": "Malware payload (Mirai)", "value": "651190bd0caec5d7a61ddbe370238e68e9f21f23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664057, "uuid": "99b11877-cda4-400e-80fa-ff7964e2fc25", "comment": "Malware payload (Mirai)", "value": "d981ddbfb8500e0cd246ac30b4e88e5c6831051175307e1ac6d8ed4d9bf0dd824ba0ef8b043072184e6d651395b9ea8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664057, "uuid": "434f4aab-2d2a-41f2-b26a-be3e4194908d", "value": "T1E0834981F64B80F5D407483000ABF73FDF32D6654261C62EEFA9DE76EE63543A126689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664057, "uuid": "fcae5fdb-355c-497c-8242-c237853b72a9", "value": "1536:Df4dZwh+kmiYgIQtWcbYR2K+SpJhYW6xIu9IJw60Zrv6X5JVeLQC:LSZwh+kmiQQtdbYR2rSpJTzu9IJw6qvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765664057, "uuid": "85cc21ea-2639-43bc-a3ea-43ae012587f4", "value": 87472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765664057, "uuid": "f9b1f9f4-58f3-406c-afbd-fa41c90ce82b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664057, "uuid": "b094e08f-e9ed-4a56-9f6f-8818568807d1", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4560dd76-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607022, "uuid": "92bc3f87-426d-48b8-b009-2d933fc1efac", "comment": "Malware payload", "value": "5356e933ccd8fbec36c685241ad2672c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607022, "uuid": "1d3c7aa5-1679-459e-96bf-3b395a62139c", "comment": "Malware payload", "value": "95f2eb74b887ce416a24e2c6c7410504613dc735c64243e263d8cbd2df224694", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607022, "uuid": "34f7e5c5-c023-4fe7-bc4c-e9a6845184b7", "comment": "Malware payload", "value": "85f60ef6fc73d01b591a6a9cad646e82cbe16b5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607022, "uuid": "eb404eeb-5212-47f6-91f5-b1a5d20aa583", "comment": "Malware payload", "value": "e83593307e5b1a1413bbd182bbd5abc6f0348eec9b1d0a13aa7891656c5015883c222577d1c14711e2687ddbb6fbff6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607022, "uuid": "5e48afd1-7f94-4a03-af5a-4bb140bb0a66", "value": "T15D953B25F7F2005ED2AFE139E88E4909E2A3B942476FC6DF025E13253567BD22679703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607022, "uuid": "6b024927-8c0d-4bbc-9af4-7ea28b8606f2", "value": "86962b2ddbf99fb8355cda2d124ba099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607022, "uuid": "035f7804-af97-4d1c-93d3-6c5e6b6bcc41", "value": "24576:V27nIqKO8jh3Wm8iQsN9ibyTYB20GQj8kUFexJxLqyS7dUoe:8UVljh3SsjibyTW20GQj8M9u7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607022, "uuid": "a7aca811-3628-4ba7-803c-ba7e90d43f4a", "value": 1966592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607022, "uuid": "e70fc891-d1f3-4938-92e4-68421c2cb2b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607022, "uuid": "ab08f8bb-6b02-4205-89a2-9156fc82bc01", "value": "95f2eb74b887ce416a24e2c6c7410504613dc735c64243e263d8cbd2df224694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "979cfc21-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667289, "uuid": "d6e02f14-281f-403d-af7a-98f9a0e0d3bb", "comment": "Malware payload (Mirai)", "value": "a555cd53037033099cfe1904880afad9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667289, "uuid": "8e98087c-3036-4d61-a35c-18bb748a7ff7", "comment": "Malware payload (Mirai)", "value": "96ab2be17f50948f356efe41e9a8038bc2c2dff33f0f794f51e2ad95f2017b4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667289, "uuid": "9c606614-f25e-452e-80b9-ab2ea5286eb4", "comment": "Malware payload (Mirai)", "value": "7c08811a87fd5d79d6b20a103e958340834c917d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667289, "uuid": "3d94aa4d-62c3-4f50-a42c-8cd356f4c7f2", "comment": "Malware payload (Mirai)", "value": "071f8584f7b0b277ed6e7a1864f6a636a3f94ba9aa3fe57c826592cad5fd809968e073b05a87da8d4f12eaa9612eecf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667289, "uuid": "8d53e975-f564-48e6-8559-2aeaf87cec3e", "value": "T1C3730946B8418A63C5D462BBFA6E42CC332563E8D2DF7207DD116F253B8A82F0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667289, "uuid": "951a5ffc-ff0b-453a-8eca-bcf0df16e156", "value": "1536:VVYaghZ9K0FefQ0wfkRNHMOxcfw0BrVnv8VR:VVhgewOH3co0ZVnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667289, "uuid": "00ecae61-ba0e-4ac7-a0dd-44f1a02125df", "value": 73468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667289, "uuid": "842c9923-ab6e-468f-92c7-cff382ee154a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667289, "uuid": "a2189ac0-0282-4a9e-8e7d-d6dd653b0dd3", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149b8633-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605222, "uuid": "d7542439-39ec-4841-974c-1a25ce2dd7b9", "comment": "Malware payload", "value": "027521885f2eaa5b611c1e4b214ffb80", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605222, "uuid": "2a9bd447-c911-4ac3-98c2-aac80263b47f", "comment": "Malware payload", "value": "96c6a228d7fb56f609d8f05086126557ffe8ba5b016e7bb6aedc0e9cc3bbeca8", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605222, "uuid": "c0e2a527-5a75-4c2d-9f14-36a6f64cc816", "comment": "Malware payload", "value": "1935fa883d763ef1079b4866e1508497daa14e17", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605222, "uuid": "4920a65c-208a-476f-9ea7-cf9bf16aa63e", "comment": "Malware payload", "value": "5a175435b2f557e3706749972b31b41156bff1a4c0c17b3ee68f58d9488f2df4a314a3a92f7ddfb792995973e447449e", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605222, "uuid": "3b74e160-2b12-4a22-a773-57192275430e", "value": "T11C843B63E3682404C3B842B5CA295358B935FB9C577003BB3B90A2FAAEF53545D1BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605222, "uuid": "008b5210-8c2a-4eda-8e65-dbacfa1662cd", "value": "3072:4FCm7qEq970hNXz9H5/AZtBSeo4fkyiGh3VUyW3uRfaRNYf66xUWxp/GJPbPjgeA:RS6o9XGh3VBbBl+PHdyiu/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605222, "uuid": "c84b687f-6979-42f5-b55b-a5b19f544e9f", "value": 389984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605222, "uuid": "056603f1-212e-4d08-aacd-63feb0cb333a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605222, "uuid": "39711d51-60bf-4651-8e58-0834b6393be0", "value": "96c6a228d7fb56f609d8f05086126557ffe8ba5b016e7bb6aedc0e9cc3bbeca8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abb343e-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605286, "uuid": "3612cd9c-a356-4959-b87e-8b216c05e3ff", "comment": "Malware payload", "value": "8dd21043105b51fd9bde0c2abd0f8ab2", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605286, "uuid": "85159416-dabe-4b8f-8723-4cee4f8d4394", "comment": "Malware payload", "value": "9801aae7cb9f3506a9fbb85b0a22b26501313c15cd94a1e33f1fbeaf45fe1829", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605286, "uuid": "cdbb5c00-7aef-4fd7-9d90-e415c99520b4", "comment": "Malware payload", "value": "bd962158bd33a054388f8f05ee0cc10ff3807e7c", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605286, "uuid": "ddb4c92e-1253-4d12-81c2-cf1aeb20d382", "comment": "Malware payload", "value": "58422963fe9f298c8c3b9c72515fb9b66c8d19ac1a6c462f035773b189c476a7953d4fb7952505f7fedc50d28228c25d", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605286, "uuid": "d424840a-1b0a-4131-a822-81233e087afb", "value": "T1E6942A63E3982804CBB886F58B599358BA35FB5C1370437B7B5062E6ADF63540E1BF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605286, "uuid": "bb2cb958-165a-4717-8794-8cf93a822579", "value": "6144:z4QZVhf5x8vGrq0x5XTQOJrnVpUtGixECiusLWO:c+hf5x8er39TQwTOGixECiusLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605286, "uuid": "2c144762-3a65-4242-b21c-95c9ae887009", "value": 447280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605286, "uuid": "695912b5-3430-468f-a55c-870595468345", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605286, "uuid": "6bbbd74e-8c33-45c7-9f3b-2446c31cf062", "value": "9801aae7cb9f3506a9fbb85b0a22b26501313c15cd94a1e33f1fbeaf45fe1829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80f5fd0-d800-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765615804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615804, "uuid": "653ca503-7115-493d-998d-2b5c3b451fb4", "comment": "Malware payload", "value": "08322dc618b63b4fa73b6aa677a25d56", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615804, "uuid": "0c1395f9-35af-482b-aaa4-bd5e8c686d84", "comment": "Malware payload", "value": "9820d5273e696b0a6eb8c6dbdc5e5227d068c5eb0c868996699ad15e2e5869db", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615804, "uuid": "f85a062f-532a-4e49-a0b7-31a8aca8941c", "comment": "Malware payload", "value": "4ad9f303b416ae36f73cf5f890312e9bae027317", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615804, "uuid": "9efbcd0e-7e9a-476e-b7b3-9cc9694e0d74", "comment": "Malware payload", "value": "b5014795c571dee3479ddee23df5f00042f0f00f582496f41c1b7690038cd560039d4e60a54b8d1d0529cc7f05882bec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615804, "uuid": "8b6af728-fe16-439c-b7e6-edc46471fa6d", "value": "T17BA33A623E7269F01606B5A3F67CF150B01E68190C0A7190B1D7B9F67216BFA3F485EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615804, "uuid": "c300fdfd-0943-425a-9d69-1b824ecd1ce1", "value": "768:GDhd0i7J4sYKgY/CMNfWd3i4itxriz2iT2iNiBi7i8ipiEiyiui8i4i8iCiy2ihK:GDB7eKg20oxrbrlDbnrAoZ16BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615804, "uuid": "64e7d578-1a18-429e-b6bd-17f12823dd30", "value": 103340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615804, "uuid": "eba19b72-d8dd-407f-9157-f3d41ef1b263", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615804, "uuid": "2940d74a-ea57-4cbb-8781-b393511ec401", "value": "invoice-1637482117.pdf (34).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da440ba-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667998, "uuid": "16512bc0-19ae-43c1-99e9-19d304b165b8", "comment": "Malware payload (Mirai)", "value": "99d766ae2b3ef286076e0ad32ed58d42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667998, "uuid": "1fde7594-77c0-48da-bb79-633df653ebd3", "comment": "Malware payload (Mirai)", "value": "98305a7db33304b218ef3fba6ecb53cc226c7b73f5297ee6873088db8a656e99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667998, "uuid": "ea8cd55d-59d9-4538-b0ee-5baeb18ad742", "comment": "Malware payload (Mirai)", "value": "de096438a9f2c2457ca1e467689b9777c8f2ed49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667998, "uuid": "a0b06d09-c335-42de-92a8-96e63bef894b", "comment": "Malware payload (Mirai)", "value": "80633dc874271a3b5265ab2fc9d2c071472bc9af71b643789d4f3cae541f12f25485f14d78bc4a16c620c58e3791c59f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667998, "uuid": "ca07bb67-a247-4288-a9dd-d40c98145f33", "value": "T17873D649FB608EBBD86FCC3745BD4B0529DD860322A83B753970E418F26B54F5AD3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667998, "uuid": "58d9ce1e-c965-4b2d-aa21-f33351f42dc4", "value": "1536:8jJdcYjrnEn4OByViorvoVNEFwaN5/gnbz59G4xKnv8VRI:8jVQnGsnaA64gnv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667998, "uuid": "979584b8-48a2-41e2-bceb-71438adbf904", "value": 77072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667998, "uuid": "ecdc01c4-38a3-482f-b5d6-406e5de7d8e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667998, "uuid": "848ad5b9-a938-4f23-94a0-3051a03c5f7e", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fbff9d-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607929, "uuid": "c9a761bf-080b-4da3-923d-5fe3f78ae343", "comment": "Malware payload", "value": "14f206342be576a766e187b4f2db3469", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607929, "uuid": "0692e4b6-cab9-4bfc-abcd-f61504530645", "comment": "Malware payload", "value": "98642808308a459cdc8e6e3167f483d875fddd2d0753213ba4b8c8929a30d709", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607929, "uuid": "313e21e0-5a45-47e7-9bbf-ed8a07c513f1", "comment": "Malware payload", "value": "64870ebae7cd89dcf9454708e8be040775797ad0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607929, "uuid": "28b1190a-1330-4238-abc1-85f9f00eb433", "comment": "Malware payload", "value": "a1d7dca55ec6b483400e9e9c82e5c76e9ef36ff705a67a8be3408a6f8cb17d90c54989bb14221207b49eaae277eb8077", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607929, "uuid": "943ca4be-52f3-40d3-a922-92b2f64ec402", "value": "T1F783C81A2B319FFCF6B9833487F34A309798629127D6D588D26CD9202F6430D5D1F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607929, "uuid": "a0d8fa66-88ae-4e77-b31a-a4d232ce01eb", "value": "1536:jioUkj5zzFTTGOzgTBhmwNxx4UsRxVcy5hIoXbVfF47eF:jioUc1UB884UQxVnXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607929, "uuid": "41c17fe9-f4f6-4da6-a7a3-8753e1ddf5b0", "value": 86380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607929, "uuid": "b14ada51-ad6b-4425-9093-74e54632ae5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607929, "uuid": "d43ab8c7-f56b-429d-8284-31e611ac3249", "value": "n2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5476cdfb-d859-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765653862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653862, "uuid": "7e58a6b2-4f3f-495d-886c-49d310bc89c5", "comment": "Malware payload", "value": "fd00be7ff1921e825a60698ce9436513", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653862, "uuid": "8bed71cc-2858-43fc-a5ad-d6cd01705ddc", "comment": "Malware payload", "value": "9879cea031f94da621640644005ac44c9504f97709eecb5cc35b7f61f9db1b58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653862, "uuid": "1eb6c736-ea8c-4fa1-bf6c-5c1c98bb5472", "comment": "Malware payload", "value": "0a2c7d104a92bf4916a56c5fe556b250b91768e5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653862, "uuid": "3520325d-d8d4-449f-ac39-ded6d9f3587c", "comment": "Malware payload", "value": "6a6ac7c3655d2afdf115a3bc9d2bc40f9fabfb304c6b5db51a8fee0f880b2b54335431b56bf58c7dd12bc0b82655a315", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653862, "uuid": "401f04db-48a4-4595-98ce-669c8bf90887", "value": "T1F91483C91A9F809F575B20FE801FCC4BDE9D2603171D85C0799EEB886FA59A4B06B2D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653862, "uuid": "690ae0d6-9925-4995-9943-9d3243042700", "value": "3072:LPhgnjsqB3x8aw5thEZYw+StdRKyMc2D5+pzeC/ss:9zqIcY5YzeC/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765653862, "uuid": "097857e2-46c0-4a9b-b277-1abbb5d673cf", "value": 205389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765653862, "uuid": "acf07e34-74c4-4b14-9d07-91b1733709b8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653862, "uuid": "eab78102-932b-420f-96b6-0f9eae5d86f0", "value": "Work_Delta_Journal_479.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286a40ed-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615563, "uuid": "ca76afec-9d8c-49fe-845e-ee553552af97", "comment": "Malware payload (Rhadamanthys)", "value": "ac4c6baf4993b22e00322d43c36e54c8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615563, "uuid": "c9eade49-af5b-49a9-941d-7aac962e845d", "comment": "Malware payload (Rhadamanthys)", "value": "98a1ab021331890a6db2b5410e1c6b52afbf0817b78bd9463f27db3eda42ff58", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615563, "uuid": "514e8118-cb5c-4f7a-b530-bb1e24a4d129", "comment": "Malware payload (Rhadamanthys)", "value": "aa5be50718c29ae564bf5e8ab8d4e3ce28837f8d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615563, "uuid": "9a006f5f-c607-44fc-891e-67c520416192", "comment": "Malware payload (Rhadamanthys)", "value": "e325fa1bdd548152ce563ddd4225dc639f4ab0cb3f0ac3f91cf6820d5259a96004e71903023a15fd8e82594c1c9ded8e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615563, "uuid": "de5ac73f-8f35-47c9-a252-fcb83345de97", "value": "T1A6A308A8B8ABBDF9221762784E4E2869546FC547428D20CD715FBFA5F4C8B5BCC48CC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615563, "uuid": "251b5bc4-5107-4083-8971-91dffcbb57a6", "value": "768:GDhd0i7J4sYKgY/CMNfWdDE5AyrX73rPLnaHX4ACICJISLAuAAroQW+FF+Ec+0FY:GDB7eKg20grrrPLn24ACR26BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615563, "uuid": "b5a86922-44c4-4fe7-a353-ee4c51b88d78", "value": 100640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615563, "uuid": "1a4fad66-65c4-4d22-8a67-79cb8db13630", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615563, "uuid": "5abe83fa-b491-4ac9-b742-e30b6188bc44", "value": "invoice-1637482117.pdf (90).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ebf56f-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668174, "uuid": "fca2e840-3079-4f7e-8e98-5cf418fb044f", "comment": "Malware payload (Mirai)", "value": "030c3383b522c9d7c055c88c41b888e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668174, "uuid": "c1f3df92-41c6-4b7f-a5e1-1bad10e62aee", "comment": "Malware payload (Mirai)", "value": "98e0c580f547ff276e8f1452151448b1ada4e97fe117e38b26d0f51ce466d184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668174, "uuid": "45027999-b526-466c-957b-b32cdf547283", "comment": "Malware payload (Mirai)", "value": "7c83fd8a5b997f7fe7ac1a7e406dd25842f56b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668174, "uuid": "42d9246f-ed6f-4c7e-beff-3a32642f2072", "comment": "Malware payload (Mirai)", "value": "dba4e0e1aa042c786cb1b39b60145858951b528ac6ca80b0b1e0744f8810daa3d51adca7ffa6aef68ef767346b4fe180", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668174, "uuid": "ba719dd6-1c36-4947-ac37-557d4303ecbc", "value": "T1BD635BC99613D8F9ED2A0D316073F7329A36F5354036FA83D7649636F852B02F60629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668174, "uuid": "5d5d9c96-d8c6-483d-8d48-b2aab36e8a83", "value": "1536:NdcEBA5SLejo6p11xQ9JqhozFy2YsgwM9Bb7cwRfgC8sLSOxG+xgqGRRy:NdccISLeM6rvQ9AhB2YsgV7cwJFt2yGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668174, "uuid": "111a9a98-0bb0-4490-af8e-2c14a682a399", "value": 71536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668174, "uuid": "85d43d18-fce6-4fce-9fbc-b77c3250ffd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668174, "uuid": "a080c297-1c59-4b39-9d11-8f02c6136cb3", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875ca33d-d7d6-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1765597684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765597684, "uuid": "149aa831-12d2-4a6a-bda2-984d7e5eb850", "comment": "Malware payload (Vidar)", "value": "7034ebeb54664cda46d9912af82ceb84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765597684, "uuid": "43caf319-e52b-40d2-a874-d6961bde892c", "comment": "Malware payload (Vidar)", "value": "98e813ee69ab1a034e3fae2966c4f5e68681e59950254e78857003a821772fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765597684, "uuid": "5d0f9d5d-73d1-4bcf-ad53-d992b9ebecd1", "comment": "Malware payload (Vidar)", "value": "119d3b46e7a97eac662585bc90d27342f6d348bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765597684, "uuid": "ab27bb06-8ea7-48cd-b277-61c1d870e344", "comment": "Malware payload (Vidar)", "value": "0ec68c8323fdd0ac825e4c421e96fd3dccc96acf59bedab9672c3c8465c64d9dd74f3914c75c6ba0496e905a993de08a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765597684, "uuid": "8e3b5536-acc1-4d38-ab5b-eadde214c7be", "value": "T1C4B66D929990066AD5ABF239ECA251553330BC04037624E7BB952BB94D77FC4133BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765597684, "uuid": "28a70021-a562-41da-8934-d009ef21ca97", "value": "0951d9f67c9a9e1b6ea746ed01bccc26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765597684, "uuid": "c37bec24-ea2f-4fa2-8128-184ec289709b", "value": "49152:35st7xHfFsmgGcvSeqtuKBCfBeT4+sEOPYfPPeWvkhFZnVjJ8z1qGJE92R8omdjL:3MNqGwzdRT24jGUTb9QA+sBJ8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765597684, "uuid": "acf4f746-e444-483c-a258-6cba3da3a80e", "value": 11074152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765597684, "uuid": "2c7d3257-451f-402a-a6dc-7198db9df7ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765597684, "uuid": "48b3e83d-633c-4d70-99ed-f4c68c8c7132", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920f3e60-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666421, "uuid": "5423aada-c7e4-470c-bfeb-ab360460d31c", "comment": "Malware payload (Mirai)", "value": "08a1499f5a3136b3715d9b5c12d7cf74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666421, "uuid": "aed185af-32e0-4a2b-85a7-640bfbb92e47", "comment": "Malware payload (Mirai)", "value": "994d9f115e5d5752c002cccc8a8cc6a53f46ce4c293a545689085d9fae61d36d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666421, "uuid": "af7f1f7b-48d7-4201-96c7-ffd75ebc50c4", "comment": "Malware payload (Mirai)", "value": "0adf3899258aadd5cd97fa73e7c24ef22be382ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666421, "uuid": "addc97b2-5518-437e-9de2-74ab2fd95045", "comment": "Malware payload (Mirai)", "value": "fb6d50e1cf9b12b4e7d1ce332e411fd2b1881513756255d982ae67c392388510418322ab1e54c958531938e4c3fb6bd8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666421, "uuid": "6c163094-140b-4afd-ab58-d3a28f16fd22", "value": "T1036197F5B431637036C88D3CB11958986AEBD9B9B0782715B9D66C73C0DC9193229F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666421, "uuid": "aa5297f5-7be8-448f-8b32-e8b628d817fd", "value": "96:fiXBb0Bym8V9p8J0fmUXMiXOCfKIil/c/L:fiX9003LnXJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666421, "uuid": "76430759-7953-48de-8465-6d120ad9e51c", "value": 3216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666421, "uuid": "1b376d4b-f3d3-4724-aeb7-d9e64bf20fb6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666421, "uuid": "e54c85cb-9414-408f-96a2-406eed284805", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1d1459-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605292, "uuid": "165bd5ed-851c-4f56-bdef-a5bbafb50815", "comment": "Malware payload", "value": "837c50d022bf11f0615bb3e39673eeae", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605292, "uuid": "ee10905e-3231-4821-8694-676eee6b585a", "comment": "Malware payload", "value": "9980f0690a0ac82bff26348b4315b7af8b895fce21682859884e6b030fe9350f", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605292, "uuid": "cddb689f-8c9f-48fe-b4b5-238de9745542", "comment": "Malware payload", "value": "739c85d1e389ed1374995b018dfd8ff5ee96a7c2", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605292, "uuid": "3be5249b-58e7-44a6-94be-53fac94ffdd0", "comment": "Malware payload", "value": "2a66db67c8abe4840820be48b6d4f5753037f2d23a35ad9bfa26480a690d005542ace1a1989a976852323e83844ea0a8", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605292, "uuid": "b54227ea-0a83-4167-9bb0-b1e7da992f38", "value": "T154942A63E3982804CBB886F58B599358BA35FB5C1370437B7B5062E6ADF63540E1BF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605292, "uuid": "1b566096-641c-4743-9d09-9c9764960648", "value": "6144:z4QZVhf5x8vGrq0x5XTQOJrnVpUtGixECiusL:c+hf5x8er39TQwTOGixECiusL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605292, "uuid": "e5616f94-d7ea-4a87-9752-eb50fdb11c4c", "value": 447280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605292, "uuid": "e3a00ed8-854d-4082-8bb1-0542a21dab7f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605292, "uuid": "c77ea5c3-0c4c-4bbc-8542-7b85e802ce14", "value": "9980f0690a0ac82bff26348b4315b7af8b895fce21682859884e6b030fe9350f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefbaa02-d872-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765664859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664859, "uuid": "7c35f9e3-e2dd-4acd-83e5-13f273e337a3", "comment": "Malware payload (Mirai)", "value": "fe7e0577f3e59eb217a6e72cd04f7efc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664859, "uuid": "3afa43c0-61d2-46e3-b3d4-71724c714731", "comment": "Malware payload (Mirai)", "value": "99e541786ccc5f2999909bca759f5b6f8ac707a607dfb7a79d4636b6493c6cf0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664859, "uuid": "49d9c4b3-f322-47ee-8563-a660ca3b4bd6", "comment": "Malware payload (Mirai)", "value": "af98c4fad93ed03a68d9ca7890ff305e4f18ec05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664859, "uuid": "1f0ade91-64d5-47ed-8e85-7d16dabea74a", "comment": "Malware payload (Mirai)", "value": "52fc7079c74b70d584804de6cabbcab2780ad9e3791be0213620855b811f41f4e0c1fde1f56fec088b2bce6ef4b07896", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664859, "uuid": "0a2f76f5-da85-4804-a537-9d6ea63c5c1c", "value": "T13CA34AD7F400CEBEF80AD77B4457091AB535A3E206831B276367B967FD321961862EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664859, "uuid": "2055d08a-e3c5-4a13-bbbe-5e267d26184a", "value": "3072:HtgNbQo9iJkEsSy0yl/Zf1r4R1Snvz9x1g:iD9twylBf1rC1U9x1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765664859, "uuid": "c7feffc7-e4a3-4fa9-8754-977b7afcdf9f", "value": 100968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765664859, "uuid": "2ea4ff0e-4812-4dc8-9535-cfdb7d4e055d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664859, "uuid": "7b603ead-b16b-44c6-ae7d-b5b8d5b1aee4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8a9a22-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605234, "uuid": "4dcb8483-9ea8-47c0-bab5-a8997adf9cdb", "comment": "Malware payload", "value": "283bd339c2fcdcca137eaf318ac96c69", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605234, "uuid": "639bd2e2-5351-4dff-a5af-948f209345d7", "comment": "Malware payload", "value": "9a4f5fbabc972a1846356e8fb3dd044434bee88deeb0b21e6013c4b84f11c802", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605234, "uuid": "d2bfd483-b675-4b8a-b7cf-c93656b4e69b", "comment": "Malware payload", "value": "bed919639280b7d74ac7f3a28fa88802e65d6185", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605234, "uuid": "93c0d6a6-640e-4141-a94c-fded6ae69a83", "comment": "Malware payload", "value": "103f78222b90d431b15d0e6a4e2d8c3122595d3c1aae39452f2401440b2d19df6ed24ffac9df206e2c49da3a2a742465", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605234, "uuid": "58bda564-bfa2-4861-87f6-9a646b890925", "value": "T1EB842AA3E7482404C3B846B58A2D5358BE35FB4C5B7013BB3B50A2FA9EF93544D1AF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605234, "uuid": "71257316-a01f-4da5-8401-3af686e9a085", "value": "3072:8FCm6KEKd70hmXz9m5/XZleSyg/MOHyA8uVUy0oMzraRbgqkg1+Wxgu/pFGJPHnK:traF9a8uVB9MzrU9+PHnuiuN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605234, "uuid": "9da6efb6-3bd3-4be2-a8d1-a1195e4556b4", "value": 390448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605234, "uuid": "68f6ca81-8972-4721-aa10-c0aeb1bf4db3", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605234, "uuid": "5e0a1481-c579-41c9-8427-30496bff5308", "value": "9a4f5fbabc972a1846356e8fb3dd044434bee88deeb0b21e6013c4b84f11c802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6452b8e-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668173, "uuid": "a8711eaa-ec66-46c4-8f80-38a074bc002e", "comment": "Malware payload (Mirai)", "value": "9d0b3469e20a761416211b82a71bede1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668173, "uuid": "9ac0e10e-57b7-4a75-8cd1-9c316af70620", "comment": "Malware payload (Mirai)", "value": "9a604ae62b8b80e8c8a6152f274fd728c646b0c4ec93ab676ae84cccedb524ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668173, "uuid": "a8a662f7-0506-43d0-aea5-150904acb557", "comment": "Malware payload (Mirai)", "value": "f14fe4809f96923d82d529d994c8d7a63949a98a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668173, "uuid": "e65f4397-9a11-4bb9-9119-38813789160b", "comment": "Malware payload (Mirai)", "value": "039b535262df85ee9b2c29c8016a7e85f0665905ebfd5399e529785b2fbea7a25c80c6e015655e47adc0806d83c004d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668173, "uuid": "c1f1840f-378a-49ac-a01a-3efe4e3f3865", "value": "T14E534BC8A613D8F5EC190A34147BE7725E75E13E0429FB93D7B4EA31B802B41A9067ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668173, "uuid": "63ef0702-5225-4e54-be15-6daa974b5741", "value": "1536:MM0AJIP6Gj+hXA++lpbPRvzFyM1RIwx+oGJok+QxBh7M9EqRR:H0QG6Gj+VzmDR44IwxfPPETME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668173, "uuid": "a68f2ed8-9d15-4f2d-905e-77b3c8fe366d", "value": 66512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668173, "uuid": "8f20a67b-6db7-4330-add9-0b689beb76fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668173, "uuid": "5470457c-5fd1-4ba0-817a-9f2227da800d", "value": "nklx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6550ebb-d83b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765641115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765641115, "uuid": "12a43a09-1175-43cd-8c19-22bf27b3e850", "comment": "Malware payload", "value": "9d235d89370f5ffa16d3ee2814834403", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765641115, "uuid": "05587dc2-1e27-4cf2-85ce-b2f51b44a4e3", "comment": "Malware payload", "value": "9a92829cb05d9539aa771272659514de94f57bd308abd83239aedb28f13961e8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765641115, "uuid": "60c01870-eb9e-4de8-b6e9-05eb89f1113b", "comment": "Malware payload", "value": "5c36929a07bc3164d23311b14fb73618d137071c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765641115, "uuid": "2b321bc9-29d7-4b55-b819-c6031fed3ca5", "comment": "Malware payload", "value": "99c09ec6e059b9aa38c198a68daf508364c61b92f3ac4b6ffd022fdaa63ba27a065f16efa083988de644dc9f27a967da", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765641115, "uuid": "aee13452-7b92-4e65-b57b-564dca5ff692", "value": "T1DF4124BAF8A28E3033ADC5BD7489254CA7569A6F491B2E74F043783C2BBC3247074395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765641115, "uuid": "fa239273-ecdf-4d3c-9b73-b81f2fe7c7e6", "value": "48:vkwvpihneZZn1oBydXlwtonmzEvJGU6ljiPq2MTCki:vkwYheZZK8a2mzIj6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765641115, "uuid": "766fc4e2-a06e-40dd-a77d-5e6dd6439156", "value": 2081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765641115, "uuid": "f0e31d57-d1f1-4590-9095-8f38a7fbc671", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765641115, "uuid": "f0b69807-f7e8-4201-8246-31a97509432f", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd1d3a5-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615871, "uuid": "7e76e911-cb60-4820-9f99-378ce4d3e235", "comment": "Malware payload (Rhadamanthys)", "value": "bc7812ec8bb23ccc86044a6b1dc3c05e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615871, "uuid": "092dbfc4-f997-471b-8fa5-d4558d75d20d", "comment": "Malware payload (Rhadamanthys)", "value": "9b071dfebf819f985508d34a1b0df4f321d4b02468dc7b463ded9553d95f183f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615871, "uuid": "24778ddc-535a-4dec-971b-38edad32ef29", "comment": "Malware payload (Rhadamanthys)", "value": "c674d0af3edbd023ef8bfa203e86282a1322aa99", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615871, "uuid": "4cb3b417-f9ec-4b3f-b0e7-fdf804d95ec6", "comment": "Malware payload (Rhadamanthys)", "value": "b5dcea0cb41b967b643770f66d471e2b59869a412dbdb2638a9b5978ac7c48ad47ee363e186fcd996f4732cb242a89eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615871, "uuid": "70802292-81f5-4424-8087-2ed4e8a19c26", "value": "T168930A88ED23FCE5B49365C74DC959E2668D8D1A693AE13C6C8EFE61C009B1C76502CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615871, "uuid": "7fcda4bc-5744-4e94-8ca5-5c6f9fc5d7cc", "value": "1536:GDB7eKg20Fb0Grmr84+4wM2T1EAWmFceq6BkQWJ+aY:GDB7b0Fb0cch+1M2T1CmFceq6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615871, "uuid": "116a7568-1127-4745-ab7f-e019bd7722b0", "value": 96821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615871, "uuid": "dad102d2-d34e-4b6f-9ba3-0beab69312a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615871, "uuid": "0d3aaf6e-6bf7-4df3-884e-d229afa5b086", "value": "invoice-1637482117.pdf (18).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e07d645-d7ef-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765608218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608218, "uuid": "2da3f46c-0d6d-42c7-8e34-e8da68cc1e8a", "comment": "Malware payload", "value": "dbb56cc263ed4d6857bff3f0cacbbba4", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608218, "uuid": "9aa09b4a-63e9-4f64-8d3d-5a963c822c09", "comment": "Malware payload", "value": "9b295537b34f8be93ced83167121d1b99639302dd95b3f8f29c2c56809210c92", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608218, "uuid": "6322f16d-aedb-40fb-868c-f4c82fa6d9d0", "comment": "Malware payload", "value": "dab5763af452d01ba1944b3c9fdb7da641894ae7", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608218, "uuid": "308e7475-d7c7-482f-bc8a-5e745cb21ba2", "comment": "Malware payload", "value": "c119e98b739ea122fac854ee76ed1397d3521801e1f95ef9819fd77909cc50fa6cd7646128036b34ce5ecb5e1bf2d03b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608218, "uuid": "844e0111-b302-4b85-826e-1319556fb6cf", "value": "T17B045FCAC99A84EE475FA075415F1F87CF8D14870A1DD9C13A9DEE8C6F21EA4B0A63D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608218, "uuid": "70bc068a-765d-46a8-aa17-3d3a069bf556", "value": "3072:f278GaNmbYtSn0JOMAgPMFhZydT87PEBbMK9loxC09XMICpqf:s89NmbYtSn0JOMAgPMFhZydmWdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765608218, "uuid": "6da733f4-c0b7-4067-b52a-693f4c0718f1", "value": 178182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765608218, "uuid": "81e22165-1a90-4fc0-9d1b-1832575545a3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608218, "uuid": "46d31b4c-be26-47b6-b10e-f34fb12ef3c9", "value": "Summer_Summary_Draft_201.mp3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d370b4-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605202, "uuid": "eecf9be1-e744-4774-b63f-75e1f8c27cda", "comment": "Malware payload", "value": "bd52f3d8177c13f0586297d6359788ef", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605202, "uuid": "a1ed2561-29c9-4e43-ad61-32c31f4fc935", "comment": "Malware payload", "value": "9bc2157f451274b3e3c005e4b643a5b6637dc5878b6d20952d9c3f561fa9b067", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605202, "uuid": "976cfdd2-9287-4fa3-ae59-3724bcab8fa2", "comment": "Malware payload", "value": "87f69765ac4437d31f935f81fac6f70826e53d48", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605202, "uuid": "283117a6-a1e4-41d5-8b83-f4305a5313d8", "comment": "Malware payload", "value": "24424c71dd5bfbdc542a6cc0e145ee20deb84bcba4a8b3ca802c3a9c4bd90567417ab0c6d76aefb0abb91cd61f616c86", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605202, "uuid": "210c7480-129d-4e1a-96c7-a41ac663fa21", "value": "T136843B63E3682404C3B842B5CA295358B935FB9C577003BB7B90A2FAAEF53544D1BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605202, "uuid": "d15e9836-4543-4aec-aafe-0c1dddc715a4", "value": "3072:4FCm7qEq970hNXz9H5/AZtBSeo4fkyiGh3VUyW3uRfaRNYf66xUWxp/GJPbPjge+:RS6o9XGh3VBbBl+PHdyiu/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605202, "uuid": "78c6538d-2765-4d9b-87bc-58ed600efa19", "value": 389984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605202, "uuid": "9363db80-d373-4888-8a00-482addc90bee", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605202, "uuid": "0912add0-686b-4cec-934a-3ef20b6befc5", "value": "9bc2157f451274b3e3c005e4b643a5b6637dc5878b6d20952d9c3f561fa9b067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7205fd-d7f3-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765609965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609965, "uuid": "45c3acb1-398c-4bb1-8bfb-9964b06e30dd", "comment": "Malware payload", "value": "377cbcf266df2742c9f7a500ef6e850d", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609965, "uuid": "ea0828da-659f-442c-bb99-4cd5298ea673", "comment": "Malware payload", "value": "9be5fc0a61e27ebc701962d98ac0532e3753e4d5a68cdab942c652e52307a244", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609965, "uuid": "0ff224ae-e17f-46c2-8b6f-4fc7881f1cf1", "comment": "Malware payload", "value": "df451303628951abfc8383f501bb12e2dba732c0", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765609965, "uuid": "89da94ae-505f-4218-af16-1cf79e322df0", "comment": "Malware payload", "value": "9d1204d69a0dd82a4874d6b346c12712cf2190b79d41f48008bfd676dadb02c335ff03b1f8a6736327b350b8afd1ff89", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "account-bo0king-co", "colour": "#26E070", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609965, "uuid": "4fa41fa3-f180-42ab-8acb-0d0d04fb6ccb", "value": "T14A34092FBBA7CEA0C1088633C0D6440453F6DE97A673E72F34883B5A5D167DEC942A95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609965, "uuid": "0c29029b-cfda-404b-8a02-578caff84cdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609965, "uuid": "63f9f4e6-8dc5-461e-ba51-234e1eb0c7ad", "value": "3072:lQ2DaYhyEY58WK9Nn3+qY5jzb7TAADujC312zhODJYFGT5QCeVnu:92YcX5fqY5nujo12MSFGTJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765609965, "uuid": "e395d1e5-ef16-454b-9ce0-51e411331cd0", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765609965, "uuid": "c921b62f-7d06-4a5c-9eda-5292b4cd4b60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765609965, "uuid": "3e9042dc-2319-45eb-b8ba-407bc1a0e3ad", "value": "9be5fc0a61e27ebc701962d98ac0532e3753e4d5a68cdab942c652e52307a244(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3649eed0-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667126, "uuid": "ec08572e-8b9b-4d4a-821d-97e8610e2213", "comment": "Malware payload (Mirai)", "value": "00289a6a1b7c39e5cff536d4813b2b46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667126, "uuid": "6cc61e92-c7a3-46f8-ac0d-d69f39427daf", "comment": "Malware payload (Mirai)", "value": "9c02fb973facc9ce807d46179c21124e9edd37febcb1db49b7a7055cfffae72e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667126, "uuid": "024ac51c-f9dc-449d-938d-6840b4c9a719", "comment": "Malware payload (Mirai)", "value": "0a4b4053777403f3f632c8eeba72686f2a4aaea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667126, "uuid": "077421fd-9869-4bfd-8beb-119629d11b4e", "comment": "Malware payload (Mirai)", "value": "1bded4dd72864f50177d3f1282eec9f0df56012709a4f9f084cd6f8fcdb15aa383d8fa4ebfa9d89c5de69da782b1ee14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667126, "uuid": "d2c6781f-4d41-4976-b1a0-4e995cfa7818", "value": "T1946302BFA073AE7AC093C17106939C80FE1D30EB58062A9F664BF49C86B31D67D5B411", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667126, "uuid": "3b813fab-3443-40d1-a977-8ad8ea990024", "value": "1536:DBXKXFU6D37CgBsuQw2B//inxcbN/fHiNbg4YY:uFWgB7Qw2BXOpYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667126, "uuid": "d00dbf3e-be75-451b-80d4-66819deb7811", "value": 71628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667126, "uuid": "cb6ced29-5425-4716-920f-4d776d4de9c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667126, "uuid": "e627cf91-6c7a-423e-89ad-92e462505f2f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5595bc-d852-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1765650951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650951, "uuid": "8cacc9ff-1e1e-4245-96fe-1aa77c9e4e3a", "comment": "Malware payload (Stealc)", "value": "d9de836e645c40db5576d7334976fd8a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650951, "uuid": "8e74996f-dfa4-409e-b8f4-22996c5d68e1", "comment": "Malware payload (Stealc)", "value": "9c2a2efdab4195801905c2f9224099f9a017075e773c9660e56bed3fad08b23e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650951, "uuid": "61a351ae-ac4b-411d-8c89-42925ce5ae73", "comment": "Malware payload (Stealc)", "value": "349d06aa67b8e886e1bb56f4c9e659f307e8643b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650951, "uuid": "96119d72-b06f-44a2-a03f-5584566ae4f1", "comment": "Malware payload (Stealc)", "value": "43f3939ee4b1b9fa4245d4534b3b3bc8fa6e29c319a9588f5a40a77061a89fab2d4ef336ea2b615f10280ef8f753b382", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650951, "uuid": "ef2bbec3-95dd-45ba-b06a-a28d730b86cd", "value": "T164E30A26B6E4A0B6D4B6137889F6825356317CA01F7693BF32C0B7BD1E326C1A531B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650951, "uuid": "b89c244e-8ad3-4e7d-99dc-0738dc325c09", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650951, "uuid": "29ecafa2-dfa5-412c-894f-77f51aafa084", "value": "1536:7rae78zjORCDGwfdCSog01313Is5gvhJh5trHtNULMgs0nph:xahKyd2n31R5uHtSFs0nph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650951, "uuid": "d77ea427-c16a-47e9-bd04-08ce52b848df", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650951, "uuid": "29359f7a-e606-4933-9393-3238b6d4359e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650951, "uuid": "0a1d663b-009a-42cb-b4a3-e7c2d3d5e15b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39002557-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615591, "uuid": "7b5b1c30-a88a-42de-93a8-72dcbcadd08b", "comment": "Malware payload (Rhadamanthys)", "value": "87a075d80af63f16128b1eb0f4160cf8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615591, "uuid": "f047a539-4072-495e-9a82-ccdc9c340ed2", "comment": "Malware payload (Rhadamanthys)", "value": "9cbe0cdd154833ee918f302dc3347de569fc7cbf2212a758c681f6b1748eb624", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615591, "uuid": "243ca6c8-350d-44b8-b5a5-f984f874f1d9", "comment": "Malware payload (Rhadamanthys)", "value": "8f46702336b3c02822dceab726facdf495584d17", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615591, "uuid": "06471893-33cb-403d-a142-1bacdafe49e2", "comment": "Malware payload (Rhadamanthys)", "value": "334417fdb8eb821a4e1b6d62b80bd0c1e805220c3ea58cfb87c9fedd639b2da54a25a52681f7e0a4e90f6478c89d235b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615591, "uuid": "69d7766e-d15d-4afd-b8dc-22f84ec46da8", "value": "T10CA33AD617C3AD361936F418C7AA41F0FE2EC4EA7C61A856096B7B443B18F502D92ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615591, "uuid": "3d1c6cc7-7818-4579-9c70-48052e2d787a", "value": "1536:GDB7eKg2075pForzrw4LatLLlooAj342Qv6BkQWJ+aY:GDB7b0nFaPFLaLLlor342Qv6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615591, "uuid": "d2f572c9-1857-4bf0-b659-4684275453eb", "value": 100772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615591, "uuid": "b086d6f6-56bb-4e48-9a0f-78da7023ae0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615591, "uuid": "8e254d6f-0029-4862-96f9-41344c219938", "value": "invoice-1637482117.pdf (82).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2473f2d4-d839-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1765640038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765640038, "uuid": "25a66c4e-9120-4941-8f79-cbc8e77d7f62", "comment": "Malware payload (QuasarRAT)", "value": "0fe7e69bc6f4b0223f27656c4eb6edcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765640038, "uuid": "75ec7e9a-43a2-47f0-a12e-f4946232aae8", "comment": "Malware payload (QuasarRAT)", "value": "9dcf7893b4c18e6d1ed5554231b57937226adc8c3be8c389b715454fe75b6ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765640038, "uuid": "0a9e7f14-c8d7-4cd7-8c25-abc86773395a", "comment": "Malware payload (QuasarRAT)", "value": "14129838382a816b9ac391af20a77a3289322a0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765640038, "uuid": "8e313cf7-58f7-4986-ba2b-838454f4639b", "comment": "Malware payload (QuasarRAT)", "value": "3425609c3e1cf1a63ee8c31a0d9350b92b6a61e4571bb9d901225fefcd4e60b79de73be6e5789015d3ca4028f0e1c7dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765640038, "uuid": "fdfd0cc6-7577-415c-8456-cb0b4cea3470", "value": "T174F54B60B7F86E23F1BBE273E5B0001277F2E85AB363F74B518166791C53B985801A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765640038, "uuid": "485f3f8f-2c3e-46fd-9296-29d2237be89c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765640038, "uuid": "7eff615f-7a1d-43bf-aba0-b3fd15dd1e23", "value": "49152:LvK3dH2tOaIStYPnlew/yKfPkeRVCI1JzLoGdndsTHHB72eh2NTr:Lvwd2tOaIStYPnlew/bfPkeRVCcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765640038, "uuid": "9c08fdb5-daa8-468c-9157-16b8f88a389b", "value": 3335168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765640038, "uuid": "56094d84-d348-4f34-beb0-63a2b3cb7e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765640038, "uuid": "f28c99fa-2cdf-456a-ade2-ebb17727d71e", "value": "meta_face.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dad81f-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639133, "uuid": "fdc20a01-c967-4d82-9dcb-781a489649f9", "comment": "Malware payload (Mirai)", "value": "070b537e356b13e2268342ce6ebfe325", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639133, "uuid": "fe46a162-97cf-4b9d-a940-4974de9baaf7", "comment": "Malware payload (Mirai)", "value": "9e3c47a31bebc3f24e4da6f2f985dcffae991cc36f3c59ba49f6d264ae96af1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639133, "uuid": "ec327431-7d32-4859-a4ac-15854d0cf84b", "comment": "Malware payload (Mirai)", "value": "1feec09f582caccfcecdcfd518311a268c261db1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639133, "uuid": "a1e15b0b-6e5c-484f-896c-68daa477926b", "comment": "Malware payload (Mirai)", "value": "e5a33040f3432cffb7ba4e4c46d0f67cf89335291803871de868061bba9cbd641e8df0d860ef9d612e6c3bf6553f60e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639133, "uuid": "bc1e0429-bbac-4024-b318-c8d6e64c1711", "value": "T100B339C0EA47D4F5DD1642302277F73B9A32F57A1139DA83E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639133, "uuid": "c09d155e-a0f0-4ada-964f-573b1b61f5cf", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEhsohHw0pJbLH:XFmzY5mXBypzjYYZ/5+JJlHLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639133, "uuid": "2c9be173-8657-4cb2-9312-b3ef3fff8895", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639133, "uuid": "ad2714e5-eee1-4ce3-a47a-c95f26dc072d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639133, "uuid": "c19a6db4-d128-464b-9449-015259129c44", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd0cdde-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667459, "uuid": "733289fc-4b50-4992-a41d-ecb99df31893", "comment": "Malware payload (Mirai)", "value": "724568defb67d25e567ba967178bb144", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667459, "uuid": "eb82a563-aa66-4e2d-9679-651c17f1183b", "comment": "Malware payload (Mirai)", "value": "9e6315ebf8ecaaa3ef53763ce8176ea376800042baceae86cafe74ccf7489d68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667459, "uuid": "baaeebcd-d217-4e07-99b6-85fe898c3162", "comment": "Malware payload (Mirai)", "value": "b89c2c40110f86c104a56f25804f721672d34e84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667459, "uuid": "bd060786-565f-45f2-bfef-494ff1762216", "comment": "Malware payload (Mirai)", "value": "15c4d24af18e1f7199f0e69432b1a8945b7e989733cc230e3420f5b80433a9f37f336a9641a57646679cd2b22342b976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667459, "uuid": "0e2d0cf7-89c3-4257-9855-54cde60a17b8", "value": "T11773A60F2E729FAEF67D873547B78E20D74563D223E08685D26CE9045A7034D682FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667459, "uuid": "a73e2d60-e6e7-40a1-a9aa-49306eae39f8", "value": "1536:AdCwcOptKmK4+gZwO8FyVTGVVjGVV5JSjYsv94bvknv8VRr:I/K4+ZO8mSkDbvknvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667459, "uuid": "69fa5b4f-d85b-4f26-8a07-8e93e63f23b1", "value": 76832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667459, "uuid": "9de2595b-ef97-46d5-b7b2-829870db40f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667459, "uuid": "47063698-539e-407f-b945-cdb642482857", "value": "nabmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb7117d-d87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669075, "uuid": "38cd53b8-69c9-43a7-939e-9e15f9771fe7", "comment": "Malware payload (Mirai)", "value": "600f2c5e633742534c0370cda011f591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669075, "uuid": "f0d236f1-ee3f-4920-8d1d-204a34fc1216", "comment": "Malware payload (Mirai)", "value": "9e910564d805b4e0ffa67ec224590ef459f97295439b9de4ed0c2299c3dc0312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669075, "uuid": "eac31450-a5d6-49e8-9242-850d96533667", "comment": "Malware payload (Mirai)", "value": "d6bec1ba50f22b1af4ba186c9599e5f606fbfe31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669075, "uuid": "0fa6724c-50ec-4fb1-8be9-cf31e34e1d76", "comment": "Malware payload (Mirai)", "value": "69c3e25d6ecd0073a288acfecbe574e43f4171cd7c75bf7777c667a81a6c8ab9cda5897d169dd46551decdc7b63e34bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669075, "uuid": "134d92ec-818d-480b-b444-856f2c7c96fa", "value": "T1CE63E656B991CB51D5C556BAFE0E528C331317B8E3EF73139E14AB243B8B46B0E3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669075, "uuid": "361b1c6a-0083-4d90-b7a0-e1f6e8bcaed9", "value": "1536:UNn+R4qJj2U1FYzhWuQ6nlW3LMZiC/Y8FjsJX7QHYbnv8VR:DRhjuzlQU/Y8FjsJXUHwnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669075, "uuid": "f7e1076e-1cbf-4ba7-a3cc-02de82903894", "value": 68212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669075, "uuid": "46be3ce6-580c-4b00-a208-97553556d757", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669075, "uuid": "c53cb6c0-3d5f-40b0-8f2b-ba708a327ee4", "value": "nabarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db76afe-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615572, "uuid": "abc65a6e-ae67-48da-a8d6-e79e895f6319", "comment": "Malware payload (Rhadamanthys)", "value": "ffb34b3f41b2966ae04a591f9175f7a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615572, "uuid": "150a1bc3-e80d-4a71-858b-f5854b68734b", "comment": "Malware payload (Rhadamanthys)", "value": "a013f831594de08256e403d95586cd801a7a2f2728333c9e9d4ab5faacb3f5eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615572, "uuid": "6acbed34-8948-401c-a6cf-2ef1a0032466", "comment": "Malware payload (Rhadamanthys)", "value": "c294571858079681f1d2897cf3dbc6a1b696f18f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615572, "uuid": "942e650e-5194-47bf-9036-a431f078049c", "comment": "Malware payload (Rhadamanthys)", "value": "f6c2061c225f1e537ddcd343d8b4be82b1027fbb2718da49fec28098b4f34aa8c1e1a6ec040af0ca96a76bd5e61270da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615572, "uuid": "c70e1886-6448-4da0-8072-fd11e978df67", "value": "T18DA3FA164F73BCB22243BD269DC08EEA351609429A22E61CD50AF72DF2D4B458DF16E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615572, "uuid": "e035447c-1174-4bc4-b73a-e338abef8c07", "value": "768:GDhd0i7J4sYKgY/CMNfWd/2K5rrXCcrA6htHscAY1OZmSLAuAAroQW+FF+Ec+0FY:GDB7eKg205rRrA6hicAYw46BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615572, "uuid": "fae9430c-461d-4dec-90d3-35dc7b1c4fc2", "value": 100764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615572, "uuid": "251eec58-50a9-4e09-978e-e7a0cce5d546", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615572, "uuid": "f4606d81-ca31-4de0-8625-ea6fddd60f74", "value": "invoice-1637482117.pdf (84).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "778c3bc8-d804-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765617414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617414, "uuid": "fee4a740-b7f0-4475-aab3-52205b9bcd35", "comment": "Malware payload", "value": "c1171693226b27189a29905aeb05575c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617414, "uuid": "43794bd5-a6ad-4bbc-906a-53e7ba8f8bca", "comment": "Malware payload", "value": "a0ae809ca1cb6cc1ef508bc1c9627c076761ac2a3cf3993fa9e63862a17d05b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617414, "uuid": "9b7e0779-a42c-4e9d-bb95-0bc176e4740d", "comment": "Malware payload", "value": "a6c4387e77b8071d405c8769d23bce84d3aa3a56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617414, "uuid": "8623ef45-77de-49b7-add0-6a7a44363542", "comment": "Malware payload", "value": "e5d874db258d404b674877902402d13afa30bbedce9e122bf041440e52c8ba7025871eeeca5989576b7fd4ff7ccd1e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617414, "uuid": "b7e2799e-333a-4007-ad2d-fcec66b9ade6", "value": "T1DDE733137649773FF06D4A384527A8119B3FBA906D36CDE286F80E0DCD6A0911A7EE47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617414, "uuid": "3e773469-6d3d-4223-9286-87584517353e", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617414, "uuid": "a144b753-0d18-43fa-944d-6d171b315980", "value": "1572864:3biGDJxxSMtMfpReD4pkf2zpfjVYbLqFrumRMiqt:3OmxEMWfpKwkU+qFrumRMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765617414, "uuid": "9b3fc28b-2b99-4e94-93e4-04f5634ffe6c", "value": 63788592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765617414, "uuid": "7fdfb835-5eb5-4ce6-be3c-fff3fcb3ae90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617414, "uuid": "f4fd9639-4990-48bf-af7c-657d3c4c5673", "value": "a0ae809ca1cb6cc1ef508bc1c9627c076761ac2a3cf3993fa9e63862a17d05b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c8c664-d87f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765670338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670338, "uuid": "254d868c-cdd0-4d75-9dc2-fd35925f7e38", "comment": "Malware payload", "value": "ee3ff00531c4a0b32bacfb988fdef8bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670338, "uuid": "b79ced26-917e-4358-a8ea-3a1f5c8af3bd", "comment": "Malware payload", "value": "a166599e051e6455acd472e66dbefa1de90de169dd4a15808a625b79e5826d6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670338, "uuid": "51867baf-46e6-43db-bd57-587efbbe9761", "comment": "Malware payload", "value": "7207709e76c834aeff9b2d7d3414a1d9c76fbdee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670338, "uuid": "be5ba2fb-598c-49f2-9b4a-77b3c4b017a6", "comment": "Malware payload", "value": "d57c2f330b7141413163c49df52f84b5ffc09290066e6daf2420e73ff88cadedf8fd57d193c24b2059c4dd04841bd437", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765670338, "uuid": "2a9a09da-de0a-4213-b939-8ff0cf770119", "value": "T11F731985B8918A63C5D462BBFA5E42CC332553E8D2DF7207DD11AF153B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765670338, "uuid": "52fa6bea-ad47-433c-aff9-41985431e51d", "value": "1536:LYljDntqt8fgYM3g4FkdMTMBN9ekuOFYvGOfnv8VR:LYlj1pmggTStvY+wnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765670338, "uuid": "f769b4dc-5b8f-4a1f-9235-f051eb45dc98", "value": 79728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765670338, "uuid": "c644c179-8da9-4cff-8e94-3ef5ebae9289", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765670338, "uuid": "2843e0aa-65b8-405a-bf3d-61eeb3af1373", "value": "splarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccc3819-d7f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765612591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612591, "uuid": "6b8fd88d-592d-425d-b2d6-9c80a06e09c5", "comment": "Malware payload (Gafgyt)", "value": "bf2d72e82bcbf52e17b4d55758cf8dbc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612591, "uuid": "8f8819c7-ce5a-4f09-b3b2-2bfd5305e929", "comment": "Malware payload (Gafgyt)", "value": "a22c52f0d1142da1eca1c715efdfdbac7a40d7764ce80517a83fc18f3f1778ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612591, "uuid": "ae76a0a4-18ab-477e-8eec-a81e7062c1fc", "comment": "Malware payload (Gafgyt)", "value": "80fd6935b9c256623e9fb0ded884364881a9fc21", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612591, "uuid": "abaffc77-86e5-4789-b00b-4b27af11c1bf", "comment": "Malware payload (Gafgyt)", "value": "213fec80441e5a0e51874bd90892dd023b7d60dde8288e526c48093c585a0467850fbf4334ab95c481d82ec5dce2fbe4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612591, "uuid": "fe3e88ab-ea35-44db-8d67-4589df7f722d", "value": "T1D5115B8B90B046715C62B913336A7604BCB190A7B88B5FFFA8E9FAD640CDE74741D543", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612591, "uuid": "ecedaffc-a8bf-4387-9284-53ccd979cc12", "value": "12:Gn0FnLGUMEe2i0FnLGo2qWYy0FnLR/nsdjIgv0FnLKKNITqLFho0FnLKVwFT+0Fu:1b9FTrGKNIT4hJGVwFT7GC7UN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612591, "uuid": "59d06e67-f59e-4543-84e3-76cb5d3072bb", "value": 1031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612591, "uuid": "36190447-ab5b-4bc0-b732-06a6b25fb366", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612591, "uuid": "3c3e0bb4-5ff4-424a-9490-5b7edff38b26", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5527176c-d859-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765653864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653864, "uuid": "45fbd64d-3910-4238-a644-39cdfa478951", "comment": "Malware payload (Mirai)", "value": "a7c26e4d45d1d4f30806853dc670d3d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653864, "uuid": "eed5b124-88ff-4617-8f73-9aebb208a3c9", "comment": "Malware payload (Mirai)", "value": "a27081f95472af62e60ae14e9cb624a91d86979acac1e62acb7c2ae3c86ee316", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653864, "uuid": "0fbcf7b1-ce61-4fa0-a8ce-a42c641be484", "comment": "Malware payload (Mirai)", "value": "82165ab6fe884743fa6c6edc5113c8f0061de341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653864, "uuid": "043c4bbd-9ed3-4565-9204-7f259ac9e4fc", "comment": "Malware payload (Mirai)", "value": "81dea641eb4dba4cfb3f69bbe4ce1c78bdbacad29101c7a8fa596161d9c5ac95a8d71c3e6fd5da94cacd5acc92c890c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653864, "uuid": "8c246480-bd1f-4a58-8daf-6e6c4be17e7d", "value": "T12E631A86F8818A53C5D562BFFA6E42CD332523A8D2EF7207DD119F147B8A82F0D67641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653864, "uuid": "3cb364ce-fd1d-4cdf-a8c2-98ab08435218", "value": "1536:XaHfBZcZIhhNLFWfKzk4BhfIy75m9f3iqnv8VR:XaHfGKjBhfIy7SfSqnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765653864, "uuid": "97d5aede-9ecd-4a62-82af-484ab87f760e", "value": 72604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765653864, "uuid": "3d96b687-0024-4413-a9e7-7210a81ee50b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653864, "uuid": "73aef2a6-5a40-4373-9249-1732157c31e0", "value": "nklarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9279fb85-d844-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765644947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644947, "uuid": "092531a8-c0bf-45de-9900-de63c89bfb79", "comment": "Malware payload", "value": "4e3433675224d40bedd05cf40beeed6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644947, "uuid": "bf918769-4a70-4091-a526-78de84e7a010", "comment": "Malware payload", "value": "a29828923481108b477df9f34543d24a8f1898e0c96386fcc4b20ed57bd8aff7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644947, "uuid": "075466e3-b685-43b3-9d79-f30dd5716526", "comment": "Malware payload", "value": "98c2a68b8f9167406215aa7aa78dcc7761499d13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644947, "uuid": "5c597961-e066-4c71-9767-2873fc0e49b0", "comment": "Malware payload", "value": "2deeff3527b7ae19b980444d3b04344a07343b33d252d9054cfc23109cc2c7dedd7dc791e75eee106e40b2de5bf5fe29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644947, "uuid": "9610f036-05e7-4509-a901-4a2bb61d2a4b", "value": "T1F9B47DADE66407F8D1EAD574CD024503FB72BC568771A64B03E18EA61F236A09E3FB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644947, "uuid": "8237a854-7b91-47db-9da7-dc5c14446404", "value": "750ca6c9e5661127af630cecd8bf41cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644947, "uuid": "c4814c55-fc6f-4918-abb5-c2ba2a50993c", "value": "6144:7mbDzGKiF9n3K8X9p8LlXSMXKED2ZKbAoTdFNhTxI0hlbFCWnSdtxF6KVsWu2wZ1:7dKiFJvTuRZFNgCwxFNVT3wZozb/tI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765644947, "uuid": "683c47a6-677f-4f9b-a128-d826fe16b22f", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765644947, "uuid": "c335e111-8fa8-4e18-a2dd-012e25788ec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644947, "uuid": "6e499e34-4be5-41f0-96cd-714fba52c4b2", "value": "SecuriteInfo.com.Win64.MalwareX-gen.45934886", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5760dcf5-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667182, "uuid": "5bcc179a-791a-46c2-8320-584101e3b057", "comment": "Malware payload (Mirai)", "value": "507723796b6c6c1ff5d89235eba938ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667182, "uuid": "ef041c61-00e3-425d-94c5-857de58124e0", "comment": "Malware payload (Mirai)", "value": "a2a3f0c86c2034178e7f9dbb1914111ead3bbd405116231240aaad49788dd4b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667182, "uuid": "c1631c76-13d1-4d99-8aec-b70ad46e0e0b", "comment": "Malware payload (Mirai)", "value": "6fa59b6bf10701a248bd7678c3c80288e9e5e9a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667182, "uuid": "07ea7a21-a323-438f-84c4-5f1f9bb67783", "comment": "Malware payload (Mirai)", "value": "a4a59035469c9c3ad7fae65e87ff54861b0eeab413217b445d5ca7d89f41b887c1ace15d5fc2da56784c4ad5e25d7e3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667182, "uuid": "bf444c1d-9151-4b02-8e1d-7499c878086a", "value": "T17244F60AAF610EFBE8ABDE3706E91B0128CD651721A97F367634D514F20A64F19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667182, "uuid": "fdd55249-4d14-4216-91d8-cc12e875cc18", "value": "6144:/QLZdTwADGPhoEPqVapUE8QMhiD0B7VGJR13:/QvqhoapT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667182, "uuid": "6593fba3-6921-463e-beda-024b2153f1fa", "value": 257036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667182, "uuid": "da9d85a5-ccf8-4d16-91a4-49b93dc5b846", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667182, "uuid": "88c6d344-1ad3-4170-9905-0136d9cfedb8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e71d6b-d843-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765644686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644686, "uuid": "59823303-39f8-4da6-b5fc-5b7fb364531a", "comment": "Malware payload (Mirai)", "value": "973ed369e0cdc4b9d3fd42fe6dd3c77e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644686, "uuid": "ee6799f8-b076-4c7e-96b1-665c46fd6a42", "comment": "Malware payload (Mirai)", "value": "a311b3e95beec66ad6d53f6e0f73ee6b3d4b2ccd293dd06f460ca654b0bc29d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644686, "uuid": "f74b39f6-5203-48ed-9d36-93e4e1eb272c", "comment": "Malware payload (Mirai)", "value": "04f3d1759a8108f4c5c9e3d2d3b2a4d44989a8db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644686, "uuid": "981063ab-2076-42b2-b4a2-0419fbd52c80", "comment": "Malware payload (Mirai)", "value": "9bb8eb8db85f2bb0934d3ccdb629a14051148ac52062e4971920e38b6eb56d0930c50353141f4731cfbfd26aa17b70e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644686, "uuid": "59dd8fff-aa98-4859-9558-d231ad87acb0", "value": "T1A9031A92B8D29E66C5D06376BBAE119D3321A3ECD1DF3257CC251B007AC952F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644686, "uuid": "cfcaee5a-e470-4954-bd66-3249f5b6a837", "value": "768:f5BCv7m0c09SHDIbDPFKYpFhlHCkrDp/2b890bwRQ9wTTPrtnN/hS2XDLveQk1df:f07auSilHe8908R+OjrVN5TnQ24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765644686, "uuid": "4d81bf0b-c9f8-4f3f-b189-9303272d7fd1", "value": 40372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765644686, "uuid": "63573aaa-02be-4cd7-963c-987aa62b0a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644686, "uuid": "864bef95-38b4-4ad5-90a0-dddba0056e10", "value": "Mercury.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ab8a06-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615908, "uuid": "0ce7a9d7-b10e-44ef-a95d-ada84e22d188", "comment": "Malware payload (Rhadamanthys)", "value": "0f7d346ab3b470725d662bf50f1d1750", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615908, "uuid": "f35dc625-cd60-48d5-97ec-2e3f99b751b7", "comment": "Malware payload (Rhadamanthys)", "value": "a31c10dd07e92351ce3729eb306f2496a5bc765f2f8ecf1d10310c7928811557", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615908, "uuid": "588a6e33-424a-4098-86dd-02be571a41b0", "comment": "Malware payload (Rhadamanthys)", "value": "7271680f15bafb617215cecf9662b4f37482d71f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615908, "uuid": "6bcb0abe-ffa8-4a4a-a51a-96090d6df918", "comment": "Malware payload (Rhadamanthys)", "value": "51c42e9648b7a78bc6db80f2bfa09ff4bf483469e240f52a34e4c03ddf66f619303d8deec9d09739ade844bed00837e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615908, "uuid": "8531eb4e-c20e-42af-b246-3f35659dc29e", "value": "T1C6A3F9C7DE7B94B2B3C32A9F2B0E05F69D49875A461A60B8B11FAE96211C7713DC40D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615908, "uuid": "4dcd45eb-113f-457a-b5c5-0e4be6772eb5", "value": "768:GDhd0i7J4sYKgY/CMNfWdDJXPrXcWrk2zLDHHm8juSbVAbk1ztGtMSLAuAAroQWK:GDB7eKg20Nrnrk2fyEA8sW6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615908, "uuid": "d5a9443c-4cf0-47af-aa80-72dc6930ef66", "value": 100751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615908, "uuid": "8c28a716-5475-41c9-998c-ab749c412b94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615908, "uuid": "1c502af8-9f29-444c-8d91-b3a1050b4e9d", "value": "invoice-1637482117.pdf (17).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a656e31e-d836-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765638967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765638967, "uuid": "28afb5da-2012-4400-8347-cff4c2e94725", "comment": "Malware payload", "value": "c96c8945ed16bb448571a50b3c98539a", "object_relation": "md5", "Tag": [ { "name": "188-137-248-240", "colour": "#F967D0", "exportable": true, "hide_tag": false }, { "name": "AlliAI", "colour": "#D0D488", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765638967, "uuid": "b6b64e2c-94b4-4545-be8c-50c308ce087f", "comment": "Malware payload", "value": "a380fcaa1ff910f507ee16a65efba06940e62223a077e0c1e7d8ade2407a230d", "object_relation": "sha256", "Tag": [ { "name": "188-137-248-240", "colour": "#F967D0", "exportable": true, "hide_tag": false }, { "name": "AlliAI", "colour": "#D0D488", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765638967, "uuid": "afbb3221-59e6-4270-bfa2-1f95e1b76c0a", "comment": "Malware payload", "value": "0d7313cc2b77ec3fa1f111734fe646e65939bcec", "object_relation": "sha1", "Tag": [ { "name": "188-137-248-240", "colour": "#F967D0", "exportable": true, "hide_tag": false }, { "name": "AlliAI", "colour": "#D0D488", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765638967, "uuid": "65ec098a-e362-4908-bf77-4fe94967bd43", "comment": "Malware payload", "value": "a878e83fe9dbd355c6474d484486dd9968c0500c4c09158fdbdb9153e3ee47b220330aed5b6db4868f4ad870c19871da", "object_relation": "sha3-384", "Tag": [ { "name": "188-137-248-240", "colour": "#F967D0", "exportable": true, "hide_tag": false }, { "name": "AlliAI", "colour": "#D0D488", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765638967, "uuid": "6757367d-7a60-471a-8329-82547078eb25", "value": "T1CBE73317F56D273EE46A45350572A944083FBF60542A8EABDEBC390CDE7E0502CAED87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765638967, "uuid": "40986045-c2d5-40f0-8b26-19ccfc7f865c", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765638967, "uuid": "f276d65a-4e0d-4723-991e-67eb4f7f2df3", "value": "1572864:uvWQIzglOpkMx3v6GFkkjRD1S5sWoEEqFSg:uvEzgl01x3v6rqRxSWWJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765638967, "uuid": "c32ad1d2-2140-49c3-a0d4-5cf555774a71", "value": 64033024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765638967, "uuid": "caf1dadf-45dd-41b8-af0a-dcdf6f5a5fe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765638967, "uuid": "a066fbeb-ca23-4ef2-8cc9-6226819ccbb1", "value": "Alli-Ai_Launcher_v2.03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0963dd14-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615941, "uuid": "5688f5c4-cc6e-4a3c-a222-108e69c13832", "comment": "Malware payload (Rhadamanthys)", "value": "7db2844569b0a2354634820fbc6b7883", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615941, "uuid": "6121699f-01b7-4d12-97bb-5f2087a15235", "comment": "Malware payload (Rhadamanthys)", "value": "a40bd40e2d489fa7a23c012beee2188b72a9a4d60774f5be9161562fea310329", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615941, "uuid": "4f3dd269-6faf-467a-b5c1-45052f4cb06e", "comment": "Malware payload (Rhadamanthys)", "value": "f9a1c9a41c992a8729e04ae6d0ac7e1e27c7b089", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615941, "uuid": "05f18ca0-16a8-4efc-b4ba-299606ce5c3a", "comment": "Malware payload (Rhadamanthys)", "value": "e56daccb910397fc8e0ac4e7f0824c1241397e3f75b977965b001e1c8102c20ea2e9c28d64a6abb736f1ef4c58f7f105", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615941, "uuid": "9ae3b247-a616-4443-a241-9ce1aea29f23", "value": "T1E2A3088438A8BC5A17D42F5C4B8CB3A4ADCB53E14606B9006ABFFBBD597B42D0C445DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615941, "uuid": "88f9807a-b3fd-45fd-97c0-7fdb6e00239c", "value": "3072:GDB7b0Y22XK5JPR75/Ei7KFqD7SrbIXV7a3QPgOV9CKm3F0TF55D/B5UWn4F/423:0X/KXmWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615941, "uuid": "fba83d0d-d46d-42e7-a349-7fd4ec2ef133", "value": 100783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615941, "uuid": "6155c6d9-df5e-4cae-ad59-d3cdeb29e9ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615941, "uuid": "5291f6ba-3434-48fe-836a-4097445afd22", "value": "invoice-1637482117.pdf (9).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53eae81c-d7e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765603610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603610, "uuid": "868d8ea1-91f8-4f6f-8799-0807330d0cb3", "comment": "Malware payload (Mirai)", "value": "f48169cabe5a1bf19b893eea20bfe48b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603610, "uuid": "f99bc9ef-3f1a-4178-ac46-41c43b866f0d", "comment": "Malware payload (Mirai)", "value": "a446383e81440474caf2cb203c63fc4cc02c17736a9c424835adadbc0e6178b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603610, "uuid": "b25f9156-e7db-4e03-bb03-6c3b8dfce139", "comment": "Malware payload (Mirai)", "value": "25fee731d4120bf82a865557f44d2a653eba6401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603610, "uuid": "d6e42e53-5262-4bb6-b839-061d0ff191ff", "comment": "Malware payload (Mirai)", "value": "bbc99e48cbbc62d02caab3a2ac98b3ecf2f9d2a287736766a4b1e2bb660bd7d272e6d84f1c99fa8a58267f9670bf4e5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603610, "uuid": "5a9754f4-9f73-4cb2-a857-0b4361307a33", "value": "T142D3AE73E4397A84C1418574F074AE755B62A09096871EBB7AEAC0B640CBCADF61F7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603610, "uuid": "a256d8b6-9dc5-48af-b3e9-d682799ffb34", "value": "3072:aBiW7Vqdrl6jhUahaEfX8YsIXBer+9ACKHx4pftu6NU2DN8:aIWpol6si8YsIxcCKHxwNU2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765603610, "uuid": "f2789e7a-dd24-48f5-ad95-935233f26517", "value": 141932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765603610, "uuid": "ad57076c-b3c9-4d93-8caa-6220a77fade0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603610, "uuid": "5b6d2330-adb1-4642-8a6c-fe8a16b6327b", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1f79ae-d808-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765619249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619249, "uuid": "51f97bfb-4b49-4ce3-bee9-df2a4b8fa96e", "comment": "Malware payload", "value": "2e425243745cddd66641055607c033c6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619249, "uuid": "8420d892-71fa-405b-b932-c47c78dcb7cd", "comment": "Malware payload", "value": "a48096c66b26cfd59454a415b7dc9941c231aae8ea95d01b199a272fbc617953", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619249, "uuid": "0571dca1-28fc-4b42-afa0-6ebcd0421db6", "comment": "Malware payload", "value": "b9d6c66e20383d836e574eb8939eca5d84e16f36", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619249, "uuid": "cd991993-d979-48a7-8b25-9196ae331c51", "comment": "Malware payload", "value": "c0b0be8e301199027b0bf182d7c077842ce8c67087bd0f271237c786d36c285ae204a6cc71f0a73e438b04143c292609", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619249, "uuid": "6adb0b0b-4690-473c-9715-d55ce4bfdf60", "value": "T1FF0145CF61A45E21E8C24CEDBA730838A5CED5C429D1CE8EA08B0476E08CD043151F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619249, "uuid": "6e47c722-32f1-40ae-9a1b-14f825b728ee", "value": "12:dWKDbnPZ95ZMoOF7+MB05xgMvjgMMDNkD7gMMDjgM5DNkD7gMn5IjDjgMn5IMDN+:EIbr5zOt+MB0Trmk/Mf/k/n5cn5nkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765619249, "uuid": "ffb520ec-2a6c-4bf6-b386-bdc4cd136030", "value": 745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765619249, "uuid": "53819433-f827-4040-a0d5-bf0075d761bc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619249, "uuid": "67cca94a-a582-4ab8-8964-a06ba652d2d0", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee56dbb-d81c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765627788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627788, "uuid": "41357acb-30f5-461a-b825-322085c7f73e", "comment": "Malware payload", "value": "87a0f0dc3769002f17a6fcfc86195ae0", "object_relation": "md5", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627788, "uuid": "cd1db27c-d5da-4137-a338-fc27ff459ff2", "comment": "Malware payload", "value": "a4c71923a0d7090011ecde219d912bafa72c0939d90254304288635f1c20905c", "object_relation": "sha256", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627788, "uuid": "dc585169-6179-488e-925b-6c82c0202848", "comment": "Malware payload", "value": "73ae88a2b0a928cd440e91ecd9db807127d0ee76", "object_relation": "sha1", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627788, "uuid": "34b8b723-6526-49c6-943e-fa3472bcf19a", "comment": "Malware payload", "value": "bea53e9dc5950952671ce10bafca26cba793952c20abde13caec1ac24966affd6dcdde13dbd3ad8a54f7741d4c774fd5", "object_relation": "sha3-384", "Tag": [ { "name": "46-62-255-176", "colour": "#3CF572", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627788, "uuid": "1cfb05a6-a38d-469f-845f-f8b0ee9e1399", "value": "T181930700E511C439F4A600FBC2B207BEB9389B20135615C3E7D1BDF59B6A9D26935EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627788, "uuid": "e0a37be5-85dc-4012-8964-9a207c2cb48f", "value": "b5613813a0d0878919248fa28c63e2a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627788, "uuid": "121566cb-22b9-4f05-8f38-4a61a42e12ff", "value": "1536:KP+ttvpdmi+ccjOOLPM9RcmkxzO77CAcpTWsAyXI2c0K:lZdp+ccSOD5uKCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627788, "uuid": "a4a060fc-eacf-4c63-8061-55bc152e2d53", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627788, "uuid": "bbcd22d9-216f-4ac3-bb53-ed1c03785d31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627788, "uuid": "660a21c5-283c-4896-80d3-f65dd8622dba", "value": "a4c71923a0d7090011ecde219d912bafa72c0939d90254304288635f1c20905c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538facf7-d7cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765593302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593302, "uuid": "2e77d840-a93c-4b1a-93a4-4607f7998b9d", "comment": "Malware payload (Gafgyt)", "value": "c7b9e1f28cb4934042e6c3b6a03e917a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593302, "uuid": "8471d521-164d-4c0a-bb42-59e074e7a590", "comment": "Malware payload (Gafgyt)", "value": "a4cb5422b2a7e49ad24ab4a80a1938fd0989e18d29541389ff6e4d37e40fb296", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593302, "uuid": "3a4272f3-784f-4fad-a4e7-4e49503e5e82", "comment": "Malware payload (Gafgyt)", "value": "54b894eed6180fbc5a1eab08c85a8fe123ce8b9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593302, "uuid": "53f7433c-9a23-40c2-ab27-b84e0e3b3684", "comment": "Malware payload (Gafgyt)", "value": "98e5fe635dc64184d9f0e62212e19b19b758eb7c38efc97c40ab4863dafc72bf80c4656ab7cd8ee390e99da7dec5b194", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593302, "uuid": "3411e498-e9a7-44c7-a377-9a441947cdb6", "value": "T142F3A7AD7A11AB7DD26CC6310BFB6F70D35621D226E2C715E1ACC7285EA038C5C4EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593302, "uuid": "4902a6c4-42b1-42d6-9113-018739788727", "value": "3072:96NFFSZUJrry6xAMBns1mF5hty8fOmK13itKbJ:SHSZUJ3y6x3CmF5htJmmK136KbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765593302, "uuid": "47a25815-82ff-46d9-879e-4e5cd5b748be", "value": 167189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765593302, "uuid": "6b9eff87-8a91-4544-8a89-de2c00cc3aeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593302, "uuid": "ef1554ab-6add-4493-9c26-c1fc42452b0a", "value": "ionetworks.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95885fab-d820-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765629490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629490, "uuid": "58372e74-e5b5-4c4c-999c-fb7cb91b0b0c", "comment": "Malware payload", "value": "7bfc33583c1d08a612a12e65241cf480", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629490, "uuid": "0d65c0f2-180f-4750-8b76-c1121eb581b3", "comment": "Malware payload", "value": "a5209b0596e7a197d5b66b157984c0c680713cc7c24d787bf28e7cb1a3576b21", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629490, "uuid": "cc5928dc-74e4-4314-90df-812871cb9c42", "comment": "Malware payload", "value": "e2ddade425804b28d66c6958d2185c48fd73a411", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629490, "uuid": "0dedaee1-11b1-4c67-830b-5502bb6cfe01", "comment": "Malware payload", "value": "b7426088b88d5d05494d153a3d09e3e4dea948f2ee1287c10dcfb42a6b2c9e485804343780da1a28cd7d68c671869625", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "e3db0b", "colour": "#CF8ABD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629490, "uuid": "17bcc055-0ed1-4276-b8b1-cac2731e01e8", "value": "T1CAE35B67D89184F8D82AD478CADBD22F29B6B481113C664F5DE09F061F72BB0F31DA49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629490, "uuid": "48a2f898-01ba-44a8-afe6-4cb5ca198fd2", "value": "dd5eaf09d8623688596c2c73b0c03622", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629490, "uuid": "ec68e790-883b-4311-b66a-ba4f711e576a", "value": "3072:0MKaRI8jvyeDwNzNEkqSwWlSub5qeoU1Ix+tCQ+:0raxjvyeDwNzfqSv7VqeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765629490, "uuid": "8b940d06-422b-493b-bf33-0ac3634dca31", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765629490, "uuid": "38bbec66-5f55-4e2c-8b33-27d2e0ea422e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629490, "uuid": "a4339850-e52c-4ae4-89ee-83de3d8402fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fe57d3-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765616121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616121, "uuid": "5af3e2c7-2c44-4d49-b9a3-1165ba5f80e3", "comment": "Malware payload (Mirai)", "value": "bb33d7749a07d2d7e792736a47729507", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616121, "uuid": "2ba3f6aa-2060-4be7-a3cc-ea8be962926d", "comment": "Malware payload (Mirai)", "value": "a6cda9aaf6fba825d8188d5ccf561efbd5d2e8128fe46e7be24af6e12b7267c8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616121, "uuid": "931df0d7-bb3a-4509-971f-8aa7cdd0a112", "comment": "Malware payload (Mirai)", "value": "34f3385070ad1ea4d606038baf6e8f7971f0cc3b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616121, "uuid": "6071c9ec-5f9d-4ef6-835c-ca04babd4689", "comment": "Malware payload (Mirai)", "value": "1efe497d58863ea7de2cbde48bfe2e886135b9c2e272fc7c2501a7c662d7e57253cc36c53e1a257363fa16a28597effd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616121, "uuid": "d6430353-be25-4c3e-b49f-31ec381e6255", "value": "T12501C6CD135477BD868CCE0FF6934F6824444ACE4E8A1BCD3ECC54269684ED5F824E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616121, "uuid": "26fecbe9-11a8-429a-afc8-1dfe688d8404", "value": "12:KSs6wZjYTjYtXNyHe0fjYcswjNSYeJB/jKpLjYbynj9:KSKZjgKX67LsUteLKpHuyj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765616121, "uuid": "6d3e3ead-58bc-436c-b76d-2b7010741d7f", "value": 842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765616121, "uuid": "f34f6c9a-a3fa-4974-8774-5cd63636c29d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616121, "uuid": "c5e1f920-8395-4e69-a12d-935f83e69f01", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f76bdc-d800-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765615824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615824, "uuid": "d6ac0648-ef2e-4b23-aece-14b23aba69d0", "comment": "Malware payload", "value": "a3e3ddc5ac2d67abcbf4ff98b20e55f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615824, "uuid": "94a6490b-957a-466a-8c32-3fdd55c8d0dc", "comment": "Malware payload", "value": "a70e2615f93d944d9ccbd15e9e0d384b4307347e51451836327ae9148b38e3b7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615824, "uuid": "8276f1f3-8717-483a-a8fb-a35532007fbc", "comment": "Malware payload", "value": "33e80bd0aaca2732996a197f12d5b5435a6e6c30", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615824, "uuid": "2ac0b1fa-cd58-45fc-afff-c5f32df537fe", "comment": "Malware payload", "value": "4366f7e2867e826946df313d7014b98e04ae43661fd0ce81c9a93d290154e78ea67426781582162462afb907c77bdd50", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615824, "uuid": "f4226120-decc-4a07-9159-aa5fedadeea4", "value": "T18B012DD950A09C1024809C6E729764977923D2C72A9B0FA9FFAD1A3D6F9855DF034F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615824, "uuid": "3b5c11f2-dbed-46c7-af98-86eb5aefeb3a", "value": "24:kXCZG+1ZuZI4Wu9AIm3vAIxH+AIGtNrAINnaAIyxh:e0b54N9A/beQt1fa0xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615824, "uuid": "4d5a09c9-b6f2-4a02-b8f3-ec9ac183769a", "value": 770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615824, "uuid": "f03ca29f-d685-4a5d-8238-a6d9a4e0b223", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615824, "uuid": "db55fd47-d3ab-41eb-807c-8d34c914160b", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28180dee-d86a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765661089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661089, "uuid": "5fbdc566-a444-4eaf-8650-6346ef04c276", "comment": "Malware payload (Mirai)", "value": "37f058d0a3e3c6397b5c6638e960d3ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661089, "uuid": "490589d2-5bc6-402b-ba57-a73ff733c358", "comment": "Malware payload (Mirai)", "value": "a76bb6d6eadc2cb308987edfe2a56b0b42efd47d445b3086284433f8ee428713", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661089, "uuid": "0fea2bf1-0c1c-4700-b17f-aef9f8167743", "comment": "Malware payload (Mirai)", "value": "15a3bcf40f0bb39c48568f08428605040e256ef0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661089, "uuid": "ec58aa9f-aadc-40be-a1e6-1889ab695886", "comment": "Malware payload (Mirai)", "value": "02d16714abc50399942431277a0e4a81cb399f3723b07fbc04806603409aa6562334e7b87b42c4cc6cbea157da2c10a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765661089, "uuid": "3e838bac-d5e2-4b02-9961-8fbce8778921", "value": "T1E9635B4377080A17E5A65E70253F6BE183FFAA6020E0B785650FAF8A4676E331446F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765661089, "uuid": "13975440-0334-4d4b-aca6-e66fada5f8bf", "value": "1536:3H8ZkZC41oynsuVoNBO3WE36xSgpnwDy0bqQOnv8VRP:MCwVfcoy3GSgxzLnvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765661089, "uuid": "3ac9e107-9b65-4a41-a8d8-08221b063ab1", "value": 71964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765661089, "uuid": "3515f95a-f623-4a1e-be9c-46f97d0cdbe7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765661089, "uuid": "d1da60b2-1a8a-4a4f-85c6-ce13c8f6f6ec", "value": "nklppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc49b5d-d81e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765628456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628456, "uuid": "198dc808-cdae-46f6-a38f-510a29fa39b0", "comment": "Malware payload", "value": "f0d0297a2728fa0c5ac08a7bc14b673e", "object_relation": "md5", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628456, "uuid": "a91d3b7b-4e83-4bea-ba52-e896f0fbcfe2", "comment": "Malware payload", "value": "a7dbe88b8cfaecefce57f5856be7f9a2100841bba3ddb164f80dec1065a37fd5", "object_relation": "sha256", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628456, "uuid": "00015d62-1bb7-4655-8601-8f22578d7b55", "comment": "Malware payload", "value": "10df84d103abba445bd8e930cd53e21b826ea927", "object_relation": "sha1", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628456, "uuid": "07521373-a17e-4948-91e2-6fea76f158a7", "comment": "Malware payload", "value": "16aff1b322a87e39078194ccf292b79509f26b86ef5a78919c7e1328fce2dc8a50dc6d102066cab70d6aad7c7e20df92", "object_relation": "sha3-384", "Tag": [ { "name": "95-182-101-109", "colour": "#FC8CE7", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628456, "uuid": "70b782ad-56bd-4a52-a07d-90d94a153b9c", "value": "T1D0D1B447D79E40A2E5B6073AB8E307419370F8518B2BC79F1EE8805A2C257E95A327F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628456, "uuid": "080a2d81-3929-460a-9929-4e7d53ac5274", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628456, "uuid": "bca26ca3-d574-4792-852b-99ba725b9011", "value": "96:CpXbPYujpJ1I+5vzl4pkewdOL9gUM37WK:ozI+Nmpke0OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765628456, "uuid": "3cb0b7eb-55ab-4a29-a2bd-8576b3445c85", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765628456, "uuid": "1894b44f-1641-4f46-a9da-54ae6da78179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628456, "uuid": "1bc0b77a-e4c2-4ad2-bff6-cb35b3849ea0", "value": "0fsppoas.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8b1434-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607037, "uuid": "8d4802ce-9301-4963-a8ed-50349423ceaa", "comment": "Malware payload", "value": "87db85ec801550356d1426a79827e3d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607037, "uuid": "86e6b16c-24c6-4d1c-8e6e-8a7e636afa0d", "comment": "Malware payload", "value": "a7e139fb2af9e8f172e0417db165201d2dfa45f8418227f7b896f21665c09e87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607037, "uuid": "d32df87c-9e3d-4ab7-9c55-14bd210e62ae", "comment": "Malware payload", "value": "ccd8502e9a4ec1b3802c6bd724b61833901aa460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607037, "uuid": "abf7cfdb-1aa3-48fa-b1a2-c794f679ea71", "comment": "Malware payload", "value": "db24ef50da229b70430448446d5c1a63cf50f8617fb499914fbee6e32457555ec6df5134b6460be43e02d866274391f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607037, "uuid": "9cd4a009-0c3e-4fed-844c-483e92a47b02", "value": "T1C5953C15F7F2015AD2AEF138E8CE4909E2A3B942476EC6DF025E13253967BD2267D703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607037, "uuid": "6a5310d4-18dd-45ff-b9f8-db4b5d15a202", "value": "86962b2ddbf99fb8355cda2d124ba099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607037, "uuid": "c765cfe1-a1d2-4653-8263-f6d0de88c4a5", "value": "24576:S27nIqKO8jh3Wm8iQsN9ibyTYB20GQj8kUFexJxLqySQUk6:nUVljh3SsjibyTW20GQj8M9ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607037, "uuid": "8fefd957-f174-4e5d-955c-c1fc29fc0d7b", "value": 1961984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607037, "uuid": "4c0f4e70-708b-4abf-8e28-4e211c775986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607037, "uuid": "dcc57a60-58a0-4d58-8f8c-4d216a1c46aa", "value": "a7e139fb2af9e8f172e0417db165201d2dfa45f8418227f7b896f21665c09e87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88611cb-d7e5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765604236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765604236, "uuid": "4e6923bc-2c29-459a-8e26-65b1c98be794", "comment": "Malware payload", "value": "2b9bfef7b5fa684c7f7eb2d243acd286", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765604236, "uuid": "8caf51fe-e1bd-4997-b7a8-4e61ae209b31", "comment": "Malware payload", "value": "a7e2cf0899ad819ba675df1c413ae4a89d4eca70a1c73827f9f4d7bcc878c369", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765604236, "uuid": "d461ca90-7e06-4a84-894c-bb6f5e8d3da3", "comment": "Malware payload", "value": "b0cbfc3e5fc772a52f5d3dfec7c7ed91b469b08f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765604236, "uuid": "093c12d7-f016-44f0-aded-0e1abd999c79", "comment": "Malware payload", "value": "9d25496cdb9b66936b396d651a07132f61ca511a20bed5477bdb180d5ca49076779419de972173ef0406d95d8007ef0c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765604236, "uuid": "f6f352d6-7713-40ec-9323-b62bf0f9665a", "value": "T139F3634A7FDB58EDC28F2125C04FDE038B890603568FD8D0B54FA6C8BF566A7526D2E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765604236, "uuid": "7e8d31e3-8c32-44cc-a988-2adc5dbd9f6a", "value": "3072:EmcJUpNQT5eAZokuSGTMMxuappGuwR0k+VJq0s:hNQnJUc0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765604236, "uuid": "5ad4eb4e-2a75-42c0-a1be-2b7a12e4409a", "value": 168312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765604236, "uuid": "acade9c6-b1a3-4cb1-a4fa-9bec64cedea5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765604236, "uuid": "6e262c12-39a7-4498-bfcd-c44fc5ab2db3", "value": "Z_Archive_Tokyo_1907.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af731b93-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613213, "uuid": "da8824bd-3892-46b7-a5c5-1d315afc2b9d", "comment": "Malware payload (Mirai)", "value": "1e5ee4f0986ee5308edb2ede20c51d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613213, "uuid": "c00db7d5-5a34-4ac9-8076-e3a34c2ef192", "comment": "Malware payload (Mirai)", "value": "a7f6b802de2edd44f43cdc2a65fac7d96e19347447c61a1588865d323c2f5898", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613213, "uuid": "e6a19ac4-fb21-4199-af34-9071e190eef0", "comment": "Malware payload (Mirai)", "value": "891eb317c9ef6e9067ba6ef8754c1047fd3745ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613213, "uuid": "34ddcb16-170a-4be3-8246-5a986900aac5", "comment": "Malware payload (Mirai)", "value": "8e553c4bf3edf1a57a88fd0a63a5fad416ac081dfa26ea3046cd478132c5489a83ef331dec7aaf30c5a62e1842a14c4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613213, "uuid": "c199b27f-c3c3-46d8-985c-160b438683dd", "value": "T1DB73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613213, "uuid": "d3f565f1-2c49-4aca-b26c-0f25031284ae", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStw:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613213, "uuid": "12051e07-d5aa-40e0-a6cb-1869aee1f9a0", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613213, "uuid": "aab090ae-596e-4fe6-af5b-80143d71e486", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613213, "uuid": "3ad1f097-6b34-44c9-9b46-a788ec51b26b", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6573cf15-d879-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765667635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667635, "uuid": "ca47ed3c-51d1-45e3-af55-fdc980e7ea53", "comment": "Malware payload", "value": "b236cd61fc69f652e7664d10889381c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667635, "uuid": "9b654122-b34a-425e-ba24-8ea5ef95f5a5", "comment": "Malware payload", "value": "a80e4e1de88fe991b75358f1197b2e2330ac17269af6cb1a790477da9d734998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667635, "uuid": "bee374fc-713c-4762-8a35-94c9227b671d", "comment": "Malware payload", "value": "79d8baabd814f3a3802cd518da60c0c4fea6525a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667635, "uuid": "a549a6c9-a29f-4517-9ce6-4490ef6560c5", "comment": "Malware payload", "value": "63224240f9979b928c2cc75d35e6d9211f7a756ae330a8b9f429ad46b3bebd451f52ab775533ff3366de441b2a3490b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667635, "uuid": "d53814e4-6b3c-4144-9116-aeff7c2e1806", "value": "T1B253B51F1F668FACF76D873597B38F31968833D226A1D641D25CE9011EA070E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667635, "uuid": "c1be2a1c-b1c1-4221-b116-234a37b2ca45", "value": "768:ceq32pn8ekdo6vpzG+o+UOL5cq3JOmY93/PQnP6dPhnPPZOTRW1l52gHufnc:g3Xk6BzGQl29PPQnPiZnPPZO8gIufnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667635, "uuid": "f2ee3c8d-5872-4102-941e-fc2fd3629353", "value": 64976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667635, "uuid": "cc8f845c-cf71-4737-a652-e78ac22766ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667635, "uuid": "b867feba-e405-41c3-a050-a0ba3af66a39", "value": "zermips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23ed181-d844-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765645000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645000, "uuid": "ad4a1892-7b14-428c-9f0a-1b71d2b14703", "comment": "Malware payload (Mirai)", "value": "4f36adb8c8812d9e28edd5712722c4c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645000, "uuid": "5c60fb6c-0f35-44ac-8ea4-967a44d5c792", "comment": "Malware payload (Mirai)", "value": "a9c5e5e50af14289a1c9ddfeef4abc9f145fc0761bc9faf486c9f8aba76553a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645000, "uuid": "794197a6-9b99-43ec-bc29-f7231fb4f002", "comment": "Malware payload (Mirai)", "value": "e7c05581fd808a4af28271099dc43d9c5f595cb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645000, "uuid": "14d4be83-20a4-40e9-8511-3d9368640199", "comment": "Malware payload (Mirai)", "value": "cd03f2a7f273067dad31fc5a7c80c15640d197c1ee3628f201981cde6cb1a43dcc47997c6e45bb15a51fb29bf6643367", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645000, "uuid": "f7edbbf2-4de0-4ce5-99d8-114fe8d866dc", "value": "T1C77302D24733DD22CD691571DADF1BC0CAA9AE7205CF6A62235816002DD6203B7EFA1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645000, "uuid": "8b145379-1f00-4c2e-aaf1-053ff129436c", "value": "1536:2KaLbN2+ihcOTLn3WOqAwYHc2/CL36ac3WylsnByCV8Ey2URnLwH:2XLFelTTFPr8eCL3jc3FiIC5y9RLwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765645000, "uuid": "6be81ac7-e078-40ba-b75b-7a0f3e2e46fb", "value": 74384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765645000, "uuid": "74cf91ac-bb1d-445c-ad26-85279dc12094", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645000, "uuid": "26d34ce5-747b-4020-a6f7-f5d4980d24a9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4c12e2-d872-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765664724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664724, "uuid": "90c62653-2d22-43c9-92cc-cad119c80378", "comment": "Malware payload (Mirai)", "value": "27d7c9a3d55a8987ec4ae0a7b9ae5164", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664724, "uuid": "7a1f6e32-ee3e-4efe-9bdd-a0fa453ffdbb", "comment": "Malware payload (Mirai)", "value": "a9d85556af02bc8801835aa32a8f061fa0cbe30d6873f1b655172e99b9bfa091", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664724, "uuid": "9f4928e8-42d7-43d7-8ccd-fb4e10c56c71", "comment": "Malware payload (Mirai)", "value": "c5b82f4cbd74638f2f000781ab0d3f2c44a1ad17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664724, "uuid": "e2fed6ec-01d7-4113-afbe-6b1ee9d8509d", "comment": "Malware payload (Mirai)", "value": "393dfddaa24d8a4dc022beee5bcbc26b7bc84e8acbfa51f5c69187b0d22425889c101979dac3e3cd53714a763450da4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664724, "uuid": "cde48067-8cf2-4348-9d5f-023849d65591", "value": "T16FF35B82F687C0F6D917893050A7F73FCB31A82A4077D65DEF999F31CA2750192263A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664724, "uuid": "1cdf7e59-4fb4-4c2b-a4d3-4daa7396a635", "value": "3072:GzTXkti5MLD94ArF4kJycXXfipwFtnjXAbT920aA1W5CnBhIB1HB:4XkgMLDSArF4kMc5wmCnuB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765664724, "uuid": "16671c95-76e8-4c30-b305-a07eb15b2bf1", "value": 167592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765664724, "uuid": "c6dd3b2f-cd9f-4482-9eb9-4c87e132c660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664724, "uuid": "f8182413-4426-46f6-8e3b-c7079b41bf2f", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f0b615-d7ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Rekobee)", "timestamp": 1765607504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607504, "uuid": "208c19da-aef5-414f-99e6-aa7d907fca28", "comment": "Malware payload (Rekobee)", "value": "4b2265ec80509fd17cfa40a9cb553ecd", "object_relation": "md5", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekobee", "colour": "#AE2445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607504, "uuid": "cdcf7d6e-f7fe-4628-8f8f-1eefb965b4ed", "comment": "Malware payload (Rekobee)", "value": "aafe32438951f9cfed717a15ef5ec607cb34ce0e4590c9790cdd87ed000b33d5", "object_relation": "sha256", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekobee", "colour": "#AE2445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607504, "uuid": "ccdd4c12-a1b9-4899-af7b-4b78921839a8", "comment": "Malware payload (Rekobee)", "value": "3d266bb52758fd39f998b2fd364f60bc33fad819", "object_relation": "sha1", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekobee", "colour": "#AE2445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607504, "uuid": "b00c1de0-1bb7-4dc1-a413-41d7460102ba", "comment": "Malware payload (Rekobee)", "value": "e1b15c279d7a15ac42474ed65d89ad8f6b003904f9abe2baad3605d368e7723bc5ffde33d2094e51dfb0df61f9e3cbec", "object_relation": "sha3-384", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekobee", "colour": "#AE2445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607504, "uuid": "66b56d4a-73f7-4e51-8573-0f285f598730", "value": "T10353290AEA47D1F1CC270971528BF56F6A757030ED2E9F13EBE40EA6CC13A416729792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607504, "uuid": "f931984a-4a9f-45fc-a3e8-6efed9379d63", "value": "1536:eRJoocGMbwZVFuE6gD+gv5HDJzlS4AKi:eRJrc+1VVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607504, "uuid": "0c9afa0c-1ff3-478a-aa95-b18fe311d85e", "value": 64456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607504, "uuid": "f91f9999-7d19-4326-b0ee-eccfa0320a34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607504, "uuid": "0dd9393b-f8bb-420a-9728-2080bc427275", "value": "aafe32438951f9cfed717a15ef5ec607cb34ce0e4590c9790cdd87ed000b33d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabcb3fd-d7ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765615406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615406, "uuid": "01dd5735-4b1f-4b99-a2d1-613a39d507f7", "comment": "Malware payload (Mirai)", "value": "2b92b2a887b11b94b68cd235c809b617", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615406, "uuid": "b094f773-3034-42f3-9979-72d4ebc39d4f", "comment": "Malware payload (Mirai)", "value": "ab0f5764f11fea3c42aa70524bebb47d1e561f1f6214313550a024fdddf6549c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615406, "uuid": "a8663f79-a225-467a-9565-dbb81edb3e31", "comment": "Malware payload (Mirai)", "value": "f7b13b756621777dd18c5269783bae81615956fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615406, "uuid": "ffa3dda5-fdce-4bdc-80e0-1b382a433a16", "comment": "Malware payload (Mirai)", "value": "494d005e1638644645f13f134304ee0c630e5d20dfd4260579b6735a82f54c13c47656738893784b468d535151b37f2f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615406, "uuid": "68becc9b-c209-4049-812e-7b5dd731fc4e", "value": "T1E81194DF26921FF289689F0CFD730464900682C5F4631E786A87583A8CE6705BA25BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615406, "uuid": "5b7e22be-8fc4-4ccd-8d00-ddb54f88b70d", "value": "12:yw378YhAUlk39NIl5dvCa0LKNuNgOFx2JMJUO7tjQpSOZ74Nt28JDf2G9kMftL:cwlWNI78KZIwM5GlGNtfNO0BfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615406, "uuid": "8ff747ee-307a-49ed-b257-8d8a1d167934", "value": 899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615406, "uuid": "022818d8-cb35-4ee5-b24d-ee6df30f97cd", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615406, "uuid": "4f7c61c6-8599-41b5-9145-36a3130c45c7", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144f3c3c-d848-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765646453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646453, "uuid": "c9373d7e-b8d4-4210-8a91-80be046469c8", "comment": "Malware payload (Mirai)", "value": "ee7234d84171f5ee31c46b3d0eb01b1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646453, "uuid": "7af12f7e-74e6-4d24-b527-098756740029", "comment": "Malware payload (Mirai)", "value": "ab19b181a1fa1fe6211abbcf083c7eba048faaefa1f64f28df269b9f2254b2a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646453, "uuid": "dc66f553-f301-4d56-a9bd-b9e229f2c68e", "comment": "Malware payload (Mirai)", "value": "cf9b3be64f631cd130d39fe7c98dc95f5f16524b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646453, "uuid": "56360650-0cf1-4178-a292-313b472e4d3d", "comment": "Malware payload (Mirai)", "value": "806f0310f0f609d4835b250dc6eb0f72897afc8469ddb9520b20328fc58330ebd4095cedbf413f414f30d227073bda52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646453, "uuid": "203833e1-b388-447e-8d49-d80b715ae136", "value": "T179F2F131E3B73672C3B24472F57845C1622604F2E4D33522B79A3371E88C6949AE979B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646453, "uuid": "bea3cb14-2202-447c-ba62-400a5a4724b6", "value": "768:VXLq8n6b1Slbwfu2AIsuXnkk70t83BjJf6yiJfhR0bo0Vpys3UozR:VR6xSamSXnv7tVJ9+6bhVpvzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765646453, "uuid": "afbab199-363d-4479-9b8f-836c396b0e28", "value": 34760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765646453, "uuid": "51231e58-81bf-4211-94cc-6437c19999c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646453, "uuid": "f602b486-c8ac-49a9-b4db-edc8373d7f41", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e505089-d7ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Rekoobe)", "timestamp": 1765607493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607493, "uuid": "a5f30151-9f4b-4ce8-a31a-428c424ff79d", "comment": "Malware payload (Rekoobe)", "value": "ca09a4ae09dff447d0b6384f3462c425", "object_relation": "md5", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607493, "uuid": "26f9af8e-35de-4e5d-8491-a677f9fcdcc2", "comment": "Malware payload (Rekoobe)", "value": "ab1dff368dc04f2d04254973dc801b35ba8c49d14299a2526db80a7759ba5ae6", "object_relation": "sha256", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607493, "uuid": "dab2265e-787b-4665-8a58-f8a2354d00d8", "comment": "Malware payload (Rekoobe)", "value": "1c74d838c6fe971ea6d8107bc503f83fae2168fc", "object_relation": "sha1", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607493, "uuid": "4f46034b-65ea-423f-93b3-b1b988de2694", "comment": "Malware payload (Rekoobe)", "value": "1cdf5b8ba40e77ff539985389cc03245fde28611c3a4e2791b547efd2ef54f1007b376f772754529ffc56a254a4df367", "object_relation": "sha3-384", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607493, "uuid": "a4eda7e7-b340-442e-9610-f03c24d986f7", "value": "T1BE836C43B6668DBEC859C2304F0FA436A873BD58EF66321B34405B64392FB192F29765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607493, "uuid": "12af53db-a07d-4d90-baa3-ac2d375b02b9", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607493, "uuid": "8da6d204-1c17-41e4-a484-6f1c37aa3b58", "value": 86176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607493, "uuid": "655268f5-f5ad-4ef5-acb0-2711eeddcdc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607493, "uuid": "a5168f77-329b-4aa5-9c7b-5017aefdce3a", "value": "ab1dff368dc04f2d04254973dc801b35ba8c49d14299a2526db80a7759ba5ae6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccae4be3-d877-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666949, "uuid": "7b4c1235-490d-46ed-ac16-9e8bc3e372d2", "comment": "Malware payload (Mirai)", "value": "3bf7d8535a254cfaf92639051c96110c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666949, "uuid": "5cf3b008-2652-464c-8472-e8d52734735d", "comment": "Malware payload (Mirai)", "value": "ab48fa8da32b01a9ff7f89f474cb682cdf90e93252b03207ddcc747ed861b660", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666949, "uuid": "8ab8464b-5757-4e0d-a9d7-4e32f6dce9f0", "comment": "Malware payload (Mirai)", "value": "3cc99d6e876cd895353f4acb9322bcb9294d0937", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666949, "uuid": "8de9204d-ddde-4cbd-baf5-7a76e43ee838", "comment": "Malware payload (Mirai)", "value": "98aaa17c35b25e73094e409994b446570e02943b5e8a3c6ef3d2754cc131d4e0f03910fdc7201b409b2004b4c1e128cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666949, "uuid": "8b20043d-a4a2-401b-a32d-af1293de77bd", "value": "T1BCA3D71A6E11CF6DFB68833687B7CF31975867D22BE0C681D12CE9006E6034D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666949, "uuid": "e01a0e90-ddd1-4597-9912-00452eafb75a", "value": "1536:TClHiHbWdOiC4c2KBCifF4zhrCXK+4W+mcW++UmKXCnyeG4cLfRsnv8VR5:oi7MONzfWtrCtKX5rVRsnv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666949, "uuid": "0491a1a2-1b66-4682-aa9a-572f97ad5e17", "value": 105336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666949, "uuid": "1d6ae3fe-b8cd-4e4c-86ec-80c479250b29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666949, "uuid": "68c44e41-1c7f-42b2-bf56-77de3947a216", "value": "jklmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f651b27b-d874-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765665730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665730, "uuid": "65225577-4466-4f4b-adb9-dbf76332871c", "comment": "Malware payload (Mirai)", "value": "38e42b852c9126f604b9549d635f8ace", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665730, "uuid": "f132abdb-0ba3-4be8-baf7-a7d4476db452", "comment": "Malware payload (Mirai)", "value": "ab54858bd9775331907085518e3c02ee3d08188f0b335f8d66d16dd3e3aad7b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665730, "uuid": "a683e8f9-57a7-4008-87e5-812c190be201", "comment": "Malware payload (Mirai)", "value": "93f5abd47dcec681b37be93f975f72e0bab6a000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665730, "uuid": "062ddd05-1bcc-465d-a5ba-bcf14058aaa6", "comment": "Malware payload (Mirai)", "value": "be6cc886c3875cf8623510be6453bd4202014d93ba8570667d13c16658d2d0fb839989b85581baf806c8fa4c28fb8c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665730, "uuid": "34709762-245e-495a-8a95-3e1e9dfb9ba3", "value": "T160639E76C47ABD64C55906B6ACF08EB81F437100D2661EBB2E46C6664043DACF64E3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665730, "uuid": "b0b75b3a-b08c-427d-90f2-349f7569c747", "value": "1536:BalwtztnxqSPjPXBf8B18NrlhzBUcRW9C36X+Ynv8VR:Bm6nTPzjBDqcRW9W6Nnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765665730, "uuid": "9c40f928-3f58-4ded-8600-ba4bbd8276cf", "value": 68056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765665730, "uuid": "90f93460-91c7-405a-a9e8-9ee6dbe253f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665730, "uuid": "29323f0c-fed8-4ce5-b47f-68d746637e4f", "value": "splsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b5a5d3-d879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667632, "uuid": "1211c580-804a-4741-b1e9-25d524bbdfc4", "comment": "Malware payload (Mirai)", "value": "de7035cfe2fe78374a21d628d4aa0a22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667632, "uuid": "f2c5a30b-beec-40db-80e9-300a82510b79", "comment": "Malware payload (Mirai)", "value": "abc5be0b55b2ea1ba34b286133ee93b6f597834770ae3504f73b0899d1ead6b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667632, "uuid": "dc553cf9-5cc9-41ae-8eff-1c65c6378301", "comment": "Malware payload (Mirai)", "value": "d63a8c0e1f0bd3efcbea60754b991638c922d53d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667632, "uuid": "94dbc09f-2a75-437c-a901-a6c607dfbbcb", "comment": "Malware payload (Mirai)", "value": "72f030954de5cdca55a9fb2b32792c7379128ce8c08474174a91c3cab47c8d41b3b7899f1737bedf18c13a14ab492cf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667632, "uuid": "12e4331d-4f1e-42e7-8634-11be1c968cf2", "value": "T19D244AC7F800DDBDFC0BE77744630909B530B76224A24A37B2677D67AD3A0990967E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667632, "uuid": "42721622-660a-474d-9a0e-146e42cc67d7", "value": "6144:tjgVoJrdqP599I7FFYKOFoLO/EJLH1yYfX97l:tl459GhL7f7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667632, "uuid": "1aa9c5dd-aaf3-4bd2-bd43-b630143b58a9", "value": 210688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667632, "uuid": "b3679bd9-4666-44da-ac0a-b6933cd14d1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667632, "uuid": "3487043a-6e65-4a4f-9a06-e579eb78a420", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0178604-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765627012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627012, "uuid": "41d6d268-285f-4dd5-8365-df5798f2de25", "comment": "Malware payload (Mirai)", "value": "b5d45afd9cab48189e10879a17b44092", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627012, "uuid": "d9a3c101-7232-47af-a672-58e608cf9432", "comment": "Malware payload (Mirai)", "value": "acebb89375815a22a172f77cd9e679effd6c450feaa93aa205e956314b741764", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627012, "uuid": "42f5002e-2513-4299-ae48-c3774f6af988", "comment": "Malware payload (Mirai)", "value": "e6d0016773d3d31333f4471ad368dc0a8e5c1e66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627012, "uuid": "f714db32-9485-47d3-a18d-a9d91513d4a6", "comment": "Malware payload (Mirai)", "value": "bf7c7b5aa1a65741dec18f554ece1f63afaaa65afa19bf80be32b99d48938b7f3b45becf36c4889d2aad76845074980b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627012, "uuid": "df744c28-5f48-4692-8766-082a25465d2e", "value": "T13743F756B8D18A01C5D812BAFE2E118D33136768D3DFB2179D106F247BCA92B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627012, "uuid": "09259df0-eb2e-4a1c-8c67-65cd82c1c491", "value": "1536:Adn9SB+Ms0HGgaufSZbo0Fg1OaSF+iYLeItijNWaKWOh:LwimgN0o4goaSNNWaKWOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627012, "uuid": "a865952a-c50b-410c-9ee6-50ea6866571d", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627012, "uuid": "e0947571-9a1f-4d23-bfd9-78067469626e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627012, "uuid": "b9f073c5-75da-40fe-8f3b-759cb50f89d6", "value": "Mercury.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149a2820-d87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668358, "uuid": "d2349289-862d-4ebb-9090-460ef0ef5843", "comment": "Malware payload (Mirai)", "value": "b9b731d5dbce09317aa9439d107c37cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668358, "uuid": "805d4c09-0d62-4d14-941b-6abc7a7d30be", "comment": "Malware payload (Mirai)", "value": "ad899bc9d6e9ae87ed14efce57595e358b7e8ab9deb8d258cf68363816e8e946", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668358, "uuid": "c410a67e-b179-4c92-b4bd-1f09d6b7fe8d", "comment": "Malware payload (Mirai)", "value": "75bac6abe4268daa85994fbc883277281e47e20e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668358, "uuid": "a43572d2-6ffb-4cca-ba8c-b7dfb8022350", "comment": "Malware payload (Mirai)", "value": "6e8bf65d82d98e04ef630b68100fe3450ed2ba7df72c86a387fee82ff7c902c7747542660f72aab7091c962df0709098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668358, "uuid": "a201ea6e-9b33-4903-b224-9e0761b255b2", "value": "T175839D7BE4255E50C185897470F58E341F63B2C082876EBB6AE5C6B9A087D8CF901FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668358, "uuid": "0fd10268-f31e-4184-912b-6733b8fd8d86", "value": "1536:aaQ8bNhsi2sXdRc265GpKhqPl72t5MaCCmkoU738:akaiTjcV5GQhsm5MaUnC38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668358, "uuid": "c897e31f-9c2a-4818-ac59-77b4beb87d87", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668358, "uuid": "acf87fa7-ced8-458e-ada4-bb0c97ddb537", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668358, "uuid": "40fc2171-e915-445a-9716-1cad64b2d958", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0ba7df-d87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669074, "uuid": "e8b4f124-364e-41f8-b692-cc096a56615c", "comment": "Malware payload (Mirai)", "value": "b47e8076d4f38c16804865fd504914fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669074, "uuid": "5d8b181b-79d4-4ef4-ae42-69541badcf44", "comment": "Malware payload (Mirai)", "value": "ade5e04e67d0ba5d6530437109c0829ecf6313bb73d7d9de7459b0156cbeccc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669074, "uuid": "824b5c8f-a008-44c5-97d0-8a17d989e05b", "comment": "Malware payload (Mirai)", "value": "53b23fba1468e98c10f060563fa23d4f55f35986", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669074, "uuid": "9064b308-28e5-43bb-8493-c75eedebc9bb", "comment": "Malware payload (Mirai)", "value": "2df58f3e2150b1d6392e6931468618df771c42e9d7fa9e88d4fe6583f14cc0db1d8442fb9b0b9a9cdff7873d8b1b7f20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669074, "uuid": "b9d2099d-726c-4f1f-9f46-7402199f1c85", "value": "T1E9835B13653C2A0AD1F490B7027B5353B1E2265E5894C7DFFE760E8BBF162981E2B5B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669074, "uuid": "1c89a8fa-bb85-4fc2-899f-9590ef64410f", "value": "1536:Hi4gRt35teLcg1MidGiffxyj1I+3PksNEgWGY2Y2cW4z+kNWWIymQY2AUYci5hha:Hi4Aru+f3NEgWGY2Y2cW4CCqhh1WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669074, "uuid": "175d7ae9-f2a8-4327-8ea4-ee94cc0d62e4", "value": 85824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669074, "uuid": "fb4890e3-4307-46c3-9ceb-eb1deb55946d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669074, "uuid": "bbf37889-acdf-44b4-9706-6dd89bdd9003", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4339540e-d87f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765670154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670154, "uuid": "5c99476b-a694-4811-b418-c7d437fbc606", "comment": "Malware payload (Mirai)", "value": "43c207338f205fa18d4f858a277a52c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670154, "uuid": "4ce699f6-640f-4dff-b4b6-76c2c1158c68", "comment": "Malware payload (Mirai)", "value": "b056f2028ca7616d38b72bc62be30afdf1418a3f99c60e8394f6873c0ebd345a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670154, "uuid": "7d69cd5e-c981-4f98-ad44-2be3817825f2", "comment": "Malware payload (Mirai)", "value": "2b541548c2a999d3506aa9118f9a1ca5cd149699", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765670154, "uuid": "8ecf88bb-46f6-4852-96f4-df3d27fee6f2", "comment": "Malware payload (Mirai)", "value": "bf6499f4b7068f903787d259d7ca5538d4a8a0bf7c2fad855f350e38a5477335058d0e1662c73002e7f64bac77bf36d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765670154, "uuid": "64d13ce4-bcd1-4dde-8547-da8840c581da", "value": "T1E7C1C8E5BBF261B03C645C366479404478A3A8BE51C57EA63CDC39E2C08DE6831A17FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765670154, "uuid": "282ae669-201e-4d13-b7e1-93762c91bdef", "value": "96:2OiijM3L6DV9ArPtUzkB1ByV/Vs8DybrFl562Z:riiVqT0AbrFlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765670154, "uuid": "9352bb0c-0c92-42c1-94e5-89bcd5604a4a", "value": 5808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765670154, "uuid": "a74e0bae-86d2-4920-a453-024deb6b8d44", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765670154, "uuid": "55ca7c5a-02e7-4967-aaa3-c61d142d76d5", "value": "test.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdd2e9e-d821-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1765629930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629930, "uuid": "f0acbf95-77ac-4815-9c7f-e46bbd7b2e9a", "comment": "Malware payload (ValleyRAT)", "value": "1f21747628ae5645bb51927876ef67ce", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629930, "uuid": "abc63d11-f490-497b-ba42-15c05f0f8f4a", "comment": "Malware payload (ValleyRAT)", "value": "b12e8deba0b10fc32789001579092d8369e39a7e03951d12a70423f699896d08", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629930, "uuid": "85dd0b1c-0a51-4519-83ef-dd6a22cec28f", "comment": "Malware payload (ValleyRAT)", "value": "595ffdc2387a0953755f075dde925d016106522d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765629930, "uuid": "289e6ac9-c79f-4424-9f7d-057a42ca60f2", "comment": "Malware payload (ValleyRAT)", "value": "f2ee91f63141b89acf582146b0b2c4587a7c511c6fbe0ce66b5fb2dde66168fe75e92e7b2f6bc3e2c5c1fa8b1cc3aa14", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629930, "uuid": "442afa00-dde1-43a4-9c3f-d41263868c45", "value": "T189073311A28BC431D65D417BE96DFE4E1538BEB30B3040D7B7E93EBA88B18C25675E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629930, "uuid": "3936bf6a-0d6c-4ec7-b6a9-474f1e696feb", "value": "393216:DpDBuR7XQQ2ZH3EQecV5KwbNeNYXcSotiEVD:p1EA5KwbgGXStR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765629930, "uuid": "ca58ef26-69c9-4c1d-ace0-254b2898c066", "value": 18074624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765629930, "uuid": "85f6c1d0-f26f-40fa-a382-393d61e32164", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765629930, "uuid": "3fc91b56-aebc-4a59-bc9c-d811b9064829", "value": "LetsVPN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9085b49c-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615738, "uuid": "b6c8b82d-c827-41a3-9ea7-3358d95cb324", "comment": "Malware payload (Rhadamanthys)", "value": "92ec5af52cf29465b2eb7623fe8b5a54", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615738, "uuid": "eacd9dd1-9eb9-4a37-ac86-084d833bd2c7", "comment": "Malware payload (Rhadamanthys)", "value": "b1abcf4e895f922c769b6dd5a7dec6d950af3d028165965bd551b337d318fd0a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615738, "uuid": "8d13ff16-d547-440c-8511-74fa328db0a9", "comment": "Malware payload (Rhadamanthys)", "value": "f11d6f7b4a78d53cddb4032325c163d425142731", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615738, "uuid": "71dd738b-a283-4133-b599-2a7ca0f35504", "comment": "Malware payload (Rhadamanthys)", "value": "28ba4536d20e433a73f53bad61f2b9d5137c45a1835ab8421e3e3c5e2a214f7061c7d447b064861fac414e72a9a4b2ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615738, "uuid": "7bfc15cc-9fa9-43b9-bbb2-00da5430c780", "value": "T12993F86DAD37EED68E166D76BC846CF3CD9ABA624D110089F56BF3A1914C23023D04DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615738, "uuid": "9491cebf-b999-4ca1-ad3c-95e208445b46", "value": "768:GDhd0i7J4sYKgY/CMNfWd5ya+8s6NerXWdr2T7fegHu9W28ATLm02lhSLAuAAroU:GDB7eKg20MTrsr2TTCuA3gh6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615738, "uuid": "4bbdbc29-0fcf-4338-900d-ea983b3b6583", "value": 97514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615738, "uuid": "b2528c8d-5580-4e16-adff-492014632f37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615738, "uuid": "8e3ace71-0356-48c6-a22b-9afc222604e0", "value": "invoice-1637482117.pdf (50).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4485b1-d845-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765645312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645312, "uuid": "5159c7c3-3526-41c7-af4c-a5761aa7ce8f", "comment": "Malware payload (Mirai)", "value": "6a19c0bcd0e09b598b6c740556b22376", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645312, "uuid": "d01db95d-0bff-4c54-ba15-1e1cc3e78923", "comment": "Malware payload (Mirai)", "value": "b1c6b05f4c16fc5ee55151905d453db63ae1913bbe5f91d043558bc2c64f19b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645312, "uuid": "7e62184a-3e64-43ad-ba5f-9cf839c8d62c", "comment": "Malware payload (Mirai)", "value": "29013ebb37fd1dd625bdccedc28eb6c9d7b723b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645312, "uuid": "a102fed6-9400-4509-b27a-e296d99d4318", "comment": "Malware payload (Mirai)", "value": "01b9f81619ba1fc0616a79f89996b03d9d62eab22f2babc1d7d98d5db6c4c835d5071f68c51d37a3bda6afd0a2f80d61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645312, "uuid": "572a2b17-a46b-4c13-9242-e3d458cc3cc2", "value": "T18173029A93400E0AE782C3BBC7F907AD5F915AB5E513EE1E2349C5D358C3166EC827D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645312, "uuid": "4a75de9a-153a-4ccf-85d2-c9f10ab5c05c", "value": "1536:l/WqcTxJKsqw7L+LIZSLZ573L+onhKhjg7uMKk1BvIj6FpekVJuD:RWquBL+eUz/uFO/ekVQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765645312, "uuid": "fc0482b9-e680-48e0-a69f-9616409a6eaa", "value": 74588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765645312, "uuid": "034a234a-3da8-4581-942b-738e1085c54e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645312, "uuid": "edf03f6e-34fc-40fa-9576-6c4365802a17", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061a17e6-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639128, "uuid": "da44a631-46f0-4916-b9d0-6fc0f9e26d0d", "comment": "Malware payload (Mirai)", "value": "3dd14e8564a209cdbecf7802335b39b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639128, "uuid": "f0fae341-f583-42d1-97a6-a4f0f0d5a5a7", "comment": "Malware payload (Mirai)", "value": "b1e5deee43149cf5a1b0ecdfc51111b577e8b0bf81d468e91f202c183d226088", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639128, "uuid": "de1f6649-704d-48f4-a62e-9dcc5ed7ab46", "comment": "Malware payload (Mirai)", "value": "98401a89ecea2c5077750e81bd9d7fc5245b381e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639128, "uuid": "3e11f37b-a593-48b3-b05e-d9ac1e10a5eb", "comment": "Malware payload (Mirai)", "value": "78117a761650ac3f4e3844729118e5adc5bdab262b0808c0e8943b6d8bd27bd21e1b1bc0de3758a1f05c6051a26f500a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639128, "uuid": "5a272070-45e1-468d-a283-2761d8ca9f38", "value": "T137E35D8AF4029E7DFD4FE5BE44670D09E931A39131830B2A53DBFDA3A9311A94D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639128, "uuid": "ba298d18-4649-4465-99fa-1ca61b9cdb59", "value": "3072:7oDlIyA+oy+ZGiTC/lZoEhH5lgLOoe97dlJ8jt4:1Dy+ZGeEFxoe918jt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639128, "uuid": "86fe5d64-4774-4673-a329-abb9de30df0e", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639128, "uuid": "e21f74a7-346a-47a1-b007-2cedc1b1e323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639128, "uuid": "2897c6dc-0577-482f-880b-37404abf8ec2", "value": "frost.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915d5ac4-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666420, "uuid": "086de940-8de4-4255-b259-3b4f8032d74a", "comment": "Malware payload (Mirai)", "value": "28ff95b0363b492cf51829efd5c4fa26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666420, "uuid": "1c3268dd-b9c5-48f3-ab8b-db46f9fb845f", "comment": "Malware payload (Mirai)", "value": "b213109f876af840157f2c2b2ca610052201fcd908286c9f91c29a9b30fb2652", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666420, "uuid": "6de9f8fb-520a-47eb-8a77-b7e8901a8aef", "comment": "Malware payload (Mirai)", "value": "c68f2c8e46d7bb31650dd3679241274c1e9ad4a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666420, "uuid": "5169f8e7-0323-4129-8a29-092b6188f220", "comment": "Malware payload (Mirai)", "value": "d81b745f40a068c46d3f7343c1a94be076fd18c7ccedf3043e892915ce8d16f28434d14c0010282f8b79f22b06b84791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666420, "uuid": "f5bf88b6-e7ec-443c-b5ae-3eba08b7f481", "value": "T18A833ACBA810DDBDF90EDA7BC4678F04B52467015F421F3BE666FDA3A9310948D19E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666420, "uuid": "02da57d7-27d1-4ac0-a5af-a1d740e37f1d", "value": "1536:mxr3YEom7EE1wS7qkvGZX/Tpc8ubbSXLx6rgt235fYxD7TPBSZ:mxr32EEENqkulNkbW60t235gZ4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666420, "uuid": "155fab0e-8e5a-4426-bbba-99b9f0d2684e", "value": 81632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666420, "uuid": "6da85d9d-6a75-4818-ac0d-4a436c1212ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666420, "uuid": "b3e50f38-9eab-4e03-b093-ddb98437c185", "value": "splm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a123b4a1-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615766, "uuid": "fca69704-71a6-41ea-9ada-18db7d7b3f6b", "comment": "Malware payload (Rhadamanthys)", "value": "f4e69130291359c3302bf6f613bf3b8d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615766, "uuid": "d5ad5c61-3877-4f63-856d-2af71fb3b72f", "comment": "Malware payload (Rhadamanthys)", "value": "b23b4ad7c25fa6c5c7bc44bc4a98e468df7ffadf7c0a1cc80f86f63fcf8fdcb7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615766, "uuid": "0420e331-13b4-45d5-8367-90134c47eefe", "comment": "Malware payload (Rhadamanthys)", "value": "201ccdceff3b37eb5ffcdf8bdd7c63d21aed16c7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615766, "uuid": "dc8da6c1-08da-46a6-96ac-0a4a77b055f9", "comment": "Malware payload (Rhadamanthys)", "value": "f9d6e4428d75dd6badc68c787d7c6b5085d5cbe17f28d2f6aac7743b8eefc95b87e80573d748e59a8092c7784c77781d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615766, "uuid": "b7c59d0c-5a90-4373-86e0-365cc95c1143", "value": "T1AFA3F76C01A73DF4AF6B136D4A943C976F7BA78058F20245E271F2B253BDB762409AC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615766, "uuid": "e15d8512-1a83-48fa-a200-bc16ddb24b0a", "value": "768:GDhd0i7J4sYKgY/CMNfWdxemeReKeAe3eJeGeNeoehereadeIeoeTEe+depdeIeH:GDB7eKg20/rwrGnu03Aeru6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615766, "uuid": "0db404c4-1624-4378-adce-1966497c2cdb", "value": 102728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615766, "uuid": "f15e9551-afea-49b9-bb93-c209d00da8a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615766, "uuid": "93534e70-23aa-46f7-8acf-8fc263cca646", "value": "invoice-1637482117.pdf (42).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4129c04a-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615605, "uuid": "be08016e-8390-423c-91be-76725dd9fc66", "comment": "Malware payload (Rhadamanthys)", "value": "41365ab37d82e42fd958044a1895b2a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615605, "uuid": "dd79a7d4-007a-430a-b0fe-1fa9a58c7f90", "comment": "Malware payload (Rhadamanthys)", "value": "b2b3a747722425ee2393764b63088469863148f3c01626ec8ab49c9e6580ef2a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615605, "uuid": "0e2e7095-d94f-4343-9c73-e148a1ae4ce6", "comment": "Malware payload (Rhadamanthys)", "value": "ac0c8d46125596cf114f121181fd935a85ab559b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615605, "uuid": "70813d4d-9e38-4e02-be1c-8e0ad3e65d24", "comment": "Malware payload (Rhadamanthys)", "value": "a2cc698e9f0185a18547dfe02ccc7ba05c2ad9f1c3350ec086022de0a7eb5bd7debe38706f274797e1c7e5a75065e62b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615605, "uuid": "bdbb4259-651b-4f82-98d4-b066e7f77934", "value": "T10DA3E7066F41CD7116477D2BFE9B29F198094512BF0B53C0B725AA28B3D9B2EBD049CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615605, "uuid": "b42b7d9a-d358-4f68-8eae-312083798125", "value": "1536:GDB7eKg20uTIrhrU4Dc3DEVWAA7fGYog6BkQWJ+aY:GDB7b0uT69ZDgDEVWrfGYog6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615605, "uuid": "8ad55237-7bd0-487b-bd2a-a6e8773d3aa1", "value": 101316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615605, "uuid": "2a639c05-142f-46cb-9d45-c53d395ae0b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615605, "uuid": "2d0e8e17-63af-4cbf-b393-bc0eb8d61b6a", "value": "invoice-1637482117.pdf (80).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e8f302-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605244, "uuid": "44296e82-7a89-4572-8b73-919a1179f978", "comment": "Malware payload", "value": "1a9602857bc5085ad61350b953b34168", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605244, "uuid": "283a96d3-f456-48bf-b12b-60384d560375", "comment": "Malware payload", "value": "b2ec734521133a5355293480b3807f481c45f4921aec91e38bad5284e0a15242", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605244, "uuid": "7534757b-9df6-4f86-9f1d-08c215d142c7", "comment": "Malware payload", "value": "c6023cb61a4e516118d0600bc1390a0d008944bd", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605244, "uuid": "159968ec-932d-4eae-a36e-baab31236b3a", "comment": "Malware payload", "value": "fb025800dd37f662e51406564b4d2c33bfd933648a07ac3fdb0f92f7639792a295982309f42ad363bc003b8ca058e336", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605244, "uuid": "0c537295-f789-4776-add3-638170304352", "value": "T1F6842AA3E7482404C3B846B58A2D5358BE35FB4C5B7013BB3B50A2FA9EF93544D1AF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605244, "uuid": "2f803d1e-509d-42d4-897f-89b5668fd17e", "value": "3072:8FCm6KEKd70hmXz9m5/XZleSyg/MOHyA8uVUy0oMzraRbgqkg1+Wxgu/pFGJPHnO:traF9a8uVB9MzrU9+PHnuiuNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605244, "uuid": "bb1f5833-579b-4ccf-8a8d-a01eb8216e21", "value": 390448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605244, "uuid": "72b3149d-d429-485d-a5ce-2ba63d20e534", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605244, "uuid": "90ae1056-0717-492a-a496-7d9d3ae6bb98", "value": "b2ec734521133a5355293480b3807f481c45f4921aec91e38bad5284e0a15242", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b2e56a-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615936, "uuid": "d88426e5-66d6-4049-8d8c-21942624ab26", "comment": "Malware payload (Rhadamanthys)", "value": "1debd103d78a7e69061b05b5f8781aa7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615936, "uuid": "aec44d01-04f0-4d38-b712-218dafb95424", "comment": "Malware payload (Rhadamanthys)", "value": "b31da7bad972b7aec2987be805b568f99d663db7db52f63ddbb82e3998c79120", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615936, "uuid": "146929d8-643b-43ac-8615-1fe3ba892289", "comment": "Malware payload (Rhadamanthys)", "value": "0a8c59e6a26e74b627e2e445951a19fbf6f43a7e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615936, "uuid": "c55bcb06-fe07-404f-9d71-b48bca3b03a3", "comment": "Malware payload (Rhadamanthys)", "value": "68d25d6a90fd1544486cd1043dbf13783591144dd0bc0edc77ed9720d1a78b224308a6b0106936b0b784c09756958404", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615936, "uuid": "2230d63a-e365-469c-8839-fa9def10fb1c", "value": "T114A33AC6EE12EC3AE67CB4AFDC6F83D60C05F910CE1652D4A1257FB1649896F2A240D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615936, "uuid": "eb081274-664f-4a32-97e6-7d4769e01195", "value": "1536:GDB7eKg20Z1js/a6LQLB3G+a/mDnFCObJOag6SQOAmHNASy6aw11rqrB4KWrTChx:GDB7b0+LbR0M16BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615936, "uuid": "e9926ef0-b532-42f4-8d22-31ba5995cddb", "value": 99374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615936, "uuid": "852484d3-bdaa-4627-a194-7df5595062d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615936, "uuid": "4c948f41-b711-4fb4-bc2c-98b65bd3a134", "value": "invoice-1637482117.pdf (8).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c923e806-d7e4-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1765603807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603807, "uuid": "94c42b0f-05d9-4796-ac6e-6b5c34d0a69a", "comment": "Malware payload (Formbook)", "value": "6935dc6198933ab606371efcb374cd9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603807, "uuid": "9d6dfb00-b4e1-4e77-bf3a-9c8addb729a7", "comment": "Malware payload (Formbook)", "value": "b49f326c7a4f5156fc6033fe83b1129ebf9679947afb36ade578a656eac96c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603807, "uuid": "3a9c471c-8042-4358-b130-e58674788da8", "comment": "Malware payload (Formbook)", "value": "6c8a95f1d439b66e7481471ca88923e630b817db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765603807, "uuid": "e4784b14-d55e-4239-9ab3-04622d61f03a", "comment": "Malware payload (Formbook)", "value": "2cb5455eefa245f044e38c803a1315f7ec4fcceae79474d5241b301716b65f9e3f499b92a5b4c1ad19cff3ef3a569053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603807, "uuid": "21a67816-bed3-437c-a6df-7906edbfe1c4", "value": "T166F4F0D03B2A771ADEA00934E568EEB642F91D68B044BEF359DC3B57759D610AE0CF02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603807, "uuid": "f6cb62c9-4b54-43f4-90cc-27919853d2b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603807, "uuid": "4aaca624-ba52-437a-8516-709f80a0a903", "value": "12288:MjyGJPztq0rlWS9aHswPxZRtyMnX72oy9tGVdxk10S0Ew4aJBRM60VfrXJKz+E:w1rlWiY+oXpyrdMEDMzMpzWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765603807, "uuid": "410b7632-efa0-4f3b-aba4-d0fda093b925", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765603807, "uuid": "18210658-e521-43c8-a3eb-0c0ca003b169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765603807, "uuid": "dcaf75c6-7f4b-4b8d-9778-14b21e77f8a6", "value": "z1ILDC12DECDOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f2ef29-d846-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765645832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645832, "uuid": "73de55be-e1ee-4b23-9bda-ab4f5c90a1f5", "comment": "Malware payload (Mirai)", "value": "9d6ba852e6ab936a93e3af58fac5f9ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645832, "uuid": "1b1d002d-d2a0-4725-a778-7a4555aea1fb", "comment": "Malware payload (Mirai)", "value": "b50abbaee32ea54e7f535e2dd7222e8548a513215195fb2e39759cbb522bfee4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645832, "uuid": "119c9fb6-5d63-4fa7-aa0f-7d1505dd6fca", "comment": "Malware payload (Mirai)", "value": "8c9431182bcd9e0f50d8dbc50421c969680f4bc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645832, "uuid": "5e330a61-ec6b-46a2-88bd-72b5120b6884", "comment": "Malware payload (Mirai)", "value": "75a1bb9789863787d7babca42defe79b0823f8e4936007194dcbb8d258c061ecb5540a8970f0b5d0fdd759e62c1e965c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645832, "uuid": "8fc133b2-f923-4c87-9518-77b43a83bc52", "value": "T172232AD6B801AD3CFD8FEABE8016490DF62037545093072B67B7FD93AD321949E26E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645832, "uuid": "ddf5a5db-f07e-4efb-bcb4-18fa494dc45f", "value": "768:YtcBMeu5Xx0rJgTIK7q5+zr8RnufWeSPpYilJT8k4mfw8Nb:Y6WjXqriTqIr8Rufp8YilJQk4mI8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765645832, "uuid": "95751041-7c21-44ae-a620-4d66727c37ec", "value": 47848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765645832, "uuid": "453a8095-cdca-44ab-a059-2edf3bdfd8e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645832, "uuid": "def31b3f-0cd3-404c-a846-6b439fa997e2", "value": "Mercury.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f774b58d-d863-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765658431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658431, "uuid": "062e37af-cd99-4f69-a68e-5e846e8c5005", "comment": "Malware payload (Mirai)", "value": "daaf6fd5dc367133c7316b7649a9e624", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658431, "uuid": "1cc9f88c-322e-4c73-86ab-a593b32a3740", "comment": "Malware payload (Mirai)", "value": "b5fca6811245093c6b93e90962e26b6af666968277091f00e541292faf956204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658431, "uuid": "a33f605a-5a87-4908-8edd-5ca3e527bacf", "comment": "Malware payload (Mirai)", "value": "1dff8b730c3cb0262b24ebcf4d8d357f7b5eb3f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658431, "uuid": "b2ab9d2a-a723-4534-89f5-a7ba30cd7ae7", "comment": "Malware payload (Mirai)", "value": "1b8bba61f4f07e3ebf561769a39db8d699dcb47da5a98bd1cff1164694d46e1084ad360cf84ae3a06c68fe1e6a91c003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765658431, "uuid": "246042b5-e68d-41e3-b4d4-735c47c8725d", "value": "T1E7638E73D56AAE94C14C45B8A8B1CAB91F03A100D6532FFB6E85D5A68043DBCFA4D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765658431, "uuid": "ccb75268-1f4f-4e83-ab68-43bdab67289f", "value": "1536:eakwt+Jn6yATonF0lVPGf/OUkm5xFJzdCRAwXqnv8VR6:eP1nokFaufnkMxjzdYL6nvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765658431, "uuid": "0ae8abfc-9e93-46a0-9afc-05e4d33d3398", "value": 71148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765658431, "uuid": "67cf4a69-fcc2-4e88-9c56-dfdc3ddf3c12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765658431, "uuid": "96b8371a-4a85-492a-980a-5d042961fc6a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d04f04-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667124, "uuid": "ee78f59a-74ec-453f-b0e5-511d130b45fa", "comment": "Malware payload (Mirai)", "value": "9106cbd8747aca80147096e43195cacf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667124, "uuid": "0f4520fe-212a-4b94-a402-6de7890ee6f3", "comment": "Malware payload (Mirai)", "value": "b666e212424b1f06a5eac020055c6521a6dfed257a23e1b6156a4eff1eb5031a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667124, "uuid": "ed16bdc0-4fa5-42ee-99e6-2ee460450c69", "comment": "Malware payload (Mirai)", "value": "798ee3b32a294a3074a9e28226e06cff67636ee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667124, "uuid": "3f49a34e-c346-497d-b8f7-bfba8240846f", "comment": "Malware payload (Mirai)", "value": "9295c2378906dba57f9b7d514566c55e288e885a0ff1f5cd1fee5eec676149601c8520851cf59aea918df2d43cd2b684", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667124, "uuid": "7a1d4c3d-cea1-4359-bf88-2034196178d3", "value": "T17F13F1718172F275C122E0B252AC66C8FD12763BE447179E8C4B72EB5DBB97C7820E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667124, "uuid": "6e42d9ff-f5cc-489d-8d3d-cef0b3078596", "value": "768:dnSWo2+Mjdodb31SdVoGRQL5EeEYUz9MvFAJeCgOJY5pCSKGVt3G4qFiQ220Ux0T:dlYblC/8WeEYUKdAJeEJipdKWN5qFiQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667124, "uuid": "efc3f7df-b2f5-4726-ac6a-0f9894cd577d", "value": 44636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667124, "uuid": "5c5c68c8-8500-40c9-ae55-5bb9f8e16833", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667124, "uuid": "a0577ccb-1ab1-4a27-b397-b88810cc8d82", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e8536df-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615600, "uuid": "702a0990-858f-4e34-9229-9337b96a9659", "comment": "Malware payload (Rhadamanthys)", "value": "8ea323e8fbfb56029493f9d179b3fabb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615600, "uuid": "06950554-e86a-4843-a22b-8514c8ce412b", "comment": "Malware payload (Rhadamanthys)", "value": "b8012e4096324b6ad827cb6dfabef2189845d2dc1f3b040200ca3959348331e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615600, "uuid": "03c5a539-d743-49e1-a08e-0bbb20ad5d2b", "comment": "Malware payload (Rhadamanthys)", "value": "0edc5351edaa03f51d55e22a7e19743ee36cfced", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615600, "uuid": "9a8af7be-f476-426b-89f5-90ddb6915a7b", "comment": "Malware payload (Rhadamanthys)", "value": "17376ee37d9a80a3a096c6f7320f1706fdb62213f90497b4bf4a6c74c04322486fdda04f1c34db52a3e925ea1bc156e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615600, "uuid": "c9ccb63a-ce8f-46e4-9156-20c2253acb58", "value": "T1F1A31B18C87BAEF1D847C0DD1E511D69BC565D39881AE3EA8011F3F02209F45AE6AF7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615600, "uuid": "b9eb9965-d287-4e9e-bb10-bfeb31a6433d", "value": "768:GDhd0i7J4sYKgY/CMNfWdee+bzw5Szv8lhgpS6QslflSTeGqnnr3ZWc8+hJMVNRI:GDB7eKg20IrirDnuBNAf8S6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615600, "uuid": "3963c9b5-8eb6-4c6c-a3bc-319cb7c4bcd7", "value": 101347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615600, "uuid": "0424f768-9c37-4471-ac6c-d3d7164b78db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615600, "uuid": "9018da67-a799-4ce0-a8ce-e7ea598a2256", "value": "invoice-1637482117.pdf (79).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f604d7-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615861, "uuid": "40b87040-fa36-41ae-8735-bcb179100ef2", "comment": "Malware payload (Rhadamanthys)", "value": "039c0cc16b2ee14f035f4be51abc919c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615861, "uuid": "f918d034-d9df-4d03-8596-a9cf85025167", "comment": "Malware payload (Rhadamanthys)", "value": "b861b6a61a758320472c66baac9304e08fe255291cb320153b7c0cfedd382f2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615861, "uuid": "9822500e-b4ed-4c32-bea7-afb087e731b3", "comment": "Malware payload (Rhadamanthys)", "value": "1b1f895d71b652f6ad7ac96cc91245131d3960e2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615861, "uuid": "b3215a80-399b-4bbe-bc89-dc24b434dbf2", "comment": "Malware payload (Rhadamanthys)", "value": "a5d207d50f70ca36aadff63b1f0a0e2c2eebf3790a42956b2f17971f0107b326f869861182a4768e4a84e5400a0286c7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615861, "uuid": "5e3139bb-0bc5-4402-902d-66e32a4be4c6", "value": "T12CA31B425EF0BDD94CDA66807B6F05B90F8E74435E6B8842312EF7F94129C24A6D88DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615861, "uuid": "a0d349b6-e46c-43fe-a1ff-96f8697cae70", "value": "1536:GDB7eKg201Zhdr5ri4d3uet7mqA1ry/9T6BkQWJ+aY:GDB7b01tlTfx9T6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615861, "uuid": "9a6527a3-9c8f-48d7-b029-5156f793b41a", "value": 99349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615861, "uuid": "e50173b1-861e-493e-a9a9-44d112c5c69b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615861, "uuid": "719c4ffd-3368-4b06-9f9d-bbde45b3f989", "value": "invoice-1637482117.pdf (24).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1abccf28-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615540, "uuid": "edffdb39-193b-475c-94fc-6d3c31f45ed4", "comment": "Malware payload (Rhadamanthys)", "value": "7d0a6c76db5fa04739dfa710efedd096", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615540, "uuid": "3f0dc419-18e1-4b19-ba0e-efe96abe6c5d", "comment": "Malware payload (Rhadamanthys)", "value": "b93f688928e63f9d8d8d307edaa7fb23c6b4f853fe7f34a4dbc58105f3de8f1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615540, "uuid": "573891fc-6d99-4b38-af0f-fa24b249167d", "comment": "Malware payload (Rhadamanthys)", "value": "37936ea3ef9a1c12a8828027a9a0d6a5e97b9e38", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615540, "uuid": "d7ea1abc-767d-4e0e-9b5e-0e078ff9c4a1", "comment": "Malware payload (Rhadamanthys)", "value": "6074a514177dabdd9c7c3db9142a9c38192334c80d7a4a817b1ad379e95a2c755d027a915b6e90540147e85c16af843a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615540, "uuid": "d57b6e35-38f7-4b1f-be66-1f066dd94920", "value": "T103A3D9CA1DD4FCA0513A74289E0749B88C9BC8779F45DD01A8B6FFB1892DEEE0D85193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615540, "uuid": "822cf351-f4e0-43da-9dbc-22111fb51953", "value": "1536:GDB7eKg20Gi+r/r/75u4dY9J9AB6T4wc6BkQWJ+aY:GDB7b0eTTz5wc6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615540, "uuid": "3467566a-6ffb-4c41-b393-20fb23562031", "value": 103379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615540, "uuid": "b2014e20-6342-421c-851d-3fed645c49ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615540, "uuid": "132c5975-46ef-478d-a923-ad047f5b98b8", "value": "invoice-1637482117.pdf (93).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3733be-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615655, "uuid": "5e4f623f-a214-48bc-a3cd-9da6435f97f7", "comment": "Malware payload (Rhadamanthys)", "value": "30399f686df66c76d4ec8dd84c0a5c7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615655, "uuid": "4f1be7b4-14d7-4182-b60f-199b7ca8998a", "comment": "Malware payload (Rhadamanthys)", "value": "ba03a130a96834846043816d27566a8b597e5d7d60d766c3d82b7d08b74effd5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615655, "uuid": "16874044-4ddc-45e4-bdae-adb9d25f486f", "comment": "Malware payload (Rhadamanthys)", "value": "9d57640b345e4c2a84a360197c53a9dc2c38a29e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615655, "uuid": "88ad081a-35b9-4d6e-884c-a8d9b3863549", "comment": "Malware payload (Rhadamanthys)", "value": "005513a88ef91efb6e0281060691e34fd06d6b6afc1ab42e2a1843a96e61ee72a82160deb4fdc9a962d66340b07f0cee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615655, "uuid": "79d152bf-69a7-4c0f-89d2-f5f750ca4f78", "value": "T19EA32A381C8B70D34B9BF09DBFA97C8191491C9B8741A9F4DC8FFF9A20D8A055AA45F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615655, "uuid": "02cf2b8f-4416-4caa-821d-dbcdffd2b5a6", "value": "3072:GDB7b0CQm31K33a5kR3cEJ7C3pulU86ynXbhttCP9YY1q88fA7fbc32kJtxbiKuE:0RMDKBkWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615655, "uuid": "655c7149-0ad9-4cac-b740-b16aa99424f1", "value": 102136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615655, "uuid": "04a56981-e66f-45bb-bcd2-12b600a1c067", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615655, "uuid": "6b52fda9-30cc-4fe1-8269-74a3e57e9b95", "value": "invoice-1637482117.pdf (66).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa49356f-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666596, "uuid": "93645d28-b66d-4dc9-88ee-e70b6f6a2be5", "comment": "Malware payload (Mirai)", "value": "6219ebf0d3142642fd26cea1e7d43a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666596, "uuid": "6f14364b-58d7-4a38-b9b8-a025688a17ef", "comment": "Malware payload (Mirai)", "value": "ba5c674ef38f53ca94152189340ea5fd9914be972c76b3f2270aca176ee107a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666596, "uuid": "f3881f91-6d91-434a-a6db-5d9883861707", "comment": "Malware payload (Mirai)", "value": "4e64f5bba251ce5f62687b9b7b3e9e34178aecf1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666596, "uuid": "4270671c-a1db-4028-85bb-d14cb0e2f5ae", "comment": "Malware payload (Mirai)", "value": "13d18315599fbcfc67d7c5310a6cd9d9fe735c91397a1328b9e3a4c3f9a6add75366aecac346efd38d3923e7a9404c99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666596, "uuid": "cc3c667d-6818-4e82-b590-b9e64e11a4fe", "value": "T109635C21FE766C27C4C8653A11E34331F5B7574674B8CA2A7EB10E9CBF54A40321BAB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666596, "uuid": "5fbe00db-59cc-45f2-ba99-33bb39a61f4f", "value": "1536:U2oZepTVW31MTcwqooN/GtLJYwEm8XsfH/MuhU:U9U6OFtLJ1RjfH/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666596, "uuid": "8c913b00-cd4f-4dc0-95ad-a81ee5acf003", "value": 66748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666596, "uuid": "3e0e1843-b892-48af-b420-cf3410600600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666596, "uuid": "06f790d2-6b52-4f7a-b820-cc3916d663e5", "value": "nabspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24978dda-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666238, "uuid": "5bc4381c-a16e-4b86-9bab-198db0469713", "comment": "Malware payload (Mirai)", "value": "fb19d2306f068ef703ba8ce321df8794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666238, "uuid": "8432d550-62b7-4a49-8e69-670a76dd49b7", "comment": "Malware payload (Mirai)", "value": "bb45d1a0cfcfc61c78383a7a92ff461ee583336b21eb7453358a8687702e893b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666238, "uuid": "f0d5a277-1566-4132-af32-03a46ba4d386", "comment": "Malware payload (Mirai)", "value": "b00c2887f4af82ecb970f17a9188a65a1b6d2a85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666238, "uuid": "45daaa18-126c-4297-9be4-24dff89d8f3e", "comment": "Malware payload (Mirai)", "value": "6c539047e47c4a63c4ba80ab1917487a4eb1e6b5a7aa60fc7b59b17a24b5f88eb199ab6186e06d96b31fae86f90214ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666238, "uuid": "19660f29-9ae4-4f31-8dc9-230cd50b6cc9", "value": "T182242A0ABF200EFBD89BCD3B05E9170128CC581A22EA7B76B674D518F94B25B56D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666238, "uuid": "2096dcd7-a2ac-4f61-9553-e709fd34251c", "value": "6144:rYxBfjXdGzQACxn/ThpxNHTJ7euk/n116lIVqub:UfteAdinj6ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666238, "uuid": "630a9a75-9637-4091-85e7-7c1faf3fe423", "value": 230236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666238, "uuid": "4dc4d41a-b929-4d14-849e-fa925d779c98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666238, "uuid": "12a86e82-5809-4f55-8690-42ee184315f3", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d581f21e-d7be-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765587507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587507, "uuid": "9a69a552-a742-42ba-b60a-680727015af4", "comment": "Malware payload", "value": "f2d4d5dcf4efcc827053eea5bc8ed990", "object_relation": "md5", "Tag": [ { "name": "207-126-162-205", "colour": "#D9EA98", "exportable": true, "hide_tag": false }, { "name": "Byakugan", "colour": "#043E53", "exportable": true, "hide_tag": false }, { "name": "dowhisper-com", "colour": "#CDCE52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whitegambit-com", "colour": "#8EE321", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587507, "uuid": "f9ad2165-458e-49db-961f-2772a261eb3b", "comment": "Malware payload", "value": "bb803b5858814ad02ce0ff7ce604fe87c08fb6be7e5f1118b9eb3bbb33d73bd5", "object_relation": "sha256", "Tag": [ { "name": "207-126-162-205", "colour": "#D9EA98", "exportable": true, "hide_tag": false }, { "name": "Byakugan", "colour": "#043E53", "exportable": true, "hide_tag": false }, { "name": "dowhisper-com", "colour": "#CDCE52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whitegambit-com", "colour": "#8EE321", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587507, "uuid": "645ea29b-6ded-456f-a65a-3b88b1be9c35", "comment": "Malware payload", "value": "61ab3f4c4bc8f562e6f5bc872561e63b152128ff", "object_relation": "sha1", "Tag": [ { "name": "207-126-162-205", "colour": "#D9EA98", "exportable": true, "hide_tag": false }, { "name": "Byakugan", "colour": "#043E53", "exportable": true, "hide_tag": false }, { "name": "dowhisper-com", "colour": "#CDCE52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whitegambit-com", "colour": "#8EE321", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587507, "uuid": "0a7a441c-dc75-487d-aeb8-39cb7e856b9d", "comment": "Malware payload", "value": "babf465395267e5f08c0eb47128c2523b9f8087c6eaad372824f9dfefb4fbd194db25d0849932856bec8e7027d54f6ff", "object_relation": "sha3-384", "Tag": [ { "name": "207-126-162-205", "colour": "#D9EA98", "exportable": true, "hide_tag": false }, { "name": "Byakugan", "colour": "#043E53", "exportable": true, "hide_tag": false }, { "name": "dowhisper-com", "colour": "#CDCE52", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "whitegambit-com", "colour": "#8EE321", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587507, "uuid": "b9aec287-0a8a-4a6e-a32c-58389452212a", "value": "T1B3C79D13F3A311E9C46AD075874B6122BA31B4475B34ABEF374C87252F67EE06A39B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587507, "uuid": "3acb7a3e-87f6-4ef3-bd4d-acdb3105dd18", "value": "72d92078842a42392cfa27c1193e86d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587507, "uuid": "5c9283a3-e9d5-4c21-80cb-fa08a74dbc66", "value": "393216:1YB28WyJyDWWlXEkscn1zabQeFNY/1zoCGWEBnMDKecyB8:1Y8F4cWyXEZrvFNY/0B2Kem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765587507, "uuid": "030283c3-ce6e-4d35-9034-169ab1a458af", "value": 57726192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765587507, "uuid": "d71c4eab-3603-4375-9d81-2fe3670aba08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587507, "uuid": "a0394d26-bde6-4ecd-8347-bedcfa2375ee", "value": "Reader_br_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16d245a-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765627014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627014, "uuid": "18c3f27a-0d5d-4307-8000-d10e95e1a51b", "comment": "Malware payload (Mirai)", "value": "d468f230bfb6fd2d12a81381958137af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627014, "uuid": "05cdfa20-fe8e-4edc-af80-12e79e88de3f", "comment": "Malware payload (Mirai)", "value": "bbde4160f2ad44264e2a6071ba5ca2e2da514a3c292eeb82701c9e7f508f9838", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627014, "uuid": "0ac43280-d412-416f-adca-6dd6fd8cab79", "comment": "Malware payload (Mirai)", "value": "e564d1aee8dc25eb0c73d2b967c764b6b5bfd7b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627014, "uuid": "41a1e138-2baf-4655-929b-adba36e25afa", "comment": "Malware payload (Mirai)", "value": "bc7e7c06dbbb098a5d9e3d0f303944fb1a74deb954a98dcc4637dd3e0b3c144acda43d50e64aa1506f45ce946a3531aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627014, "uuid": "5184b315-8cb9-4186-aabe-37dca9d1b0b2", "value": "T173138D73C86EADD8C20986B8A874DFBC1B53E10496631FF94A4586929043FECF6493F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627014, "uuid": "e27d80e3-cc94-42ce-b541-99da3b02d077", "value": "768:+azh/wt9xWFz31pe18msaVr53zHiFy9Mw/qbC/WgoVAUYICzg:+al/wt9kJDsZ53zH397/qb0WPDtCzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627014, "uuid": "041bf63c-9c64-4a9a-b20d-75f4f5ee394e", "value": 42420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627014, "uuid": "f9f1c5b2-25c8-43a5-91de-76d873cc0506", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627014, "uuid": "ccc7ff8e-4a57-4050-af2b-3f8215d52f64", "value": "Mercury.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adea0a8-d7f9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765612668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612668, "uuid": "533c839f-9218-411c-9c44-1355f4cbdc6e", "comment": "Malware payload", "value": "1ae150efb33690f4f22d8a4cc2d27f00", "object_relation": "md5", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612668, "uuid": "0d4ca899-35c2-4f6d-be0c-14d0cd8987c0", "comment": "Malware payload", "value": "bc47b93cf65f0832081811b1db180436974f333a30ae536896bd5f7600aadf4a", "object_relation": "sha256", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612668, "uuid": "f41e0915-8654-40c7-8651-ee1b7bdbe9c3", "comment": "Malware payload", "value": "7675c85b23bbfe40a30a7dc061a9b48dc4e41e7d", "object_relation": "sha1", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612668, "uuid": "e81e067d-f440-4ef7-90c6-7109c5ea5a6b", "comment": "Malware payload", "value": "e4b5574614fc488e71c59baac8cebca4b597bcf292fb9c040f2c548bd3d0264d84030707dac922e3aaeb1f28462eb62a", "object_relation": "sha3-384", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612668, "uuid": "72895302-b49e-4819-9964-797f1ec35e8a", "value": "T1E0F0598B628C23E03C25C8FF985E928AE088C255679318A0C3F27996B08A6D47814775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612668, "uuid": "b424d7e0-a373-4178-96b9-8f66521619de", "value": "12:ZNAvjr4swojlN8eYazkRE2im6KU8VfB8ErDnqRT9FfW:Zr9amE+53r7QT9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612668, "uuid": "23098d54-45a5-44d4-a2a3-b7a7295f7db9", "value": 640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612668, "uuid": "3532676d-7966-4cb4-b163-200ae8a720a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612668, "uuid": "7110a800-5121-432d-81c8-80d63f92d737", "value": "6a533ac2-c76c-623c-14d3-9a6df737a6c4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5b20fb-d7e7-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605185, "uuid": "0fb72b6d-ab71-459a-bd9e-ce8da041b885", "comment": "Malware payload", "value": "c58a68dfd9b9f65057c6ba172e1c3891", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605185, "uuid": "f86e8de0-df9f-4fa6-afa0-4fb8e74f444e", "comment": "Malware payload", "value": "bc4c1cd39d60c29959a4909a5ff71db566a06d62d75405a37e710daca2d4771f", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605185, "uuid": "e0afb9e3-0736-4d15-a0d2-56a50e10fffc", "comment": "Malware payload", "value": "37f36e98a8cc758ccd17b591d07e1939000bd44c", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605185, "uuid": "027fb718-c668-49ef-aebc-9eb91918fce3", "comment": "Malware payload", "value": "1a92684cf109e1cd04de5538f05931a2d30c344f2342b551acb6a2aacd97a36142de89dd168266af022eb9b2256ca166", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605185, "uuid": "39567e9b-5064-4e67-94bd-97e7ec217afa", "value": "T199843B63E3682404C3B842B5CA295358B935FB9C577003BB3B90A2FAAEF53545D1BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605185, "uuid": "63429184-8be5-48ea-b136-b00ef18de7c4", "value": "3072:YFCm7qEq970hNXz9H5/AZtBSeo4fkyiGh3VUyW3uRfaRNYf66xUWxp/GJPbPjgeh:xS6o9XGh3VBbBl+PHdyiu/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605185, "uuid": "96c14fa1-4142-4470-a051-0b2691571934", "value": 383936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605185, "uuid": "25dee305-6982-41ce-b3e4-3ba5bb3527b3", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605185, "uuid": "1c10944c-5e2c-400f-a4f0-1c72e02cb49c", "value": "bc4c1cd39d60c29959a4909a5ff71db566a06d62d75405a37e710daca2d4771f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a143c5e8-d81d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765628221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628221, "uuid": "632ff53d-abfe-4cc1-8db5-4a440b5062af", "comment": "Malware payload", "value": "9a96485944a9d086b8b69bf514d76634", "object_relation": "md5", "Tag": [ { "name": "github-com--niha0wa", "colour": "#0C2D91", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628221, "uuid": "07602611-8f78-4f5b-85a9-81201cad92d5", "comment": "Malware payload", "value": "bc609ecf8b6e86c3cc0427c760a99122d02e3b699b7454a45cea48bdedefb5b4", "object_relation": "sha256", "Tag": [ { "name": "github-com--niha0wa", "colour": "#0C2D91", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628221, "uuid": "42fc7bba-a688-45ca-a70a-ab2d72df6360", "comment": "Malware payload", "value": "dfc7ca8dddd89775f1321f4c096ce1929baf93a5", "object_relation": "sha1", "Tag": [ { "name": "github-com--niha0wa", "colour": "#0C2D91", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765628221, "uuid": "60bbf13a-7be2-4531-8cd9-4bbe27e5e119", "comment": "Malware payload", "value": "cd3421b3e4ebe846fea1eecc4c8f1df391d51c85f51d02b9c254fe91a831e40e6b2169128e9239ea7c032c18c4fdb615", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--niha0wa", "colour": "#0C2D91", "exportable": true, "hide_tag": false }, { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false }, { "name": "py-installer-cc", "colour": "#FC8B2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628221, "uuid": "df0b84a4-3c73-49c4-9e2a-d412cf1bf0bd", "value": "T17CF3D76A47E2132D0407C56A8AFE6F49AFB68807CF4884987EFD0EB09F5DD905C4ED46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628221, "uuid": "657ee75c-1aab-4716-bb03-e16bac7b2017", "value": "1536:ocJKx4N1CtllcV0ybz4DrlM+HX230vD9v2l4O4DHc:hnN1OllK+lFk0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765628221, "uuid": "421ebddf-ae22-41ab-a44b-f4a4e9e061bd", "value": 157791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765628221, "uuid": "90df6585-fef0-4742-939c-8d751e3ff6b2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765628221, "uuid": "e0fdaab0-ea89-4dbc-abbb-c7bbfd61e81e", "value": "react2shell.py.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b84283-d805-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765618049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618049, "uuid": "4a2b5492-41fb-44f5-8dd2-c18580f5a166", "comment": "Malware payload", "value": "f66007f31022176d72181e4a88950012", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618049, "uuid": "1901ab13-82b0-4645-b664-8ae235845e93", "comment": "Malware payload", "value": "bc8e74c8fffa0c0f05c551b5de7587d41c0cc4069324c6b3effc64553a9e1a21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618049, "uuid": "35a84d7e-19db-468f-b266-6aa3b46c846b", "comment": "Malware payload", "value": "eb5b764d33b2156f3c4dffa6a7b8fc8dc3bdf08d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618049, "uuid": "a5dffb30-098c-44ee-af09-de50e79c1db8", "comment": "Malware payload", "value": "9b2289143cc7740f4d3ac74fdca6a73b1e222e057d3e4c0155694ea30016d2761e5f64d74b645d943627b46b331c6b05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618049, "uuid": "fd1e4a83-9613-4b81-87d2-bb82a1312d44", "value": "T115C533EBD18B80623D7BCEA6A33154CD658AA14FF5D0B472864878D50CBE3C09275BB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618049, "uuid": "487ec76c-a551-44c7-a881-a0ed13307ed4", "value": "49152:NsoepnyRvcCfJr9GYu/UteEtYNBHHfGD6Y3xiyyKfr8UXERglt/:2oWnyRkIhGYu/UtRtQlfGDX3/3fIgEKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765618049, "uuid": "af5cfb05-dac6-4901-afa4-a5d9856249f4", "value": 2607204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765618049, "uuid": "3a0b7d83-11bd-413d-ac84-2f46ef5a6688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618049, "uuid": "7927cadd-f5b0-4e66-afa3-f31d5486b6c5", "value": "shell2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cec80b-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607051, "uuid": "092a239e-3ccc-4cd9-a9e5-de2d99c3ed5b", "comment": "Malware payload", "value": "0675ce53bd9d77780f6b7980894b08c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607051, "uuid": "6d7a2613-349f-479b-941f-8b26ded56a38", "comment": "Malware payload", "value": "bc938665687e838ae279fc4ac0a970eb3056594efebaa4185ea8a061b1d24d73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607051, "uuid": "79d46f1e-62d4-40e2-ad7b-aa6f735fde2d", "comment": "Malware payload", "value": "be3fdfce1fa834796c6a6eb25f51ae6a001c83f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607051, "uuid": "634d32ad-9edf-4ce5-aa0c-d23278029767", "comment": "Malware payload", "value": "cb59a6048d09a408aa64cf3726c680eed458418a7f6490d6bb700e3d0f247cda71ff7c71f787e03c302a911b07424409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607051, "uuid": "dd2b0ada-2eac-48c3-8e25-2fa5799351f7", "value": "T1249627343DEA502AB173EF698BE4759ADA6FB7733B03645D10A1038A4723A42DEC153D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607051, "uuid": "7c504933-d195-4430-ba1f-904ebe4b84b1", "value": "49152:uVtIAJMzH734Eo07slRXTMZalGbPaph1Xvg+DoSJUoZ9edneGlYxQD5CA1Orp6Jr:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607051, "uuid": "ff9eebdc-350d-49ee-bca3-06ec06b2b8cd", "value": 9230848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607051, "uuid": "3f2213d2-2b02-48ec-9778-6f8206ccd766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607051, "uuid": "c18511ae-a452-4aea-9b6b-35660d19ec92", "value": "bc938665687e838ae279fc4ac0a970eb3056594efebaa4185ea8a061b1d24d73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67888e5f-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615669, "uuid": "77fde308-8ca6-4b95-a0ea-2dec7cf496d9", "comment": "Malware payload (Rhadamanthys)", "value": "d74581be4ab1346ebadd80b979f057d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615669, "uuid": "a98470f5-ff5e-4caa-ad3a-ee9e69dd38d6", "comment": "Malware payload (Rhadamanthys)", "value": "bcaa43ea32cc1c997ecc82b3f7737372469a3a4b4f91c2aad61a1d838446ebbf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615669, "uuid": "deb805a7-b590-4059-906c-b9dc5e8cfc22", "comment": "Malware payload (Rhadamanthys)", "value": "36de60b6f7c11d6383e169aa16901db108f0e903", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615669, "uuid": "08fa113c-aec1-4284-8866-d121cb1b3c1f", "comment": "Malware payload (Rhadamanthys)", "value": "add5365a90f34d033455ce9546504f12f643c8fc6d44be17898498f6e3a6cd7d1b1c1c528a7edd4ac9a84759c51f5a63", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615669, "uuid": "0baf4822-ce00-4b60-8618-5d4154863642", "value": "T111A34CFD7CD6D5F5305965A84A088A69DB2EC3711DAE058E8C1AF8722CCCF0925C2DDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615669, "uuid": "1687de4d-65e6-4c14-bbd6-cf4760749687", "value": "1536:GDB7eKg20b8lr3re+lNlIzmNlAdInZuj6BkQWJ+aY:GDB7b0b89bJl/IzmNuInZuj6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615669, "uuid": "8f5f15bd-ea10-4bd6-83d6-cb1e589c1cd9", "value": 100063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615669, "uuid": "04a33230-966e-455c-8893-798cbfe0b33e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615669, "uuid": "34a104b5-f10c-4edd-9684-873790fe2c7b", "value": "invoice-1637482117.pdf (64).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d24ff37-d85b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765654763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654763, "uuid": "0ec0c264-b718-400d-b39c-31c6df480a5e", "comment": "Malware payload (Mirai)", "value": "dca36492d7e67121c8b7e0bf7ab9f6a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654763, "uuid": "4de557b5-2d41-4b57-b4b0-0cb4351ecb61", "comment": "Malware payload (Mirai)", "value": "bcb0bc95a6219cee06813b8b2d20d58094a0f1fe88d087297334bc17e95c4d36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654763, "uuid": "62c57c9d-9ec3-432e-8819-84ab70946ad3", "comment": "Malware payload (Mirai)", "value": "8cf66d7f2e95c3ec65edce747b55cbe6dd98d279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654763, "uuid": "d3aa1f22-fcf3-41e8-8a06-379ae4004914", "comment": "Malware payload (Mirai)", "value": "3fb34efe9e5ba14dbb3ddc580a60d8d2851c96bde3208ca740dd7cdc83af6eec3bbda8093c73a28346f4c452dc0ab85c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654763, "uuid": "d0089a57-df98-4980-979d-bf083b623433", "value": "T16A93E786B8818B65C5D552BEFA1E11CD332317B8E2DFB213DD106F257B8A46B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654763, "uuid": "ada7a596-d2d7-4615-90f3-19ea6e7d85e2", "value": "1536:kpnajBkD4AS7X5jLVMgqftiW1DjVnO9Xe6oWK4XHqW3WMcii6sIFJBS670TYOnvJ:Tc4f5jLVMJf1hnfkK446sIFJBS6IT9nB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765654763, "uuid": "abc21f74-e09a-46c3-a1b2-10eadb450566", "value": 89144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765654763, "uuid": "d5aed46a-2b7f-41e7-b35b-6aae9221cf0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654763, "uuid": "c94234b6-1b0c-4249-9358-11918c67e03e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cbde49-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615770, "uuid": "ca9abdec-bb33-4a32-8c6c-be5cc698c424", "comment": "Malware payload (Rhadamanthys)", "value": "ae8ddbd43df2f0d2ef4239085b5a265c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615770, "uuid": "173487e3-a257-4e5b-93fb-dac084dc5801", "comment": "Malware payload (Rhadamanthys)", "value": "bd12b21fc095c18b79b1fc0428522b9db528e4b2ea29ced699c3a8af1a9cf71c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615770, "uuid": "25fd8482-fe36-4473-80f8-39ac3e64cb07", "comment": "Malware payload (Rhadamanthys)", "value": "df4071093c0324139666c4e8f980250851e7448a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615770, "uuid": "97515f5b-c5d1-4100-a89a-dc352f348c2f", "comment": "Malware payload (Rhadamanthys)", "value": "b3febdb294b9177fdf07134716fa194e714056af573e22034a88674ea4ff59a6e8235fd4af0dcd0b9f06d1269979a3da", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615770, "uuid": "8ff8fd5a-f3e8-48fa-a60c-b4c7e9b8bd7e", "value": "T1AD933C035EA4FCB004362BED695BEBD4EA0754CE56969392C74BBA20F14933C35F528B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615770, "uuid": "cd177e24-4bf3-4430-afca-93eef3f332e7", "value": "1536:GDB7eKg20W+ZrTrk4hVL29mQyA5TkfRd6BkQWJ+aY:GDB7b0jvpKKRd6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615770, "uuid": "76283bd8-59b7-4dcd-afcd-096658b25216", "value": 94170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615770, "uuid": "de61723b-5ffd-460d-8164-46452fbd21bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615770, "uuid": "74be95e7-03ac-45a9-b5f7-dd091df4c0ea", "value": "invoice-1637482117.pdf (43).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57144a71-d7cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765593308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593308, "uuid": "948de17c-7eb2-409a-a962-e1c42c6bbbc0", "comment": "Malware payload (Gafgyt)", "value": "c5226537e40692e5ae8c4071b92a0428", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593308, "uuid": "eaf57de1-8d42-486a-a244-555ff8c6165e", "comment": "Malware payload (Gafgyt)", "value": "bd71a74141ac31ea87ac42c7e6837177422576b35e4c5b940ee5f2725b2a9ba7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593308, "uuid": "d29375cf-90c0-4f26-9f78-ea667142959a", "comment": "Malware payload (Gafgyt)", "value": "b62795a9eade1c683c0187f98f544e8b35b50e5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593308, "uuid": "4434e4d2-906c-4ba2-82ac-832b39a6536f", "comment": "Malware payload (Gafgyt)", "value": "fd611c124c463f54412c01997cee3d8115dbd7af47bd379a8fbeb2929cd76f6514e04d24db3e34d42277a39a382b3fb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593308, "uuid": "a0e24d8c-93bd-449d-a606-0e263648a48d", "value": "T163D31A05E8544B27C2D2677BFB9E878E3B315BD85BD7332256256EB02FC22482E3E550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593308, "uuid": "4f5b63fe-a029-4598-816d-af34df25cef7", "value": "3072:sHHy6TuR/dxNjZVhKJblajvWKJeF3cATqQUrlC1R4Jw5hMlG/QgPZiV9w6PqmcQR:IHy7vT6c+WrlC1Rww5hMlG/ZmcQNdLeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765593308, "uuid": "60c9b685-8497-4b96-9e84-1b3937ec23eb", "value": 138634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765593308, "uuid": "1fa7fc33-c3ff-4979-8626-a342e440509d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593308, "uuid": "9b377cdd-d29f-4863-8b8d-f209d444c4a1", "value": "ionetworks.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139966c2-d7eb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765606509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606509, "uuid": "92a853dd-0b98-4dc2-9ef1-4380b9d4f5fe", "comment": "Malware payload", "value": "dc3bf2935f09205e61dc099ff10e109c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606509, "uuid": "c07f46db-260d-4ec3-80e1-d040a516893c", "comment": "Malware payload", "value": "bf13ec1be8d8ab31dc40926b2923a8bbd383028e11526a7f22f7257f4859c675", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606509, "uuid": "a559bc61-2bce-4860-ad20-cf7b88caff7c", "comment": "Malware payload", "value": "d11917ae4eea4a55e35f1c4782f0b4641b145253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606509, "uuid": "52f5904c-ea91-4c3a-9b3d-c01fbf648ec6", "comment": "Malware payload", "value": "7e05ea649d3d28204b640df077e7f9dc6242457ca55521e1ad325266d6f1c6847ff6c2d8efec066c2d5f02cc3470f576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606509, "uuid": "6897ebbd-3466-4b1d-af94-1338b18b19e5", "value": "T1E945E875FE5EC4E8E9575139883108279B23AC1A3B9025CF118CF6A6FE32391057EA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606509, "uuid": "aebb8494-e036-43c6-a28c-4ca40db36c4c", "value": "06cb741e390a5d3929c93b7d12c2f317", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606509, "uuid": "98b8efc2-8a0c-498b-af7e-e40e96a53d7d", "value": "12288:43IUcH0LCUOIcVgjX08a3uSne8wkoOkKPHqoHQWKXc:cdcqJlRjkN3uSne89oOkKPKMsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765606509, "uuid": "4235567f-e720-47cb-b4b0-32c09f5d597b", "value": 1175128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765606509, "uuid": "55c54437-e537-4af5-83aa-e9c87f5d0379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606509, "uuid": "c062a4ea-2e64-42d6-8252-8d142ae2dae3", "value": "bf13ec1be8d8ab31dc40926b2923a8bbd383028e11526a7f22f7257f4859c675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7653076d-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765626861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626861, "uuid": "074e9df0-b46c-4dde-9e6a-38c35e50d8da", "comment": "Malware payload (Mirai)", "value": "27187908068983cf3d045179fbfa5dc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626861, "uuid": "e5df19de-0100-45bd-97b1-969c6a85ace1", "comment": "Malware payload (Mirai)", "value": "bf8090ad9394cdd4500f5e5263f38f4fd8cabc43d6032cef8ff84d11cae1bcd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626861, "uuid": "2615e282-92f8-410a-a90b-145cb56449b7", "comment": "Malware payload (Mirai)", "value": "677d6c484fb33e0b3cf668d62980e5bce7de67cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626861, "uuid": "0a9194d6-2f39-40f4-8fc3-7081ac29491e", "comment": "Malware payload (Mirai)", "value": "834a0fea705100ff4b7e9ab79a079a427f970c0a0a048840101236d20a39f99d8127c93046bb42726c12db62cf7c64f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626861, "uuid": "8db408ad-545a-4e2e-b258-ae0d2037471e", "value": "T14E53830ABF650FBBECABDC3745A9174624CC651A21A93B797D34D828F64B24F05E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626861, "uuid": "f99e0889-2c85-4051-938d-205bba3835c8", "value": "768:IoA81yawwhsmVbNM9Yk0Er9/R5bqe7eeSeFjM6AFXVkWkeLXiSM6BP5V:IoA8ymgYI9/RYmnSajM6MBBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765626861, "uuid": "c5b91830-f0b2-4d3b-b631-88ead367c378", "value": 63388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765626861, "uuid": "1a70c4f1-629f-4cd5-817d-af0dfcf62d18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626861, "uuid": "6dddb2fe-9b92-4591-bace-f98d27b07fe0", "value": "Mercury.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee42042-d7fb-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765613534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613534, "uuid": "1ec646af-d2d5-4500-a045-8d507dd1db46", "comment": "Malware payload (XWorm)", "value": "53dcc46dc1d7ce4a262a3092fa1dd472", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613534, "uuid": "15f72922-2457-43f8-bbb3-a0b0319a694e", "comment": "Malware payload (XWorm)", "value": "bfc3e5216976164cf916164b7e050896c2cc4282ec2ba74066634caf78b80c3a", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613534, "uuid": "62fd2eb9-2c11-4fd3-a131-649576f5a5a5", "comment": "Malware payload (XWorm)", "value": "684006cc0c4d678073ce58a6d9a16949658dbd21", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613534, "uuid": "d1b54d9b-7fa6-4efd-b02a-4f663662ffc5", "comment": "Malware payload (XWorm)", "value": "d88d5c096bbee77487f2777d813270c6a93ba8c921d3a50a088b0ee073a8421dd2dd9d844513b6f6a97b38dc693a4e1b", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613534, "uuid": "cc60187e-a98e-4fd4-ac8f-9c400f0e35ca", "value": "T1F6F0233AB300B2B8C5C5A4D0F0B11CC06A2A05EFD0738748559081655A457FFC27B297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613534, "uuid": "4f38ee69-e78d-441f-8c13-8762f809d640", "value": "12:/8k+5edGpKvhCkG1oCdzFatc8Vj0/6UYvQx98XhJ6hqvOBIMW75:/8kRcKa1Fzz8V+6UYvi98Xn6h8QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613534, "uuid": "7580c39e-dbd4-47db-979c-b47973817edb", "value": 656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613534, "uuid": "2dbed609-d8ed-4ec4-b227-1fb2a384de98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613534, "uuid": "ae732d0e-65e2-4fc5-917d-c1177ad1042e", "value": "bfc3e5216976164cf916164b7e050896c2cc4282ec2ba74066634caf78b80c3a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19638199-d84c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765648180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648180, "uuid": "0b86a6a3-98d5-4e3a-9d01-c8f8285a8117", "comment": "Malware payload (Mirai)", "value": "f4eaaae695d2821d4b2b5fb204695d96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648180, "uuid": "8dc97dd2-7e83-42de-b0b4-6ba7b5e0046d", "comment": "Malware payload (Mirai)", "value": "bff5a847e0de5450ab11f029c560a21d8bc7797507479f5b0b7935e36ff2601b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648180, "uuid": "4c2b046e-dc5b-43e8-940d-ef96ce952698", "comment": "Malware payload (Mirai)", "value": "21d3addf0ca645482fb680ffd60f121ef912140d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765648180, "uuid": "fcca2d65-9f77-49fa-93cb-965429617746", "comment": "Malware payload (Mirai)", "value": "cc6ba6b8bba0666763e16fa2b453bed3af692c5a90bf078c5d48f6a83eea695b94be621a49258339a297410179b6c9e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648180, "uuid": "abc05d57-8deb-4e96-b595-7e8a8b1fba6d", "value": "T1667302CCA156B64CFF5CE8BC02DE78A59FD85658B38857980242CEC5EE33CBB152E458", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648180, "uuid": "0535fede-a125-481b-9ba8-a44152a980ee", "value": "1536:AmXhVTVevNR5re0VImyfpeOkaUiJxQ3b7GyKxlNOP:5DTUvFK0V1yosUiJxevGDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765648180, "uuid": "94b4df9c-8b42-46bf-8a37-9458105d0c09", "value": 76776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765648180, "uuid": "7a5a6a4c-ff12-4064-a23b-ec1d18af2a94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765648180, "uuid": "0d2d2db1-b2cb-419c-82ee-75082d961c51", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f444ed32-d829-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1765633515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633515, "uuid": "26343900-5084-409a-9e6c-b08ba87f968a", "comment": "Malware payload (XWorm)", "value": "c97a4714e38aa7f36e38735972d5ea23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633515, "uuid": "6eaadb77-672b-4dd0-9732-8025799f43c1", "comment": "Malware payload (XWorm)", "value": "c0476477dac02df42dab7a04921988fecdda0652f5d40dd420c0e07b53665d96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633515, "uuid": "e946bfcf-30e5-419b-a4c3-c7f7e8758ff4", "comment": "Malware payload (XWorm)", "value": "5463aeaa7ba053df9bce2124e156e003c346c089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765633515, "uuid": "3c0044f9-ea6f-4ed2-b39c-022f404d71a3", "comment": "Malware payload (XWorm)", "value": "57b1b5c7f5cecf43d4279b2346343413652a6e41e3f29fc3367cd508dd01d4815eb2cd889853d13c1cf00102c9b7bbc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633515, "uuid": "9a311d2a-d25f-4ec0-9a1f-9e3cc60c9084", "value": "T121049A9D766072EFC857D472DEA82CA8EA5174BB931F4203902715EDEA4D897CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633515, "uuid": "4849ef81-93f6-4752-a9d9-81419fe25c4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633515, "uuid": "7f545ad8-cba3-4559-977a-31acafb75451", "value": "3072:WhjJf7tcgk1lMtYgjyGhbcZi3F9A7tu5MJXD6wwzgcyXJkk:QjdRDk1qbki3F9A7tu5MJXD6wwzgcyXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765633515, "uuid": "6d55a78c-3d24-4aff-b4e2-bedadd79b0aa", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765633515, "uuid": "ba76bc53-1d71-4272-8db8-c990f1357cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765633515, "uuid": "1604a32e-aaff-454e-866d-d210624eb8fb", "value": "c0476477dac02df42dab7a04921988fecdda0652f5d40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc65c30-d808-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765619250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619250, "uuid": "00429646-2ff6-4456-b63e-4dd14419302a", "comment": "Malware payload", "value": "cae7b77aedc7e81b0ec4eee5dba77608", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619250, "uuid": "db0bbd18-ad1e-42ac-9ade-85f0bd0f38c3", "comment": "Malware payload", "value": "c270f8d98c57039e9e378e69335a727bdeee175e6e0af6407b0445b705c418f7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619250, "uuid": "2e21e793-a4ff-44ae-9e05-a2de96ebf568", "comment": "Malware payload", "value": "e98f92ec6d7cfce59f6a238c6e838405c82be79c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619250, "uuid": "b5ce42ef-a63e-4690-939b-54fea911c9e2", "comment": "Malware payload", "value": "ca6e2c68ef6d9befe1134bf9c5387f28adcfefea3077b383ce8aeb8fdbcfc2992625ab2470a32af616a11db77291b8b6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619250, "uuid": "69d01a98-290a-4ee9-bb50-682377d5042c", "value": "T1960125CE71003F65C5C9C91FB6A3896C10CD82CA46DAA7CE3CCE44769280AE4F404E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619250, "uuid": "d68780b6-2990-487b-be61-37e1fa976de4", "value": "12:KSs6wZDgMZDgMnXNyHe0fDgMGswDgMPMSYeJB/DgMCEpLDgM1ynDgMds:KSKZjtnX6rGssPcebxpv1yjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765619250, "uuid": "0de39536-c610-4e91-b5e2-5f0be3625047", "value": 842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765619250, "uuid": "08de8841-6a63-420e-a6c9-16bf1c2c4479", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619250, "uuid": "98823939-fcb6-486e-8d2d-bfb107da7268", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ec2cfc-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667288, "uuid": "932274f0-3f6f-4d55-b8ed-86ee6437ac76", "comment": "Malware payload (Mirai)", "value": "a4d190558c4f7b0855711d2d190af8c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667288, "uuid": "05d8eb8a-e479-4ae3-81b3-f946743e5996", "comment": "Malware payload (Mirai)", "value": "c29c154eedffee31fb76d00d15c4ee9ea0e49aca9c2f530329ca030bb4cdc0b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667288, "uuid": "dbdca42d-94c2-459d-ae2a-7fb884667d98", "comment": "Malware payload (Mirai)", "value": "d491101c578c7744e7c3cf0ccf47c20b0f06a5c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667288, "uuid": "78e914ec-7c4c-497c-9e7b-eec9ffae142d", "comment": "Malware payload (Mirai)", "value": "83726e9415b60e54c3209570f365a52bde40c9d8f5afb63d465211d3321872501e27f0689a6e00f66257d4ec03f11ee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667288, "uuid": "8e1719b4-02ba-41b7-b610-0e38ec5f88f3", "value": "T1FE731B82B8418A23C5D552BBFA6E42CC372523E8D2DF3207DD11AF257B8A42F0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667288, "uuid": "1c73a20a-6062-45fa-aa15-7bd9090c622f", "value": "1536:GtqnDbnZCDEQT3YIJkuYaZqQGvAW3obvgnv8VR:GtqndIiaEQG4Ao7gnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667288, "uuid": "416f1a4b-d541-4892-8d5e-e6289141e46a", "value": 76512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667288, "uuid": "3c86906f-4b37-4caa-b4dd-3f04981e2005", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667288, "uuid": "c63d5a9b-c0e9-436b-a3ba-5023e281158b", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9666a8c0-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613171, "uuid": "aa771819-c5ba-4bac-8dd9-567f2c815284", "comment": "Malware payload (Mirai)", "value": "8bcf33dbffb0a7ad56cea471aeb9738e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613171, "uuid": "6e32583d-04f0-4f17-be4c-e98119bb4ba4", "comment": "Malware payload (Mirai)", "value": "c2d5a646569000d6599fdb019a10233131f044a912e4ba028b6a4a5cb3f3fbdb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613171, "uuid": "f028593a-19d9-4dce-9021-96bd6e4195dc", "comment": "Malware payload (Mirai)", "value": "8a14fe2c146913308d54ed858d858f3030fee689", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613171, "uuid": "01d36e9e-8b2f-47dd-bbe6-229f24c2c920", "comment": "Malware payload (Mirai)", "value": "044bd52f4765c06ad199937da6d53813e037a7041abdd50ca1221830b732e2bf6705d08e32a410a129d8e9c3f7f0c1f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613171, "uuid": "c688dcca-5561-4987-9bf3-7d0138cbaf9d", "value": "T112515EC552846D3868B7AA12F6B68128308191D39CEE7F96DEDCFAF4878ED247140763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613171, "uuid": "c9e497fa-0f77-43d2-9839-1c49fa606395", "value": "48:vpF70F7N7hpFvF6GpFgnFzPpFfFKWpF1FoUpF71F7o7UpFfOF3bpFEF9RpFhFcgt:vX707N7hXd6GXgFzPXNKWXLoUX7L7o7E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613171, "uuid": "dfd996cc-772e-46bc-8cb0-8b1abca7a687", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613171, "uuid": "555cc45e-07ae-4609-96b0-208a80830ec7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613171, "uuid": "4fe999a9-e35e-4e37-babc-2fe336c0d2d6", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e1fb4c-d840-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765643080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643080, "uuid": "222396ff-6b00-4fd6-abba-67bd3091e22d", "comment": "Malware payload", "value": "f9f30c5f8521cb2618ccb31960c1b598", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643080, "uuid": "cbcfb8a4-af36-4861-8303-ecf028d7e847", "comment": "Malware payload", "value": "c39f4a82642778198c30e8f2c06a70df627c558f159ce9fcfff0f5005e8efb0f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643080, "uuid": "f117776d-b05b-4ae8-a8b9-3b5f09483a92", "comment": "Malware payload", "value": "54e18a136258439ebb87b59b8b37be0d3d018dbd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643080, "uuid": "291dc06a-13d0-4b9c-bb90-a98dfdbc7afc", "comment": "Malware payload", "value": "bef4faeebfa5e8ff778cacb8f74400cdbcb0a6f698ee3fb0f9c36ba20bf547230bc1b7c58e474421650ce103786906d5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643080, "uuid": "75a3751c-3fa4-4ace-83f2-bf02fe37c693", "value": "T146B5335CDFA61A88C286EEFB248EB267549D33D30474CC5A280E66EF45F596F36C190C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643080, "uuid": "d76fb0c3-f36d-44e9-90f5-e4bd0971d64e", "value": "dc6b57a7282f87959d9942f26d5c0b74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643080, "uuid": "5860fac2-77ca-40a9-a930-35962a011cc8", "value": "49152:CsyYPTWhM1OfjrFCuH/Jfqu/5X1uwHPp1F5TQKiY5It1hxZ:CsyaWhMILr5Su5X15vp1F5TQKHiThxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765643080, "uuid": "20cd0bd7-ee18-4305-ac17-600c6a7dfbd1", "value": 2447872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765643080, "uuid": "7717b9ef-2e44-4db8-9b89-a99590bc974b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643080, "uuid": "ca65f6fb-c0f8-4fac-ab4c-667b28cc806a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a9781a-d853-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765651400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651400, "uuid": "fad0ff95-7ae4-4b13-ab41-ee42db9a1b74", "comment": "Malware payload (Mirai)", "value": "fe969c930b800d58a8363d07148e21a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651400, "uuid": "986c16c0-0651-46d4-8075-0884b0150159", "comment": "Malware payload (Mirai)", "value": "c3f2f73b8aa4355945c06d6a89066c8563dfc3efe7611bcdf20dfec918f13f4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651400, "uuid": "4fd3e044-68dd-4fc4-b874-8f28511e5d69", "comment": "Malware payload (Mirai)", "value": "3c5ffea09f56cb68e04ce0e5d744faae6e9f2d8b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651400, "uuid": "a5a34537-01f3-45c3-bbd6-beafaf957d14", "comment": "Malware payload (Mirai)", "value": "bdd8e24c7412113ab0cf8c13e799e5d675afe8d44be6148e409613ac3516f511fe7705686d3e0813a73226c625d49c63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765651400, "uuid": "6878f726-808b-4db8-88f3-68054cb6c35b", "value": "T167042851B8829A27C6D523BBFA6E028D332623E4E2DF7117CD215F21378685F0D77A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765651400, "uuid": "7045978f-e0f5-4fb3-8946-5022a443f04f", "value": "3072:hlx5JKMIb4Vn0otnAYPv2IPU4wpHdXyroZguhPDGfs9UuL:hDib4lDAYPv2IPU4YwrSgcbGfsquL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765651400, "uuid": "9d589cf3-dc0a-452e-9137-87000c5051f3", "value": 177932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765651400, "uuid": "eb5f85fd-1c17-4324-a6ca-626b07f793bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765651400, "uuid": "2ead4ea4-a46c-46f6-b4ea-5d220bf73d34", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab7e9a2-d807-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765618842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618842, "uuid": "ff1850cb-4a53-4090-acfb-bad358e38796", "comment": "Malware payload (AsyncRAT)", "value": "939735650515f7283cac38fce0e07ec8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618842, "uuid": "df6e58ca-dcdc-4bc6-b43a-3e2834a6f403", "comment": "Malware payload (AsyncRAT)", "value": "c40b20fd7fe58acdcceb2e99a5cede63e051ae0b80325d403eb781e6bdccb1af", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618842, "uuid": "01004560-aeec-46bc-ad31-76a77b15b694", "comment": "Malware payload (AsyncRAT)", "value": "4ce3e757d2e0b33a0887c8c749afa90ad428446a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765618842, "uuid": "2be8d185-5ca7-4420-b4d7-7a6a158d5954", "comment": "Malware payload (AsyncRAT)", "value": "34a7d2fa95fceefafb3a6c046bd178364accbb123dd4ddd3107a4b54c09e18595bb545f23b021ee935f79156176427ea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618842, "uuid": "5d63c681-886b-4d7c-a531-ebbfd3c80565", "value": "T1C3E38A9D365076DFC85BC872DEA82C64EB51747B931B9203A02716EDAE0D99BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618842, "uuid": "8d71ede7-f0f0-4020-bc33-73d5421deff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618842, "uuid": "a9238d4d-308e-4a28-af18-3adf25dff13d", "value": "3072:y7udRzO/tYsm3J0+VbDlwpRQa4B5KVQc0LiBUeDPkeD+Ft42:YudVsq3tDOQa4B5KVQc0LiBUeDPkeD+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765618842, "uuid": "1225c27c-dc8f-4e4f-a651-42b975f89441", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765618842, "uuid": "8631a20f-88c1-4a22-b778-21784ed2b871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765618842, "uuid": "f628a084-d3f5-4193-a40b-df3eb25da4e6", "value": "c40b20fd7fe58acdcceb2e99a5cede63e051ae0b80325d403eb781e6bdccb1af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d54cadc-d87e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765669796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669796, "uuid": "28c33f16-6b57-469c-8207-1f5b2e84b3ad", "comment": "Malware payload", "value": "30bd73669c76471fda88b1a9f333a56a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669796, "uuid": "fcb1a8db-b58a-4195-941f-c3e1a3db6c80", "comment": "Malware payload", "value": "c40cccb08df5e21b3eb35e964b04a851c56fa3555f201b210277f231a8036a3b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669796, "uuid": "1a117e88-e2b8-4e8f-83b4-7b8b69bcbd85", "comment": "Malware payload", "value": "ea6b1fab4c95c9b36ab7ab5c40b03ffb0b9a4140", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669796, "uuid": "7267b9b0-f14d-4626-97b9-bfbf0eac55e0", "comment": "Malware payload", "value": "9a04ee9f17a6e4b64a5c18f5dae47ff500454a44d36c4737610013c5ffbd4504d80e635c2cf3c5eec7032286129f4b0a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669796, "uuid": "04318899-b3b9-4561-bca7-4c5b969e0884", "value": "T179F3A55A2A8B40D90A5B7025D55F2D87DF78040F018C9B80BFDDAF8E6F93970A2A77D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669796, "uuid": "e1908cdb-cd88-4206-8ff7-93b8e4f750ec", "value": "3072:vAO+I4fRjMpc6Oku2IrX1A1NgtCuPOD4b9YDHBXi/Vm:vAO+I4fRjMpc6OkuTX1A1NgtCuPOemD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669796, "uuid": "4ad24c7b-7258-4ec5-93d0-ae057bbc8a5a", "value": 166581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669796, "uuid": "4e88dd9c-6fb6-4f53-aea1-e37c597bcec6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669796, "uuid": "3a7d43d0-e906-4046-9145-05e1c0242c15", "value": "Photos_Alpha_v9.2.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a490ff-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615582, "uuid": "375e0c65-5c70-48e5-90d2-1de222a8ad87", "comment": "Malware payload (Rhadamanthys)", "value": "660f8aa656be4ae33a9778cd2671a2e3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615582, "uuid": "9255df4d-9cf3-45cd-8213-0d2d502fdfdd", "comment": "Malware payload (Rhadamanthys)", "value": "c42dd554523c9d3367c75e307b00ff6a39515526450f6a5b524630b030ce937b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615582, "uuid": "bac059eb-b042-4d1b-91f1-f5401aa20991", "comment": "Malware payload (Rhadamanthys)", "value": "06f0d5136cc2e9b9c7a0e29faa8203d45527d9cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615582, "uuid": "e4b5ed16-99db-4e56-bbfe-79a1a0e54534", "comment": "Malware payload (Rhadamanthys)", "value": "4c9a5644f2bd677a6820f90dc7fcd3de6e528adf73921d47d572278b1da15dada9f550bc7d0ddaeb9d8738bcd9bbe078", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615582, "uuid": "19193392-085d-489b-b4c8-5cc725343939", "value": "T1C0A329547A666E821740D9377AEC68315D8ECCAFD877F044762DBB633050B893F289CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615582, "uuid": "9ea6eb16-d3d6-46d9-8a5c-1b01924f664d", "value": "768:GDhd0i7J4sYKgY/CMNfWdaH6UrXa+rfr5IH9KcAQO9JSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20Ar7rfr58FAQoJ6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615582, "uuid": "d93187ec-d460-43ee-bf28-a358c20ed0ec", "value": 101466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615582, "uuid": "293a377c-bcc3-4952-a9a0-6de089b74fb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615582, "uuid": "8cfc4c2d-743e-4770-813d-ce0e31b699d7", "value": "invoice-1637482117.pdf (86).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467548a6-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615614, "uuid": "0bcda3b0-0757-4ae1-85cd-bbb73d9d3511", "comment": "Malware payload (Rhadamanthys)", "value": "51c3e03fb6fb37ab4d03804656141433", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615614, "uuid": "f537748a-8f01-41e1-99a1-1eeacfe4afcd", "comment": "Malware payload (Rhadamanthys)", "value": "c459eefb22862a9db72964ad0371c159d3ae7350f2e3da8a2a6da69445eddb91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615614, "uuid": "27e48f9b-77b1-4dfa-be59-4b7c272fbf3b", "comment": "Malware payload (Rhadamanthys)", "value": "a3f94107f1387a92e2c54b39b279031325864d93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615614, "uuid": "55c9d963-fb90-4f85-810c-c2724d666610", "comment": "Malware payload (Rhadamanthys)", "value": "ed99ac946440cf991bfcca4f828546881e476d824e8d579d15d08a3fd5f2efb316020731f9c67ec590ea6ee213b3eeab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615614, "uuid": "7dd49649-4319-43e5-8f87-9a7a58bcf41d", "value": "T171A3F7553E068CDB31166198AA8472F4D616E95BD80307DF120F2BEBF116BDB2436BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615614, "uuid": "c463c525-a8cd-4730-8cb1-c9ce02d45b7f", "value": "768:GDhd0i7J4sYKgY/CMNfWdHuCnQrX+8rK4+qHUtAzDwhSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20irBrK4+TtAzEh6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615614, "uuid": "098348d0-725f-45bd-9c82-46ce3944313a", "value": 99314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615614, "uuid": "119cb01f-10b9-4f19-972f-a0df113a326e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615614, "uuid": "1abfa98b-4c67-493d-9309-921cf424f10c", "value": "invoice-1637482117.pdf (77).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f00166cb-d7f5-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1765611174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611174, "uuid": "372a13af-7b5a-49a7-98d5-351c61dd73a1", "comment": "Malware payload (ACRStealer)", "value": "0a2f5bccae105fbcdf7ff6c24996e29b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611174, "uuid": "8c891e0c-82a6-40af-a697-da4d4c1e81dc", "comment": "Malware payload (ACRStealer)", "value": "c46cd09676c6393ba3530f03135d1484ffad998b307347f9d4581393da164252", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611174, "uuid": "865cd9d7-1e6b-4ab1-a76b-81bf1d746c88", "comment": "Malware payload (ACRStealer)", "value": "d9882ca9983c22325e270376a1deb15d11185ebf", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611174, "uuid": "b204fc73-ac2e-4ada-ac3d-3fbeb48a8f9d", "comment": "Malware payload (ACRStealer)", "value": "9802ef9131bb9d4839f1d6b6b37c4482574dd69f34a59fdea2bc96f764537428c4758cc6e884331d86d0db83b5f1e374", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611174, "uuid": "2ab9d6e8-fb34-4ff2-ae6d-277dccbe32c1", "value": "T126967D63B646C326D88601F0887EA79E512D6B35072B10E3B2D82F2DE8727D36635F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611174, "uuid": "a2efb3bf-e49c-47a3-b72b-ddf7d50957a7", "value": "27228055f932183d49be80f1aa505a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611174, "uuid": "9c887b1f-309a-4a62-85ae-9f86933d3bfa", "value": "196608:svS45YtcLGfUTrTf6dOwvH/WFtso+t1Ge283Sq:wYKCOwJIa3Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765611174, "uuid": "181a8e69-09a5-4ffe-8c47-58adb289eef5", "value": 9154048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765611174, "uuid": "f65e6e65-7377-47f4-9028-a4ed99933067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611174, "uuid": "9e45f34c-c4b8-46e3-b5c0-b49355864429", "value": "Axe_Starter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c1afe6-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605432, "uuid": "e7507340-d886-44e0-a599-7e7ab1a7c027", "comment": "Malware payload", "value": "115288be32c3903a4926845f9c692330", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605432, "uuid": "94a178b9-5024-4a45-abd6-9de6d82d655c", "comment": "Malware payload", "value": "c4fd13310c73168d05b2ef9befdf5e041162992306fd7124ecfb049f3c9f11c4", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605432, "uuid": "e0450bdf-afa2-450c-a63e-f465d1ab34fa", "comment": "Malware payload", "value": "875da9ae899b1e7741e3d568f7f16e3c63e6b605", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605432, "uuid": "d8188f49-01ce-4c77-890c-aecf247ebf34", "comment": "Malware payload", "value": "bd02b5fc8e8a633c5ae828fe909dc08d5d64d960380f108722a1c6631d16623c8882da622f08c9ab90609dc936de5728", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605432, "uuid": "2991fa9e-99c0-4fb7-b3ce-20dafa51c266", "value": "T1F686F70B3F9E543AF11FE2FD6672A1173426B8E1590C40E07971DB0789C6B1EAAD4C7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605432, "uuid": "20543f37-1c9d-491b-896b-e515c16f2655", "value": "98304:jMLj34G8LfUxCdKV1bz6pLxbLK+8ePyXWP:jMLj34G8LOn6pAEymP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605432, "uuid": "8bc1b712-bedb-47b0-bbad-d6a923447265", "value": 8254416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605432, "uuid": "bc1197d5-7a2d-4fd6-b3c6-74c0710881cb", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605432, "uuid": "91e17e59-fa86-414c-907a-de9733269a12", "value": "c4fd13310c73168d05b2ef9befdf5e041162992306fd7124ecfb049f3c9f11c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e238059-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605453, "uuid": "b7f56cd2-7b70-4773-8d40-4306502e90fe", "comment": "Malware payload", "value": "4a7bd9c1c186f58cfad0bc86886ed861", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605453, "uuid": "c5dba137-c87c-496a-9d81-999c51f238af", "comment": "Malware payload", "value": "c62f3e8c3872e0e3e4667e0291d827f54febac35836cc56ef807a2880e8ac805", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605453, "uuid": "4433ea42-e9c4-4806-afdb-f26f68e29b1a", "comment": "Malware payload", "value": "887f8a308fb41abd31d979f7472d080444ffe209", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605453, "uuid": "fb133261-926f-43a6-bc5b-b943f5f5dc0e", "comment": "Malware payload", "value": "78b631a1260778cad72bae17353a1941a2ecfd45f7ec09f5885b2d3c24943ec35d3f530fccad01da23b51dd5bc33f231", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605453, "uuid": "5e15f9c0-30bd-4df2-a5dc-1ce53516b7fd", "value": "T1C286F70B3F9E543AF11FE2FD6672A1173426B8E1590C40E07971DB0789C6B1EAAD4C7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605453, "uuid": "e41d3b72-1183-48c6-a1e8-50c0d4c50ab5", "value": "98304:jMLj34G8LfUxCdKV1bz6pLxbLKW8ePyXWB:jMLj34G8LOn6pAMymB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605453, "uuid": "e015849c-b07d-4ab9-88a2-f9caa19bea7f", "value": 8254416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605453, "uuid": "6251bad3-c7f1-47f3-9407-36d239933393", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605453, "uuid": "f0688e0f-a81c-4b44-a8a6-d3c5a07d5dbb", "value": "c62f3e8c3872e0e3e4667e0291d827f54febac35836cc56ef807a2880e8ac805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf73afa7-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765627010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627010, "uuid": "a2bf48dd-74fa-4e1e-9d7c-d207dd7f7c76", "comment": "Malware payload (Mirai)", "value": "76157e563a309e02a4ad2735ada8514b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627010, "uuid": "82b74ebb-53c1-46fe-9d92-daac3c2808e0", "comment": "Malware payload (Mirai)", "value": "c64fcad14dae05ab876f2785b61e320ccbe0b704bef2c27c98ea7de76cb8dec5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627010, "uuid": "88709c58-74cd-47c0-a19e-0aa9cbae0ac2", "comment": "Malware payload (Mirai)", "value": "9859f7cceae3d02eb2e8e48d5b48cb4278fa7258", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765627010, "uuid": "54ba3025-5271-461d-94e8-90424ad500b6", "comment": "Malware payload (Mirai)", "value": "67b1c8bdc3c5c052eefe170526f69f32de3f21ad20d6b78d69db6c50dcb2dd51dcbb68ef5bb3de2f8660f048b05de759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627010, "uuid": "fe93e8b6-9bd5-4b58-bab9-b2444f82e976", "value": "T1D5134CC4A543D9F5EC2106743477E732FB7BF07A203EE98BD756A532A841A01E60729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627010, "uuid": "bb66a698-257e-4020-825d-05b0fafcba27", "value": "768:tt/Y1Z2bIXm4UC9kRwD0uWSKFXIxAJpw+K4yaZm7KO3Yw9DiTNULNc:tBY1ZgIXm4UC9kSo+KFXIxAJQf3YaDi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765627010, "uuid": "c538fcb3-1ee4-46f8-8708-4ed78952b5b0", "value": 42396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765627010, "uuid": "0b88a9d3-edc2-4a7a-a0ac-6273c6ce05a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765627010, "uuid": "b06e83d7-3ba5-4c29-8813-3047999fbb63", "value": "Mercury.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782720f9-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765616127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616127, "uuid": "1577fa1d-d3b0-4650-906e-af28344ea76b", "comment": "Malware payload (Mirai)", "value": "22086b50a950e8c8a289b43aba5ee4a9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616127, "uuid": "1dd48e9e-c5ad-4840-b9a6-34fffcc9416a", "comment": "Malware payload (Mirai)", "value": "c80b0eb6c9290597f29338e478877edc9696accadba950360f3127f11ba33b84", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616127, "uuid": "c75b2509-1001-42b6-a25d-3614ce8d5055", "comment": "Malware payload (Mirai)", "value": "aa9986b6df86f5b36f36afc45868b26950e3cbb8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616127, "uuid": "86313d2d-7e11-48d6-8afa-8cf866900049", "comment": "Malware payload (Mirai)", "value": "3ff5ff671e7ee794f471daf97a8ac048db1976e71f9ada516c75175fc7116cbe01de2b7a4bf7e882aa190bf37c95c946", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616127, "uuid": "857f505a-26ac-4207-a442-182cfcc604b0", "value": "T116012FCD125473EEC5888E0EB6934F9814544ACF5D8B1FCC7A8C5C269784E54B834B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616127, "uuid": "3e7d46c2-f241-48f2-9d9a-e78c882e7962", "value": "12:3s6wZjYNX8jYtXNyHe05X8jYPQ8jNSYeJBV8jKpB8jYb+8j6v:3KZjfKX65AStemKpauJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765616127, "uuid": "c8d18200-4491-4f43-bc29-4d5f2258acbe", "value": 796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765616127, "uuid": "f9ebef21-531e-44c0-abdf-85f2f214c92c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616127, "uuid": "031b54ca-70e4-4eab-805a-bdd744a122e4", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b12e4f4-d86b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765661551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661551, "uuid": "b2689d8b-db55-4368-a941-a4b08406b530", "comment": "Malware payload (Mirai)", "value": "a745b9e3469fb2ee16b8ab93284eb8f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661551, "uuid": "f56c88a0-a421-402c-bc3f-e861f875e99e", "comment": "Malware payload (Mirai)", "value": "c8b82e7a1952347fb2c8e8a3380aef039671229ab5b7a70b09f61820dc44074a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661551, "uuid": "951a7977-1eff-4150-9e01-83af549c617f", "comment": "Malware payload (Mirai)", "value": "958be680d33436de1df3124e4f2fc061f3a3550b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661551, "uuid": "94984ec4-8782-4071-8844-189a410cd0d1", "comment": "Malware payload (Mirai)", "value": "6ff579da8dd85dfab1116a868c52357e0743914579f04a6ff35ea4ba9977d8a7631d2827f22210940903ac5e2dc8c730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765661551, "uuid": "930fef1e-303e-4672-8eff-727ad5c22585", "value": "T1F1630255293FF433D0613C37E98E980976B82FE0C9AD73B62928D03D3A91E5F15A1D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765661551, "uuid": "4b392960-ed11-4f19-9873-385b369eae8c", "value": "1536:O/xLg/ch4cBRMbqKxauqBz17AWzNmtE1SLikUW49EBx0FZRTZC:OJSch2bqKxazBz173NOLikx4SmRTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765661551, "uuid": "8edb551b-d079-40c4-8d12-0ad7de98d80e", "value": 68884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765661551, "uuid": "a3b70999-cc2f-4dcb-bfca-0891f9c0f481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765661551, "uuid": "7201cefa-9476-432a-b0b9-39156f7ae535", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f57dce-d81a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765626859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626859, "uuid": "9366b9ce-8308-4da7-a0c9-1733d4486f15", "comment": "Malware payload (Mirai)", "value": "5e2bf62c0b5e1112b79a286f6b263485", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626859, "uuid": "5220ee6c-ee9d-454e-ac49-2fe2f409e5cb", "comment": "Malware payload (Mirai)", "value": "c97f508f4a9297f35a7000bc46cb2330e077d46d16814f9c270740ed80775506", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626859, "uuid": "b95b2778-ec92-443e-a8a8-ec524f3b803e", "comment": "Malware payload (Mirai)", "value": "d2ea593adebd5b485434e654f4d901688071c254", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765626859, "uuid": "d5c02af7-ce50-4e35-8ddb-9ad8b1d051d6", "comment": "Malware payload (Mirai)", "value": "8f309da7af83e78671c8c0f26c2f60ee8134ce724633b05b737aef8e32d0dda408a6a4a814a674b834df3d321c95748b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626859, "uuid": "2160923e-8c87-4865-8433-c0679e29affb", "value": "T1D953A71A3E21CFBCFB9C863547B74E309648339526E1C685E19CEA015EB070E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626859, "uuid": "3e4157c8-b4fc-4f5f-ad01-454404b6d6e3", "value": "1536:WNrNhDOB/AwPpWunn+HxlOkxqzW0sD+mk2eKf9:WNrXDOsun+HxlD10sD+nHKf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765626859, "uuid": "e5bf227f-fe9b-4972-ab83-5e5c8cabc730", "value": 63388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765626859, "uuid": "9994e71e-cb4a-40c0-90b5-6b814244c119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765626859, "uuid": "45f5b1a3-06ac-4b6e-a32e-d4b765a8457f", "value": "Mercury.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8d5d6c-d844-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765644831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644831, "uuid": "ae67aeee-693e-40a9-be18-21ee235d69b9", "comment": "Malware payload", "value": "5503335b77e768a7a66dc63c4b164a99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644831, "uuid": "17c3a4d5-7caf-4105-9b8a-a1461f506cdc", "comment": "Malware payload", "value": "cab4b5ba9013d23a3cf7a6d209c80a2c7cb2810e78d9a0a7d613e39258cdd9c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644831, "uuid": "c29a2be2-eda6-486b-a1af-9d1e3cd7901c", "comment": "Malware payload", "value": "513b76e6957e61821584e6e338afa2a8d0ea1575", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765644831, "uuid": "651beb30-a55d-426e-bb95-32aeb07e8ada", "comment": "Malware payload", "value": "dcdc14700e3289dde80fd33a6b0a5e00cdd70578efea4c3738c83b87a7191f9ede4bcc553d467e3abcb1c842df6de355", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644831, "uuid": "7ce2a605-54b8-45d0-a1bf-1dfe2047ca6e", "value": "T13AF36077EC1707CEF578B770CCD80BB1E476582CA5A006034FA6A65D4396E99C76A8C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644831, "uuid": "08fdc387-d782-45f8-944b-b30b80321a65", "value": "1536:1cce+QjoaGt03N7K8ojFBSjkWLCxrTe82Fdf8MF55rO3FSCsN/cNkmmlO/5QqkQI:6c6joC3NiMzKSC/NNmlO/5TebCeDEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765644831, "uuid": "cfb958ff-41e0-4162-ab7c-4d72aed414ee", "value": 163792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765644831, "uuid": "cc5913da-5e66-448d-8b6d-a32f0c234172", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765644831, "uuid": "f438225a-1248-471a-afbd-12c2a35e73e2", "value": "x.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9492053c-d874-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765665566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665566, "uuid": "1d0db60a-c6dd-4da3-9cd3-0a80d17a98f0", "comment": "Malware payload", "value": "8ebe9e4077eb0b3c2e67211f9a183d0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665566, "uuid": "52dbbf9b-6e54-4e26-ba50-cdddaaa3d200", "comment": "Malware payload", "value": "cb0d819e976cd3cae8c6d18c306b90d7dad904d355b46ad803d68ec8e2533e1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665566, "uuid": "e2326493-13df-4d9d-81fa-64dae4d2c102", "comment": "Malware payload", "value": "2a3a50f3e6dad505e889299430e4f25ea5459f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765665566, "uuid": "e42be31d-0d4a-47f6-bcdb-089c347a61be", "comment": "Malware payload", "value": "b720a011269fafdcaa48194715843283b068dda019431b245aaeaccc3bc76805e4933b26150a0c48b885a92046f862b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665566, "uuid": "8cdbce8f-bc86-4cc3-be84-6f367c424e77", "value": "T1E9730849FC819F15D4E422BEFA2E018D33676768E3EE7212DD111B15778A92F0E77A02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665566, "uuid": "9b3df98d-b741-41ce-be38-23307c6ad15a", "value": "1536:99nw2wDv2iFmsJ5nClC1q86nP7ShcCCdlSbin/4nPYn:1w72SWC1q86nP7ShbO/4PYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765665566, "uuid": "1e89ac6c-cb3a-48a9-aefa-2f84d21968fa", "value": 74368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765665566, "uuid": "3cd85513-24c0-4188-a661-ffee162226e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765665566, "uuid": "da72ede4-2ca2-442d-9caf-7e36daaa8862", "value": "zerarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8ef2b6-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765608185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608185, "uuid": "894b2033-2847-4948-8d70-42d216cbb757", "comment": "Malware payload", "value": "a79bbaf0c6b771cf85c658b8978841de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608185, "uuid": "6d5ea26a-8e7f-44b1-90c6-d0d646a4af23", "comment": "Malware payload", "value": "cb130c0cafba8060a7d6b944ce670cef9f4a9fa3a7d8a3955a2a9d91f3c1ec47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608185, "uuid": "a6a9dc58-5b87-4d9b-9b33-f525972a54be", "comment": "Malware payload", "value": "5f983a1ce9d0e48ed24d58581c43908bc2e5a140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608185, "uuid": "644f21fe-16ef-4798-86e9-8ebe0d9b8929", "comment": "Malware payload", "value": "1f7ea8d96d925434fa653d2f99b0187c5cdeb5e8d51598859945640b5de92d402f162fadb7089a14f4479ded8ce72cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Xiamen-Aoyuhui-Ao-IoT", "colour": "#4FFE97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608185, "uuid": "278580f6-a973-474f-9c56-a518825441f3", "value": "T184953382FB944A73ED742B31DDCEA52EA399F9304952855B230CC2510B3879963F92DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608185, "uuid": "bcf33cb0-72ba-4e28-a753-b9c155e6f6cd", "value": "6c739e1019d9cb00da3aeb8989ca6433", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608185, "uuid": "0eddc1e4-4843-49b0-a51f-16d6e431d8d8", "value": "49152:HngjTpT6k+/xBD/8huYEyI7BrUYtuVg/s0ZmI1aCqz93DT:Hg5TdSBr8hnOCQGMzoPz93X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765608185, "uuid": "010fa648-85dd-4185-b5b0-4389bbc993f2", "value": 2001520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765608185, "uuid": "0529ef6c-24fc-4e80-8858-4333799a957e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608185, "uuid": "06ea3ee7-2677-4bb3-b500-fdd042c8e83e", "value": "cb130c0cafba8060a7d6b944ce670cef9f4a9fa3a7d8a3955a2a9d91f3c1ec47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a84447-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607912, "uuid": "54fe38cd-a880-4cf2-95b5-7c560b28b10e", "comment": "Malware payload", "value": "1f92c12dacb556737955ef2190292502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607912, "uuid": "f25acd90-f091-4585-b6ca-5e32bc941889", "comment": "Malware payload", "value": "cc0e43ca637415f824f8c55ea0694a862c1f58ed60e899650423cf6273cbdd88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607912, "uuid": "9065b97c-4549-484a-b4d3-2fd93506b57f", "comment": "Malware payload", "value": "ec629afc50d93432deb206ccebf25a3cb37ecdad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607912, "uuid": "83c6460c-d98e-4f88-97b5-9beed2cd1744", "comment": "Malware payload", "value": "b486c4bbbaa86a5b9e7639906701ff121dc9555e65355e50248f69c31c031c4336eb1d0d008c6229abe41d857ffab502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607912, "uuid": "b8733fe7-95a5-487f-ad5d-0ab57b328735", "value": "T1C357337491579C25EDB6CF38373A82B2549E0F4F729B09048B287EA95CCC9A3F52395C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607912, "uuid": "d375a315-82d0-4f15-b8ce-222e209e9079", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607912, "uuid": "51efec4e-8a03-4f5d-9e42-fd4dd0a90d1b", "value": "786432:wxNmPpBBMiQKw8ywBBtCjmCBkj38qWVRjDL:DrWLwywBBXCSbTWHjDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607912, "uuid": "84ae6925-a484-4998-9ea1-645f09dc2331", "value": 29239112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607912, "uuid": "6aa7d789-ab08-4ee2-a1c6-3dffa71526a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607912, "uuid": "48487547-d8b6-44eb-b37b-d6515d39dead", "value": "cc0e43ca637415f824f8c55ea0694a862c1f58ed60e899650423cf6273cbdd88(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591366d8-d7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765612209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612209, "uuid": "23c7685d-62d8-4c60-962d-ea9d792eb41f", "comment": "Malware payload", "value": "b52c0f9768c521b9c9e5929d69acba1b", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612209, "uuid": "26d9f9d3-7029-43b2-9131-116b40a3f2d3", "comment": "Malware payload", "value": "cca9c2b799e7b70ed2031ce32d7b27addf5cc7d6fb187f2c297487c15245dd65", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612209, "uuid": "b02f79ab-3c16-4023-a7f0-feae3d279f20", "comment": "Malware payload", "value": "37482e878b52df92747b8868ef177f92994709bc", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612209, "uuid": "c4779ffe-6339-47dd-9179-715b7a4656ea", "comment": "Malware payload", "value": "a0338c6cf6623c40b875d59658a1968eb3475ba8a91bab7ddf68a8b6b8a91f64963a0eda6ea416e91a1fd97c908606cc", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612209, "uuid": "342080a7-385e-4a4b-b4ce-29f0b308f8c6", "value": "T132A1279EF5B173730DACDD16F2168A2AF042828602225F6976E970F8BDFBD499D40315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612209, "uuid": "c091b182-6a2c-4f4f-9d42-2cc462d7338e", "value": "96:UIuUdbUeo0eweaGe4eecemeI8FUNFNNFOF0FeFtF09ioIi8iaKiUiegiqiIToSuL:UWfKnaV/s1I8FWFDFOF0FeFtF09iji8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612209, "uuid": "046ae615-dc7c-4087-bd7d-8dc9e162494c", "value": 5068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612209, "uuid": "164ac9ef-e749-4888-a940-708a812521b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612209, "uuid": "984cace7-9b80-4152-8e3d-b0cd5013e03a", "value": "create.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e21568-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605228, "uuid": "18f18d3c-3622-4ddd-a53b-a48e9680774c", "comment": "Malware payload", "value": "72ebcf8ee688e58434c5b64ec30a5d45", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605228, "uuid": "bd352906-d3ec-4c5c-88df-e32a097d3389", "comment": "Malware payload", "value": "cd2e0c4f23040178d072c7d9b0135d433dcac6e55dc2b596c4a2ca88d8201546", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605228, "uuid": "63725f82-6388-4ec2-96c6-5c4f0a885fa1", "comment": "Malware payload", "value": "2514a3a5c8a8baa1db56bd237b906ca1ef59b968", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605228, "uuid": "1548ffee-0852-4743-9b8d-acd3468503e1", "comment": "Malware payload", "value": "1009d2b4f850aa621d53c1cb407776a2b8fc0cda921357bce2b3721bbb85c6e26b6a9fb38a58b759844a3fc59236eae6", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605228, "uuid": "7b1d56f5-9c1d-490c-ac74-48c716dda8c2", "value": "T13C843B63E3682404C3B842B5CA295358B935FB9C577003BB3B90A2FAAEF53545D1BF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605228, "uuid": "7eb03d6f-7696-4af9-be9a-4814c4076eec", "value": "3072:4FCm7qEq970hNXz9H5/AZtBSeo4fkyiGh3VUyW3uRfaRNYf66xUWxp/GJPbPjgeP:RS6o9XGh3VBbBl+PHdyiu/je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605228, "uuid": "7a437998-cf88-4357-8472-e34f195f0c97", "value": 389984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605228, "uuid": "ffd0df82-6aab-43ec-b4a8-3136e0a31bc6", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605228, "uuid": "4f778cf2-e5af-46af-865e-0fd33184378b", "value": "cd2e0c4f23040178d072c7d9b0135d433dcac6e55dc2b596c4a2ca88d8201546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ab393c-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615633, "uuid": "26d838fd-ed96-4ef7-88e0-fd82791d933c", "comment": "Malware payload (Rhadamanthys)", "value": "42a2ec9c487cb1025279ae83083ec2fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615633, "uuid": "33b1dcb0-f3fa-4df1-b5ae-1c528eb8fe0f", "comment": "Malware payload (Rhadamanthys)", "value": "cda009c2455259c5fcbe4ed744546e82db2b26553799f56f1aa89b0b44eb68cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615633, "uuid": "3367e167-fd67-47d7-a929-1b25da7a9ac1", "comment": "Malware payload (Rhadamanthys)", "value": "7f8f9f4e2ab3dad066b1d3dbf7bf46016158c951", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615633, "uuid": "ebd36f75-3325-4da5-a15e-e62e21af049d", "comment": "Malware payload (Rhadamanthys)", "value": "87b971d6d70e7decf6201c72b2b86f69976152f1d96d5a7edb770a97550b168db848ac79b68f19cb6b1c33bc6a871bcc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615633, "uuid": "9048ca1b-e3f3-47b6-b162-ade4cc84b84b", "value": "T1A2A3FAC89D96FCC51582FEF2DB8B475C4F6B95A29D09F941112AF33053AAE1C28864CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615633, "uuid": "1229fe9a-2b84-4dad-8e82-22078ab260d7", "value": "1536:GDB7eKg20CajurHrUIo68f6IFuAACZ2Qf6BkQWJ+aY:GDB7b0Caj0LzoDf6IFSCZ2Qf6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615633, "uuid": "257752d0-e3eb-4f14-8cde-a2ebce92f263", "value": 100677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615633, "uuid": "332c859c-a81e-46ea-aec0-cab2c35d2338", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615633, "uuid": "b0346ccb-201d-4e16-acd1-aa64ef06e1a8", "value": "invoice-1637482117.pdf (74).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082d4e51-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639132, "uuid": "72809cfb-b77d-443f-badf-cc27b2a9b015", "comment": "Malware payload (Mirai)", "value": "fbb640f486c146a67e8aea21c3859b0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639132, "uuid": "066d7a6d-83bd-4d8c-946e-1f4898ce4ca8", "comment": "Malware payload (Mirai)", "value": "cdda566a0c8f28248e56c5f14a429d479ff502705025a1ba6248a51e8b945e78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639132, "uuid": "f38fb81c-69ae-41c5-837a-c3b7585e38c6", "comment": "Malware payload (Mirai)", "value": "004069b96db51d1abe04503ea0a5065dd978bbb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639132, "uuid": "68e7d7ce-fade-4dd3-9b70-e24b9c954499", "comment": "Malware payload (Mirai)", "value": "8cb6974d7443645c8af66b36a7d909c8ced03b61e0f888f16754222da2b82023646a79e685b439b2c1b22ae0311e863c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639132, "uuid": "f2ac1a18-f41b-4769-9da1-4ce0c17dc282", "value": "T166E34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2577C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639132, "uuid": "3c3c0e34-b06c-4188-845e-f4d54e8e2b88", "value": "3072:CotWnBLigk1Tc3DCC0DvZe1k6aU6zL6EiueCo2k6:VWnligqTczCCqeS6axIueck6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639132, "uuid": "f4e7b362-0faf-4362-9563-ade9a7beb398", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639132, "uuid": "99102d75-77a8-4f30-b448-eb194b64414d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639132, "uuid": "c0ea2fd3-44c5-4be9-a9b6-5aa1dc56caaf", "value": "frost.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c156af64-d7f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765611095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611095, "uuid": "77e66b0c-2b7c-4fa3-b6e8-be298cfe54f4", "comment": "Malware payload", "value": "b82746678795f1f0fcb0aa55cb52e163", "object_relation": "md5", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611095, "uuid": "d914fe29-46ca-44bb-a3d7-391b7dc46a07", "comment": "Malware payload", "value": "cea575fbae4a14418896cec1e8f3541e263413f40fedcf585cc3b3af9e13abd7", "object_relation": "sha256", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611095, "uuid": "f91854e7-db4d-4098-b468-3107a4e3b5a2", "comment": "Malware payload", "value": "4726e1e1085a1f60a28024f7d6cd434c99d17257", "object_relation": "sha1", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611095, "uuid": "a042d30a-f067-4c1c-aa2e-5fe0b89791fb", "comment": "Malware payload", "value": "c6f23395314b4ddf8c5b28d0e561b5f9f6312eaf6a9982036c684acfa1fe76d8dae0a07ef102d80f2836a9004b99ee3f", "object_relation": "sha3-384", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611095, "uuid": "5a58b03f-58e8-4272-b010-8d665439ff64", "value": "T120C08087459951795947C3D61065DF55C50C5545D2A5604313728091D4951CDC14C2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611095, "uuid": "63cf6eef-faa8-4811-9862-b75396edc76e", "value": "3:TXT2rGjCMeasGSHCMeasGSeASZJWOenn1hROrSLkueDXBiGRNQrhXXQ9i+2O922f:P2ijPeanSHPeanSKZJbGuGLkue97NQrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765611095, "uuid": "a0d68b9f-05ef-4660-a294-737075b979e9", "value": 167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765611095, "uuid": "6106990b-3797-453d-ab33-6ecd257e96cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611095, "uuid": "50182d99-7ea0-47ab-89ed-0d2c6875444a", "value": "cea575fbae4a14418896cec1e8f3541e263413f40fedcf585cc3b3af9e13abd7.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4709aacc-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605307, "uuid": "6b8ed774-e529-472b-8675-efe4c564862e", "comment": "Malware payload", "value": "5748b104642012472158ea940750a1a7", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605307, "uuid": "8d1abde2-7082-4444-9571-c7ffcecc7f36", "comment": "Malware payload", "value": "cf37a786dd68d0c8100c05b4c3c38481d463fadeadd0a40bf47b4e198c088e9c", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605307, "uuid": "f1f3a70a-a0b8-4667-b4f8-9f2c7a8c880f", "comment": "Malware payload", "value": "d8b5d21b59afe72ad4aaba86b1ace469ae4ab55c", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605307, "uuid": "c0535586-58d6-4496-94e9-c7229cffb556", "comment": "Malware payload", "value": "52ed091b265c261b1f7dcc8a3218bac230ec4c42b05c6400cbaaaa835bb9b5f66f5c45c36beed35f1c4d158ad6f57b67", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605307, "uuid": "52bead64-39b1-4249-b5c1-980005e6e85a", "value": "T1A6942A63E3982804CBB886F58B599358BA35FB5C1370437B7B5062E6ADF63540E1BF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605307, "uuid": "56584746-5d72-4ad4-b94c-5276002740ee", "value": "6144:z4QZVhf5x8vGrq0x5XTQOJrnVpUtGixECiusL:c+hf5x8er39TQwTOGixECiusL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605307, "uuid": "9a259b29-5c2d-4efb-a5a8-0d15c5dbf1bf", "value": 447280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605307, "uuid": "289de66d-2bb6-4e12-aa9e-cca14a5f0e86", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605307, "uuid": "6b301cf5-8ae5-4c75-81be-03c8a84be96e", "value": "cf37a786dd68d0c8100c05b4c3c38481d463fadeadd0a40bf47b4e198c088e9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f406a3-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615715, "uuid": "7595e39e-2327-48ed-bc1e-09c9ec52ca06", "comment": "Malware payload (Rhadamanthys)", "value": "f797e5ff3dfa0465e34b0962b7175a28", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615715, "uuid": "a600c26d-d855-486a-b409-ba04e30318dc", "comment": "Malware payload (Rhadamanthys)", "value": "cf7a568e685f40853c73e73e08b7f23f5132e75b27e9a7984bdf65204f60451b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615715, "uuid": "bb01c6d0-caca-44d3-a6ff-9c73ac2fa652", "comment": "Malware payload (Rhadamanthys)", "value": "c0f08ee78b477161f1c10721aebb8dba009a7742", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615715, "uuid": "522a4950-81fe-4dc7-bc06-456f3974e6af", "comment": "Malware payload (Rhadamanthys)", "value": "641d5fc5d344ef620e53b1d7a2c3763c04027f2fcfac343b47d6d92fc5b6c9495b986b2eabb3b976b184a1c2c9d88471", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615715, "uuid": "e489ee6d-0d39-48b4-9bc7-4e204f805a99", "value": "T1CEA3B8104E912BF8172AF6A85E6D7220DC28FE7E04496CD421477AF3919CE1BBED85C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615715, "uuid": "4f0409c1-499e-4a49-81a8-37016d14b256", "value": "3072:GDB7b0Hd4n+G+VluRg/Z2RkX8QiGsl90v0vKlKKukEvBU4Dd5Rtv/KkQKd8+FMGz:0Gd4n+G+VluRg/Z2RkX8QiGsl90v0vKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615715, "uuid": "f8fcec3b-81cc-4742-9d79-cadfe7a0234f", "value": 103427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615715, "uuid": "6292ad39-2ea2-4dca-a1b3-e2670246950b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615715, "uuid": "49d4a1df-5398-4523-ac21-710c0a432553", "value": "invoice-1637482117.pdf (53).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4259bcbb-d86f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765663281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663281, "uuid": "d282dc25-a843-4396-8cc6-3e94875ed3a7", "comment": "Malware payload (Mirai)", "value": "fa9d7a6a02261626d0c72c787e725782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663281, "uuid": "86bfd7ab-e7be-4302-a00c-829b74a210f0", "comment": "Malware payload (Mirai)", "value": "d04a4cbb6a8d9e3c45fde324ffdb73b0adb3e1f0328bcce8ee985e2da89f8c7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663281, "uuid": "285a9987-d79a-49bd-9006-6bbe172492c5", "comment": "Malware payload (Mirai)", "value": "8c19a072bd37103e1d06a59562229584b7dc9c49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765663281, "uuid": "9a59d515-7fd4-4ea7-96ba-07b8ede52601", "comment": "Malware payload (Mirai)", "value": "618d89c4af07ca8537cf7fbe1edd1a5cff3b4a68cda5db1834bde4b8a141a45eaf90741022a24b41c6f2845cad747db5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663281, "uuid": "29231281-a551-4878-b57d-88e2a1144e3e", "value": "T17D042946ED418F11D4D622FAFAAF014933536BB9E3FA7102DD205F6023C699F0BB6652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663281, "uuid": "fe2af8f5-285c-4a09-b770-0ec48e28d0f5", "value": "3072:7wz3SondZX1v/hssiv2e9Sa1j/wmSyBujopq6A1fj6hh1YG2PH:7wbR3X1v+si+MSa1j/wmSwTp/A1f1G2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765663281, "uuid": "e616c3dc-5992-4a7d-9f8e-3035c724902e", "value": 186760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765663281, "uuid": "5a790346-33d1-4af0-a6ee-1a3a7e6e6578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765663281, "uuid": "75bf9242-3dc8-4a08-b4d1-e9331011a28b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97bd4c0-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615780, "uuid": "222cd168-8b40-45c4-b92c-f6cc3d6c1185", "comment": "Malware payload (Rhadamanthys)", "value": "ca7252006d595bfb5ccdca2538e5fda5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615780, "uuid": "9461c2fd-576b-4355-9536-0fa37f04fa8b", "comment": "Malware payload (Rhadamanthys)", "value": "d145716c065f3e389c0fd1f43b2aed4cfbc2684b98a7fcc99053665ebe200664", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615780, "uuid": "93781288-d07e-4d95-89f3-4ea2533006d5", "comment": "Malware payload (Rhadamanthys)", "value": "c37807b3cc6909655dcdef0ae8f05aab47fba05c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615780, "uuid": "5ba40f47-497c-4c66-bd22-5c6dd0804353", "comment": "Malware payload (Rhadamanthys)", "value": "53e40c9b9f81bcd042c0cd584947a2ce82465e9770114fadafa8f133e42c1c224e7b54fc6b50e0f585fdada723d9ce92", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615780, "uuid": "3321af29-a87d-484c-aed6-46a9a91debc0", "value": "T1D3A32C28AEEFBC7713F3217FDA5441EA2D2295B14BD0AA60D929BF1152F470D34D6283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615780, "uuid": "094ca965-452f-43c2-9468-6174d2678fed", "value": "768:GDhd0i7J4sYKgY/CMNfWd3rrX29rD4V3H18AZ261cusSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20brgrD4Vl8AZvi6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615780, "uuid": "19694ff3-7455-416a-b99a-329953de019b", "value": 100040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615780, "uuid": "3aa5fae9-963d-4fbe-89d7-08a3ca77a770", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615780, "uuid": "4da10873-8ae6-4dd2-92bc-b5115ab9434f", "value": "invoice-1637482117.pdf (40).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e43f5de-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667999, "uuid": "79d27123-4a66-4fb9-9159-e0a09f8ff7f4", "comment": "Malware payload (Mirai)", "value": "9dd5214c180843d4b58e48d2a198b174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667999, "uuid": "07399f32-601a-44e2-8ea7-85229dbe7241", "comment": "Malware payload (Mirai)", "value": "d14872efdf280f1a51f11262d28f952248b18684f562994859743194cce786e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667999, "uuid": "ae321c95-8454-4333-9ead-e0215009f1f6", "comment": "Malware payload (Mirai)", "value": "f487465b13a899827ac8070518eda0405001a87d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667999, "uuid": "fc574984-224c-4ad7-bbf6-768f546d5e2b", "comment": "Malware payload (Mirai)", "value": "7e09fffd2645d98210d059d21e3fb48678d320ec9b46fcde0c7b98306e3738690a0c5fcc1c6784b1e5e13caf5d784d90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667999, "uuid": "f6b94b0e-7245-4293-8243-7717721a6dd4", "value": "T14913F15786E7AF0EC5FA85320C5A7E0B1140C631A60DC7F6EEE16AB28764B251F152F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667999, "uuid": "6a2d8a23-bca2-43c1-91aa-2b8e92e5af20", "value": "768:CfIbTTod95I2WQGGxJNo7QdLRdZFM5ZKxpethOTTO/cB1GXpnbcuyD7UHQRjO:CfIXTod/I23PNz/TdpezQCUBwnouy8H5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667999, "uuid": "23f7527c-a49b-4fdc-8566-21107987df53", "value": 43612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667999, "uuid": "1b00027f-b64d-4ac2-be1b-7d425ee49f28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667999, "uuid": "dc9af965-0f68-4e6f-a2c8-3e7f5017d9b1", "value": "x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "900b4218-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666418, "uuid": "3da6eab3-ec93-439f-8b2b-955d13447b32", "comment": "Malware payload (Mirai)", "value": "aebb784a2aba92c5f629a66ae161ef51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666418, "uuid": "8d2f6841-9841-4351-a46b-513704bf548f", "comment": "Malware payload (Mirai)", "value": "d2337990980330f40885ec8e37c77352f05aad2fe362f9f5ccdc9920eb8c5f04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666418, "uuid": "3d4a966b-3829-453d-94d3-6593d921ac01", "comment": "Malware payload (Mirai)", "value": "87395360c1a3fa88bee5bc2bf39944e967a428e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666418, "uuid": "321f4a9d-2f76-42f2-8a73-9049f7081e12", "comment": "Malware payload (Mirai)", "value": "ef05c661102b09e972934f712a3ad31be6fe64b25f9be0916778791df80458d45f02b0f9b8f964fbf52c55b8b8fa5bc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666418, "uuid": "764a2e00-d85f-4805-9116-fd65830f16af", "value": "T17583F84AF9419F55D5D565FEFF0E528C33534BACE3EE72029E14AB25278A82B0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666418, "uuid": "57af76d8-d8ca-4c20-9a3e-53b8e64727de", "value": "1536:egnydsqtjI6RZPCxMS4jmB4iUHPiHlO610ae0qmllYwiDsiv7sJyZ2Yma8nv8VRz:Ydlt2MbjFj0lO610aeN1sI7ssg28nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666418, "uuid": "b06e0874-938c-43d0-ba38-501fe7e66ab5", "value": 81480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666418, "uuid": "64c77abd-b92f-462b-8919-e4e1365b895b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666418, "uuid": "95b20ef3-a285-4628-81c6-2d2f4450818c", "value": "nabarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5483eebe-d7cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765593303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593303, "uuid": "8b1a0cdb-9d0c-4377-9872-e942df27dcdf", "comment": "Malware payload (Gafgyt)", "value": "5ce2507ce29fdf1a7cb07ff8226b0e7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593303, "uuid": "69162601-e67c-4591-a7c1-259a543a45ef", "comment": "Malware payload (Gafgyt)", "value": "d2670dd44eb6690c5f51e500da348566473f84665992d899c816fb66834a9081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593303, "uuid": "4894a10e-4ad6-40c2-9a22-ca31527b6002", "comment": "Malware payload (Gafgyt)", "value": "663edafe37aee31ae4f57981078b50643d301d97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593303, "uuid": "677cf345-9ee0-433c-95cb-a3f3089a14a3", "comment": "Malware payload (Gafgyt)", "value": "5b95a4152c1ee3d82e0a0a712f0d50fa4100c53941fe85fbba8b5646114dcc23109c9e1d679b34c2c18e6fab74da1a55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593303, "uuid": "0799f301-756c-44dc-a8fa-57beb06b8e37", "value": "T1B6D30905D4508B23C2D2677AFF9E474F37225BA89B9B332256296EB02FC179D2E3D510", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593303, "uuid": "ed0ec7ad-0c23-49a8-a878-607b239315dd", "value": "3072:A5upxw7bIfTzhm32x8E9laJE2thjq3BHoFdGP5hMH2Z0DXfgwjWkmyhQaS+pg7J:ACeE9laJE2PNGP5hMH2VwqkmyhQaSGgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765593303, "uuid": "d614bdbd-d2c9-469d-92a6-a738791f0b0d", "value": 138878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765593303, "uuid": "e3cbc13b-100a-484e-8124-5a00e08e459f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593303, "uuid": "dcf985c2-395a-4cda-a6be-8d17c259ed9e", "value": "ionetworks.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d61f2e-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615559, "uuid": "7c17077f-f01d-4b94-82ba-fafe2ebfa4ca", "comment": "Malware payload (Rhadamanthys)", "value": "46fdcda4d68692b2e2797110f9a42a5a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615559, "uuid": "6071a135-8c85-411b-af7b-b9774643d571", "comment": "Malware payload (Rhadamanthys)", "value": "d32e87fb3a1d1468145553c0e9ccfede20f1a146d83510ff67c1c468cea6be81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615559, "uuid": "22e88d70-deb1-44d3-9872-0567ce39b77c", "comment": "Malware payload (Rhadamanthys)", "value": "1455d78445a7299134d78f246d7b816452e9a3c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615559, "uuid": "d0895ad4-d955-40f6-ad2c-f6eea6d6092f", "comment": "Malware payload (Rhadamanthys)", "value": "cdb8dfec2a4dac9162d75301e7af48cc0c4659a73d611161d7dda8a75703dd08c45a3f253870044b98652391fbc35b3a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615559, "uuid": "474e1124-63e5-48b7-899c-a95061584f4e", "value": "T136A3F89A4E69780A52135B6A6EA114F4AF1D6C1D08EEF4C69F9DF735C98270608333CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615559, "uuid": "11317ef4-72cb-48c2-9b83-ff971e0dda9c", "value": "1536:GDB7eKg20v7gb1he6ucCQToYTZfSsCJdU7LtltoodiUdppYrY0FGoX6rqNdezrvS:GDB7b0mCOJZu7nIktM0pyOU6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615559, "uuid": "1043b5f7-c644-49b5-b9aa-94be00cbfa02", "value": 101881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615559, "uuid": "06afeb1a-7d8d-4df1-87c2-586e2ffc5a86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615559, "uuid": "7b9110b0-e10d-45bd-aa1a-995f433cc315", "value": "invoice-1637482117.pdf (89).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32392c20-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765606990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606990, "uuid": "10c61545-6d4e-4a38-9381-d7a903ea097b", "comment": "Malware payload (AsyncRAT)", "value": "cf81a51bd6f49cdbed622a922b7c33dd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606990, "uuid": "2231e1f2-a4c0-4650-81ad-380218ad4bb9", "comment": "Malware payload (AsyncRAT)", "value": "d3c04371fa3aceeaf08182349f912d1a0265fbed122388391ac4b836fac88cdd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606990, "uuid": "13bf32d5-46a5-43b9-abf8-e02a4856f717", "comment": "Malware payload (AsyncRAT)", "value": "a25509536813a9b4acae984678ebc80b53500aaf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606990, "uuid": "f087a178-9794-469f-ba8c-d8b4791229e5", "comment": "Malware payload (AsyncRAT)", "value": "6730e314738347df6507693d45334da727da9eb6f844930105b89ed8421204dc4cec5301e017ecc1cf367fa9c2590036", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606990, "uuid": "d4ca12ae-d796-48f6-83e9-2b3cfdd80529", "value": "T10FD33C0427C4C7B3EDD966BF9F53C203016F9BA613B18E096C80258E366AD8765D399F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606990, "uuid": "6a92826d-134f-471d-b253-c698d3228526", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606990, "uuid": "27454003-b9a1-444f-9b92-0d378de3dac4", "value": "1536:Mv1sHI9MEDyL11GbbhXgFAOG/pLzioVclN:MGHarDiLGbbhKAdleyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765606990, "uuid": "55d6f092-3cd3-428c-b252-937326e27c59", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765606990, "uuid": "ccaa9918-96d0-486f-a106-acd479254de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606990, "uuid": "67d585e9-e759-4fbd-86b5-352842fae21d", "value": "login_mail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85778074-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765605412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605412, "uuid": "476b9c8c-a747-4bc2-a1db-8aa6cd138b52", "comment": "Malware payload (Mirai)", "value": "eee8d53e2bbea13f9c9c6fee3d897ecd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605412, "uuid": "13012c4d-2ca8-47bd-ba84-a83e2ac672c9", "comment": "Malware payload (Mirai)", "value": "d3ce82e7878626a7348a5d00e26e566053d4a2db8160a09eaec0a7010ed670d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605412, "uuid": "bb03c548-db57-4403-9fbb-7225430b9ffa", "comment": "Malware payload (Mirai)", "value": "baa7d80c817276d007893451629e94a02b6539d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605412, "uuid": "efbbbd13-2311-4874-bf0d-9732d84685b1", "comment": "Malware payload (Mirai)", "value": "5b72f00c1d6e0e3b1974dddc38adb0b9a3a6a10eebf1b08475f679b5103d6d9132a9120289130beaede02da2f0a1a5d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605412, "uuid": "9ec80579-1b32-4448-868f-1a0e702114ca", "value": "T1BDC35CD2F203D4F4DD1A01702177FB379A72F0B5113BDD93E7A8DA32AC92A9185162AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605412, "uuid": "c8fad92d-fbdf-454f-9a47-1aa6a5d8fc5f", "value": "3072:VC5dNKj0LM/YlNVhDrWVyoq92wUkuHm/+ngk+z2FR5GxD4fsENU2bRZ:M5dUj0Q/YlNVBriyoq92wfSge7GxSNUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605412, "uuid": "5cf39f67-e168-4f46-94f9-f67b85a326c9", "value": 128304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605412, "uuid": "d1d6570d-af97-4876-ab91-a3731a538c94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605412, "uuid": "ab8090e5-1fed-4165-87f1-86a152704fd9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61406489-d808-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765619095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619095, "uuid": "ef9709cd-89b8-4ff7-9ba7-fe0488275d1c", "comment": "Malware payload", "value": "14e14dbce85d5fd8dd2f89f64cea7ccd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619095, "uuid": "afb919f6-63f7-48e8-867f-a3526799c675", "comment": "Malware payload", "value": "d4957f0660e46c1ed4f059dd097b93c21ebc8e9a47199fd1cd8ef3963356af04", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619095, "uuid": "19c19898-d0ee-4360-a006-131502744045", "comment": "Malware payload", "value": "a9d298a915dcfbadbb864051842e991ec8c8f801", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619095, "uuid": "487934b8-6e7a-45f7-a734-b6043c4057bb", "comment": "Malware payload", "value": "b2b6afce3da5ccccaeaf39f76c477584c56391a20847e09de13f87189d0071066e2839d1662d93614c62a764af92fe35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619095, "uuid": "169161f4-ef7c-4e26-9424-fd8425d120fe", "value": "T1C85199E5B83167713288DD3CB11598946AEBD9B9B078270579E16C62C0EC9193219F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619095, "uuid": "744616a0-6a4e-44c7-a38e-50a211b135d6", "value": "48:ZYjfc2laX0XiV6Wqe2P0IU5qixeMAP7ITC/M:Q3lW0SV6WB20IUXxTAP7ITC/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765619095, "uuid": "1631a3ec-753d-48c0-8cd3-47efee699251", "value": 2542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765619095, "uuid": "12daa064-da90-49b2-9ee5-0e57fbc8977f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619095, "uuid": "a9eb6881-9389-4459-ad2a-3092df4d78f6", "value": "massload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358d0151-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667125, "uuid": "cf186566-4ec6-484c-a52d-30169492e894", "comment": "Malware payload (Mirai)", "value": "16db901e15bd0b78b7240078477fa42d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667125, "uuid": "9801ae7b-7ed8-43a8-8785-e8e9927dfd66", "comment": "Malware payload (Mirai)", "value": "d58acea96a43aced3c3f6946c7d659bc6dd0c1ff50bfee3619a40d7463333d9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667125, "uuid": "8dad0014-28a3-440d-8def-f8598b92135d", "comment": "Malware payload (Mirai)", "value": "4541d0606236174a08b9ab0e98062bf6b879d89b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667125, "uuid": "74d1f59e-40ee-448d-a0ac-ffdd9a5bbeb6", "comment": "Malware payload (Mirai)", "value": "7aa081a104574041a8807154f7c3cd5b4bee5d7b87d752e046a17168d321000fb6ecdd69dbba53ad440a4c7b3e423155", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667125, "uuid": "9da2892c-278e-4d92-848c-072b2d5427b4", "value": "T1E9D39C8BF78B04A1C8A305F007CB0B9E2E6321925F5BD5E37D69A63B5E764DB0901BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667125, "uuid": "69343fdc-6780-4de8-a483-4edc8b0342a4", "value": "1536:guLwVLUCNs7/ensXyfNphOq96bFY4cBl2FXNFDxet1gM5P+/LWvc:ELHebesXyfNphd4RY4kQNFOgMx+qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667125, "uuid": "21d46ed2-6044-4fb7-8da3-e774888a417b", "value": 132688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667125, "uuid": "dbac69a1-175b-446f-86c1-b07cc3ed8d26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667125, "uuid": "9fcab355-20d1-4694-a80e-7bbe8a0b8743", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28a5cfc-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615795, "uuid": "79aa6422-032c-4da9-9ba7-d7421061d183", "comment": "Malware payload (Rhadamanthys)", "value": "5c6cd4178187b994b8e78b911863e7c5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615795, "uuid": "63adbffe-c3c9-49ce-a8e4-ef81c6be1ce3", "comment": "Malware payload (Rhadamanthys)", "value": "d61a65c793bf0ed0a62cbe8dff361345096fd7192192dbad1a848f335882cf8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615795, "uuid": "50ad3e73-608b-4dc8-b7cc-a208f858d72d", "comment": "Malware payload (Rhadamanthys)", "value": "79d10c200814cb78f7ec3f2b478651ae3fd4cb68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615795, "uuid": "c6d6f452-aa4e-44c6-8de7-fa2e9905a5e1", "comment": "Malware payload (Rhadamanthys)", "value": "d753f47e750b0d7553ca09a2e807dc645e3a973c33346b9a0c3504abeced3fd80364bd7449258140602d8863043710bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615795, "uuid": "140fcd33-c8a4-489e-b5fc-244f2f8dfc83", "value": "T168A3F7F07E17ADF82A1157DB2ECA54F0CC0D2C856C15124585AB7FDA35C6B890E2A8FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615795, "uuid": "ef03ad3b-8374-4324-8836-f825f15b97c8", "value": "768:GDhd0i7J4sYKgY/CMNfWdwGOrXqirCQD/HaFLLA61iJISLAuAAroQW+FF+Ec+0FY:GDB7eKg20OrDrCQDC1A6Qi6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615795, "uuid": "fe121940-3da9-46ac-b8ea-9baa2a89e266", "value": 100082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615795, "uuid": "ed0dfdbc-1613-4292-98c0-c1251dfedf86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615795, "uuid": "5cf9bf9c-7afa-4be9-8899-149f830ebca0", "value": "invoice-1637482117.pdf (38).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed42e8e8-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615894, "uuid": "8a024a0c-4873-4785-8981-b59dfc7310f2", "comment": "Malware payload (Rhadamanthys)", "value": "1f750cd08bf5a3ddc6424735371b80c3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615894, "uuid": "b3ddcd6b-4194-4b90-885e-bd7006c38b92", "comment": "Malware payload (Rhadamanthys)", "value": "d729c76c7cb30436ab3c0b614aca696cae6fd22312404b17dc0d0a6fab43dabc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615894, "uuid": "aac204a8-5e04-477a-8e48-7833cc7b8b3b", "comment": "Malware payload (Rhadamanthys)", "value": "21c5492a6569b8c0b198d9a8fa0edb46ce398b0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615894, "uuid": "3f51ac78-adc3-435a-b3fd-704b03e9e36b", "comment": "Malware payload (Rhadamanthys)", "value": "53963c219acea2a78cb38c65afd50414d83b6a6d2696ecde60e49ff380c3cd880af61e664dcdb449a727872d4c1c0f77", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615894, "uuid": "44c9e36a-3e91-4ea8-9c9e-1788831fe63e", "value": "T1F8A31ACCDEA76CBA0863B1A7BD79BBE49546C83D07D58484900A332E4D14F46ABC15FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615894, "uuid": "392f4270-85d5-4bdf-aaa3-c1b17e1200c2", "value": "768:GDhd0i7J4sYKgY/CMNfWd8EJE+E5EoE5ExEvEJBESE8EJ7EtIEHEXEPEYElEEErv:GDB7eKg20JrWrdhnlhA8f+6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615894, "uuid": "762c61ef-f951-4603-b374-fff9ebb70d4f", "value": 103236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615894, "uuid": "4985e353-46c2-4408-a817-d86f8565ffca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615894, "uuid": "d84b5ad6-4c5c-46d0-bfc1-642e836f9d89", "value": "invoice-1637482117.pdf (14).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90a8d44-d878-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667319, "uuid": "582c7361-5272-4b0d-af49-b80d77660173", "comment": "Malware payload (Mirai)", "value": "74d02771c4ca2040eaddcbc032327d1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667319, "uuid": "5d0253eb-f4aa-4501-866f-ecf92fcb9db6", "comment": "Malware payload (Mirai)", "value": "d73faa44735ee6e6a9902e3e667807b0c5ee1303c55d2a852dc10535c14dea05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667319, "uuid": "3dda980f-397a-49f2-adae-4e0c40dc95c5", "comment": "Malware payload (Mirai)", "value": "ec0e0e84e87725d6d2541e07e8e41e4c298d9c28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667319, "uuid": "00d10997-bd78-48fc-b0b8-3920eed16540", "comment": "Malware payload (Mirai)", "value": "81a901128d885ccbc414a9f1ff4ea9867fc00b8162f583ccc0b9b9b614d0f3e2f00885b2119887234ee033f6c9fc6e23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667319, "uuid": "a6b7235d-c810-4f8c-a4dc-ea0dbb977097", "value": "T13E43E691BD824667C1D022BAB66E968D37B163E8D2CF7317C8200B507B8A94F5D77F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667319, "uuid": "32b47eef-3b3a-496f-a5af-08707fe8258c", "value": "768:v/e02d3L3GCAPFjSHVxAz/Qt63p83bHewSBlb0fU63JFlu2Sh/AtobuwZk:hCb2CANjq63O3TewSTofFJFluxIKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667319, "uuid": "7ac8804c-38f2-4539-9df7-81aa4821a0ea", "value": 56544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667319, "uuid": "46661b2f-9f3c-4a04-9d28-a27b4f46ddf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667319, "uuid": "1e80d9b2-2b34-4ed1-ac41-f628ce147958", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8236ebd-d858-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765653708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653708, "uuid": "7d2ee38b-b75b-4ad8-acab-d2232c998572", "comment": "Malware payload (Mirai)", "value": "8b094ac5f97310ae4f281189ca4d9ca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653708, "uuid": "1e7e3d4e-1672-44ab-823d-85c629156dbc", "comment": "Malware payload (Mirai)", "value": "d7df6d07b57f67410fe5813e1fa2b5d2cf54d73fad775257b441f9c81b7ccbbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653708, "uuid": "35108617-ab6b-44c9-a9a8-36f83e32465e", "comment": "Malware payload (Mirai)", "value": "626859d16ea979dc316dc6c8c6d580a18873be8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653708, "uuid": "2815d941-e00e-4970-b8eb-255b5695f35e", "comment": "Malware payload (Mirai)", "value": "89ad9b044be3b84c5cd7f122ffa774a69f26f1875b5f616c5f7555c8f871504b6e19957ec414f09833cb2816fbdb4378", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653708, "uuid": "2ea900b2-2d31-41c3-b261-f1f7a8bc38cc", "value": "T170633BCEAE03D4F5ED1B053014B3F7725A76E5390029EB83EBA5A633B852611F60639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653708, "uuid": "5023cd3f-4a1e-40f8-9817-4e96c982db7a", "value": "1536:sbOBIHUI4hDpWmrpxrkz1pZ1TjbPbXSeAelHGSYxA5GNGRRBQ:sbe+UI4hpXpxrqZ17PbXxhVV8pWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765653708, "uuid": "95363dff-a16a-401d-ac97-93a2b3dddf2d", "value": 71440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765653708, "uuid": "ecc34dda-6852-44e6-a6ac-df5ef516011b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653708, "uuid": "ea43c600-5de9-46e5-b78f-74eed2c4fa02", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56ebdcf-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615880, "uuid": "72b32cb8-47ec-4cbd-963e-08efb6404b34", "comment": "Malware payload (Rhadamanthys)", "value": "f96288e3a55e3104c4c124cfcf8d409a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615880, "uuid": "bae15561-dcb5-432f-befc-c7fdd1871167", "comment": "Malware payload (Rhadamanthys)", "value": "d85b459b08e738ceed880622b23bddeae285a635d3b752ce42321b75a84421df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615880, "uuid": "624f28f3-824e-4a77-a42e-3d51c614f4bc", "comment": "Malware payload (Rhadamanthys)", "value": "1491a4ef552723543cb51299efcf2f9acc274154", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615880, "uuid": "ed2d0da8-bb31-4b30-8bd6-4513ae3f9d75", "comment": "Malware payload (Rhadamanthys)", "value": "9eabfcc83159383072412b9f46435eb27bbc38d61a9e6c52a99a944bc7714c870d67c0776b6aee5252cc421ef6be5777", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615880, "uuid": "1cab28bf-8f79-4281-825a-a416fb770e20", "value": "T1F2A309A4AF3B3E1404645A78EFEC20FDD929ECE69D010C1D5A19F761D4DAF2C63458E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615880, "uuid": "b93e9946-32ea-40d9-8ea5-9eeea6673d6c", "value": "768:GDhd0i7J4sYKgY/CMNfWd+nEES9kPXErXAMrcQrA3aHu5tkqAT946b8rSLAuAArt:GDB7eKg20nrlrcQMdBATwr6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615880, "uuid": "5844f8a3-9c5d-49cb-91b2-08c3b58ed6a2", "value": 100077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615880, "uuid": "996b6ea1-c0ab-4493-9324-c25526394ecd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615880, "uuid": "db934bd3-d9ff-4857-abea-23fc79acac36", "value": "invoice-1637482117.pdf (20).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255be9f7-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605250, "uuid": "95ccc7c2-8a37-4d49-ba78-4c9ca42e378e", "comment": "Malware payload", "value": "3438bae421391c7f1ca196b834b323f3", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605250, "uuid": "a32db6d3-9369-4b2e-af4c-b106db313542", "comment": "Malware payload", "value": "d89f3a1a36fb2a782956545e19c540b514643ed48098cdd1ff0ef84dc2571e3c", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605250, "uuid": "ba008175-dd81-4e52-a0db-2793350c126c", "comment": "Malware payload", "value": "1285a76446097fd9b559a79cd383cae8c226aa01", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605250, "uuid": "87d670b6-e22e-4221-bf72-562ea2016bf9", "comment": "Malware payload", "value": "b23aec57794e5b6797d372030d74e2c07264437938a633ccb8b329435b64ad17ba86a8b65f8f742f6a6e5e4ef45f41c6", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605250, "uuid": "765a0812-c44e-4435-b5ba-5b3b2fb9de17", "value": "T13E842AA3E7482404C3B846B58A2D5358BD35FB4C5B7013BB3B50A2FAAEF93544D1AF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605250, "uuid": "2712ead6-5c97-4f3c-8ce3-944fb8a8fc14", "value": "3072:8FCm6KEKd70hmXz9m5/XZleSyg/MOHyA8uVUy0oMzraRbgqkg1+Wxgu/pFGJPHnO:traF9a8uVB9MzrU9+PHnuiuNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605250, "uuid": "13dba063-29f3-470a-b6a3-3f492a197489", "value": 390448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605250, "uuid": "189f919f-bcbb-45b9-8150-faa9999038f4", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605250, "uuid": "838df882-5db7-4277-8092-c4060cca0ebd", "value": "d89f3a1a36fb2a782956545e19c540b514643ed48098cdd1ff0ef84dc2571e3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8deb68b2-d876-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765666414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666414, "uuid": "6234c65f-a300-47ed-943c-6b68b598f301", "comment": "Malware payload", "value": "2e07878b9b294cb730befc000a0146e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666414, "uuid": "f011bb18-68c9-4ea4-bf22-d9209837cac0", "comment": "Malware payload", "value": "d8c6772c020048da775df5cb5c4eb75263c1602aed86ee6e2bee28844ca57f49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666414, "uuid": "d1b71f40-409c-4b9e-8cbb-94f1c2080b7f", "comment": "Malware payload", "value": "d46c7957afd54646344a84c218ce5962e86537bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666414, "uuid": "9130af7c-be46-4564-b745-6986693c26ad", "comment": "Malware payload", "value": "5ec78591152a79b7bf421e39444d8005279302fefbad87adece30fd3ddc0195af4338bc7942da4edd3944d746a119db1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666414, "uuid": "acc43be2-e697-402c-9ae9-f472e34febdd", "value": "T147831A85B8919A13C5D452BBFA5E42CC332627E8D2DF7207DD11AF153B8A82F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666414, "uuid": "4bea43b4-94d4-4b68-bd4e-3fcb00089478", "value": "1536:7tAtdiUuvB8m2kANibD/9ckcWcMABU+VjesWJE5vYnv8VR2:7tAtdxbmD95YC+osJJYnvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666414, "uuid": "b9471a14-9b55-4b31-9e69-8313f819db15", "value": 83136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666414, "uuid": "43b60271-feaf-4f43-87fc-d84c700a07b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666414, "uuid": "7fabadc3-f9d5-4f68-a88f-872865d8eb59", "value": "splarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c836d1f-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615651, "uuid": "61c4a655-efd9-4250-9f94-529d3440decc", "comment": "Malware payload (Rhadamanthys)", "value": "bf36420c02a3742608ae78aa29d5b444", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615651, "uuid": "449d67a4-d7fb-4586-bf33-6b7dc08d6903", "comment": "Malware payload (Rhadamanthys)", "value": "d8f973b3219829b0a8269aec9e6d06ea7e181758207d2ff22f4ce755a2130d8c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615651, "uuid": "8ef7e747-0bc6-4fab-8ad9-86bc5fa345a2", "comment": "Malware payload (Rhadamanthys)", "value": "8d8128fbeb89d09a9652ec5d63af295d4a79fe5f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615651, "uuid": "f91f9f37-37a8-4813-8353-c43088724218", "comment": "Malware payload (Rhadamanthys)", "value": "5e6be563d838555ec4b132505a231b1aa245047fd6030ec09e55a87118fdbb82524187ae01a09e21e63ee8669af9626d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615651, "uuid": "eda90162-ec91-47d3-94c2-b0811c4a8d77", "value": "T129A3D844AC216D842348F651FFCA53E85A5C43F3C9884E01472F7F7AD26AAE2E8527D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615651, "uuid": "a753c636-58c3-44b6-9702-bf87cb88bd1b", "value": "768:GDhd0i7J4sYKgY/CMNfWdGg47uaTrXjvr5dX+WeH/NzFXAvsXoAC6SLAuAAroQWK:GDB7eKg20mr7r5dO77AV166BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615651, "uuid": "753ce397-7170-4fb8-9574-478a34739551", "value": 99474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615651, "uuid": "d9ad7293-2fb8-40d9-8298-3d590ffbd099", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615651, "uuid": "2f898901-8b5e-43ee-b9bc-f03dadde7fa9", "value": "invoice-1637482117.pdf (71).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425412a3-d7c7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765591125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765591125, "uuid": "7010c25b-48cc-4013-a541-818d06076928", "comment": "Malware payload (Mirai)", "value": "8744100cd1f89ae9ad44930d11ca0e30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765591125, "uuid": "bce88918-8bea-4457-a9c6-ce5e28d9e423", "comment": "Malware payload (Mirai)", "value": "d9a690e2acd8547107c2423b6a7d54eed121ac5e1451a04ba99a1f4e604f68dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765591125, "uuid": "ac512555-4a3a-4222-96d2-0050949c79ed", "comment": "Malware payload (Mirai)", "value": "ac29dbc5b5e717870e3ac7a8017cb4af4c04ac6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765591125, "uuid": "c4495788-aebf-423a-9543-4b21e67291e7", "comment": "Malware payload (Mirai)", "value": "3b8466c631bf45958ba4179d4bee128a002e29b58c76e5c1410b8e03e52ad32a1f8ee94dab28d5c7524b3dfff52df144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765591125, "uuid": "76fe7ce8-6d4f-4335-a782-5e415bc8fa36", "value": "T188B39CDBF24702A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765591125, "uuid": "fedc5e40-6e0a-4b79-a453-c7be62a28330", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1D/LWy:c9sSyzz36YaWWgg1Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765591125, "uuid": "020a21bf-b8eb-4451-8cef-cf058d15fb0b", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765591125, "uuid": "f68f47ac-3784-457c-8373-d72e50ef83a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765591125, "uuid": "1a40d9e9-78cb-456c-a27b-fd15f0b91554", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20af23db-d849-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765646904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646904, "uuid": "7ba2c507-1c2c-4237-b9dd-210dbe157801", "comment": "Malware payload (Mirai)", "value": "abe4239b81af9878abd3f54b161770a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646904, "uuid": "fadcd3da-683f-44b0-9e84-16089070e1c6", "comment": "Malware payload (Mirai)", "value": "da7a18b0ec3604fd7c141540828279c48cee8a35ad208069b4e62e43fad95c15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646904, "uuid": "20100b62-0755-4350-b820-9f36178cbce8", "comment": "Malware payload (Mirai)", "value": "924a84364b8d9c3e3a2bab89ff8f0d066548bc31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646904, "uuid": "c344e1cf-3f37-43f6-995a-224680adfffe", "comment": "Malware payload (Mirai)", "value": "67d254a771f251930b4039fb63659deebe5d2d74c06c559fc14e9ecba9c560b2c8732ef8fc4d05881eb29be14e62494a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646904, "uuid": "f555ee77-490a-4f83-95a6-92adb4a1f77e", "value": "T156334921AD3A2E17C0D4A97E62F38724B2F1524E25B8CB2E7C720E4EFF14544A6536F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646904, "uuid": "e033e0ee-7228-46ad-980e-8f7d39e0a3f9", "value": "768:dFoQAoq9o4CXrrZABAS2G5uH203xwzVmKW9xqTJXVO+FOhYm:dFIoSotXrrZABARG5uH2Ykrb1Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765646904, "uuid": "e559cb32-3d11-4c6f-8624-24a1fb7b0e21", "value": 50364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765646904, "uuid": "cfd1be2a-bc7e-4eef-9558-6a8ee5587749", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646904, "uuid": "8b9df768-c70c-4524-a341-1f246ad63a41", "value": "Mercury.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d5efe9-d858-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765653405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653405, "uuid": "8111f4ea-6253-4aeb-9437-3c16494f4afb", "comment": "Malware payload (Mirai)", "value": "61c8f7da5b88da787b978c4de53dda73", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653405, "uuid": "8d8ccc1e-65b4-4d4d-961a-1e8570ffd438", "comment": "Malware payload (Mirai)", "value": "dab775c7da81d3364da3953c20a41d70bbf9845c3d0ed40c668257fabf4584ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653405, "uuid": "4a02868a-15df-4c7e-b3ce-4ead365e6279", "comment": "Malware payload (Mirai)", "value": "7d9e52b81b99dd04b67ee668e84c02df869b2916", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765653405, "uuid": "2f942d33-f97d-4097-ac5d-7275130b37f3", "comment": "Malware payload (Mirai)", "value": "db8c1e682d6a725db6db77ded86620cef7e524a61bccc328626fe1efc319b08ec0ccc455008ff45035e892726a362388", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653405, "uuid": "960f7544-e9f9-4996-93b8-d0610bb979a1", "value": "T1D4D45C87E8A600FCC1DDC03446AB16366AB5F86D12357B6F2691EF722D23F606B1DB50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653405, "uuid": "5be216a9-6f9c-46b1-a84c-f8173b74d7d3", "value": "6144:Yl4JboLMvS5LYn/Dm9W+HCk5EFgAES8fe+qeejgQAF16WMwoUtXWwgbYH55wOZOX:y4JbOwSFYnsW+Hh5HAShH1awoUhgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765653405, "uuid": "11003c83-8900-49bc-8726-ffc7f8b03b62", "value": 635832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765653405, "uuid": "5e103518-5fbd-4d84-a097-a14f8c1ba2d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765653405, "uuid": "2c4ec509-ac09-4906-a7ae-b43bd7cb88ea", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c573c286-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615827, "uuid": "bf846ab2-27e3-432a-9458-e81816e988a2", "comment": "Malware payload (Rhadamanthys)", "value": "7cb51937365e72a0843639fae9020f2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615827, "uuid": "53ce842b-ab0a-417e-97ff-9f92150880ca", "comment": "Malware payload (Rhadamanthys)", "value": "dabdb41eedf1da705cccc518e325c5617d5f8fc4bf69452a06ee9f40c7091d1c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615827, "uuid": "8bbd174e-7060-42e2-a7d0-ebb87110ddbb", "comment": "Malware payload (Rhadamanthys)", "value": "ae6c9aee579dc624f4ce6e5c9d9b8046ddcb500d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615827, "uuid": "114d9a1d-9bc5-4dce-be9c-8d88f12def5e", "comment": "Malware payload (Rhadamanthys)", "value": "b8333cc4ac76162e60385232757f981242dc667078d7ce374aff73ff03fad7cb49985b29cd0f6c022cc528a6c5e6ba55", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615827, "uuid": "954098bf-4f73-4476-b0b3-6d3309efe621", "value": "T145A31C9C8B359AD052EB49609DB06BF3E01F510BE588136ADD6CB357CC04E283B966DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615827, "uuid": "9f310689-907d-449c-a3a7-908bdbf6778b", "value": "768:GDhd0i7J4sYKgY/CMNfWdw5oVOrX8CrsCC8HSXAX1kLSLAuAAroQW+FF+Ec+0FO1:GDB7eKg20orbrsCCZXAXuL6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615827, "uuid": "64d92778-9776-4770-a555-d44d6a3517ab", "value": 103910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615827, "uuid": "4ff68b70-6570-4165-ae5f-2cbe1a8dbec5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615827, "uuid": "8c447ae5-93d1-469b-9943-57e3fc15e4af", "value": "invoice-1637482117.pdf (32).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad64998-d845-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765645471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645471, "uuid": "43a366e2-ae6b-4d53-86d1-60d1f52d2e7b", "comment": "Malware payload (Mirai)", "value": "a2c561a470f7cd96684dc3c7efc10bc3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645471, "uuid": "6018ed03-21d3-4f06-860d-c9c72dcecdf1", "comment": "Malware payload (Mirai)", "value": "db5135c8741173d079f2050311d611c702360a1c64674f048e99221ee8fc3d1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645471, "uuid": "3cf11be2-c810-40ee-a493-2b91ca0e2e1e", "comment": "Malware payload (Mirai)", "value": "1cedbdbbc8c873239dd45b97759cccc8dc9a0ab3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765645471, "uuid": "e15347b2-c1d2-46dc-adcb-c00137b7c010", "comment": "Malware payload (Mirai)", "value": "a1eadfbd509de9ebba798988f12f6481912026a6a6b26e5dbfdc008b8a91bec578fc22984bffc2411134e0571ce0058b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645471, "uuid": "683174f0-a357-4e25-9d05-e73f813ef00c", "value": "T1C143F756B8D18E01C5D412BAFE2E118D33136768E2DFB2179D106F247BCA92B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645471, "uuid": "a2a4446c-4370-4194-8751-132ecac9588d", "value": "1536:Adn7NVwz4O0HlgAk3P5pGWGc1ZsZJbgGLaIWicWXMKW50:2VigFgZ3hpqcnsZsWXMKW50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765645471, "uuid": "73360f50-dc79-46cd-9116-610e5a145036", "value": 58496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765645471, "uuid": "40f89e80-9d6c-4882-b749-35ae86fceb8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765645471, "uuid": "c7dc03f4-3d07-4ac8-8da7-8ca98d8ab9e5", "value": "Mercury.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c09f8a4-d822-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765630119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630119, "uuid": "00a112a2-1d16-48fe-96b1-beb37fdc867f", "comment": "Malware payload", "value": "6d571018b39849c6ee62c1b826e58516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630119, "uuid": "e9b9d9b9-c6e5-4527-83c5-6a6498c2c130", "comment": "Malware payload", "value": "dbb0fcbf57d9c83286a84fdb2776e4c9b14c2ac6a9cecc4c5551dd53705af742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630119, "uuid": "de10c8be-add8-4a38-b5f0-4ad11f852699", "comment": "Malware payload", "value": "2038f260366b9606b002a71a62045119a4675e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765630119, "uuid": "6afe9def-c325-4308-b8a6-d15ccfcb70c9", "comment": "Malware payload", "value": "7b1639e8a33daba42b419b5270375b85d5e1b06de7af4bb37f28a82bd53632d1e7b677fe4dd233ddb99402de380e9524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630119, "uuid": "dda46d03-490b-4a87-bf70-6871f9d28fe8", "value": "T1F2554B47F66294ECC53BC07486269773BA71B82D0634BE6E5AA8E3321F31E505B1E734", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630119, "uuid": "be93abaf-2d02-4e17-88cd-4c90291f6265", "value": "3c687889d6d93cd74a1fe0a928407593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630119, "uuid": "8f323922-9251-43ff-b713-67f800959309", "value": "24576:7C490PYUGYZNgeK3jJT6x+O9WTh8komysW5UDz4:7C49gYU/Zm3jxw+O9WTh8US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765630119, "uuid": "63edd760-71a0-4cbc-b4b3-a79f032493fc", "value": 1398792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765630119, "uuid": "2f84cd49-5b74-4812-8839-372fdee4409e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765630119, "uuid": "315e5a1b-9867-434e-a2fa-a6b9a3913a5e", "value": "xboxhelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a3c276-d849-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765647206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647206, "uuid": "45e13be3-9185-461d-8835-4ed8b4295d3c", "comment": "Malware payload", "value": "960ee8ff35b019ebd305bcb9303a5d21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647206, "uuid": "fbae0bfe-da75-4c8b-81fc-b87e36f7deec", "comment": "Malware payload", "value": "dc97650ddccb05bca3d673dc2e0c286ec4734a87c92794394bea3ede458ffb75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647206, "uuid": "3958bac0-990f-4e23-89fd-3e2a07cbe6b7", "comment": "Malware payload", "value": "8d8b2c72b54e1d11a99f3e78a43712bf371a23ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765647206, "uuid": "cce1b632-aa76-4de6-a77b-37e4963a3cfa", "comment": "Malware payload", "value": "8be3d14b7134ccbd8ac4266bc30d3bd271e154e19e592a2e777e8d65c78337fc9993917d0d16f32ca40e6b42173e851e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765647206, "uuid": "1a943f00-181d-43ff-87cb-f0435a8e482b", "value": "T1F0631218602A4974C931F07FEFD5C8C17B4F898110E52065A618835DA79A17BFCF9AAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765647206, "uuid": "71f2c15c-a706-43a9-8386-add87ae42af9", "value": "1536:/GZT6gEo4powDUuUrB7mNZdXZ+86rACsUQ6Bz0Ai4Swdt6z2:e0dBpowDEyP9jiAjooAi4Swdt6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765647206, "uuid": "f8aad544-465c-4ee1-adb5-0636d5d80874", "value": 69312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765647206, "uuid": "5d9b1b42-f590-44ca-a689-41204a53fc0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765647206, "uuid": "3a18ab80-d6ea-4009-a197-44413a544650", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a5891a-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666595, "uuid": "eaf7bccd-0955-4c82-b49d-5da54734def9", "comment": "Malware payload (Mirai)", "value": "ffc6b9af966af1c01bae19a83d614142", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666595, "uuid": "b7def411-ba0c-4239-85f7-2426e69ca459", "comment": "Malware payload (Mirai)", "value": "dc9c4bdeb4bc46033437f78cfc250e882eb3bfea33f3ce71e3ed814fb946636d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666595, "uuid": "c376571b-090b-4ba7-9ae9-92bd92c377f1", "comment": "Malware payload (Mirai)", "value": "b7be297dc7cfec5919454ee88881b18baadf71a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666595, "uuid": "a3795c7d-ce2d-4fc7-9aa3-d253efa5aed3", "comment": "Malware payload (Mirai)", "value": "7ed37d8fdad506e5f6980bf6a6202ae65d607b69f05de764fe7683ffa1f5bc1e6f3851ccbaf666d5cd892ed440ca5e39", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666595, "uuid": "7f724b29-68f9-4a0d-9300-19b7ad88a1a2", "value": "T13E5190CA12524F316CEED92F77B988883184E5FBB4C6DE24D9DE78AE448DE0DB040646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666595, "uuid": "72b1ee79-f5bf-4456-bb69-8f4d686c392d", "value": "48:iDO8DviDtitGD8wD/qDpmDR7qDaMD5+lLD2uXJDbaD/SDIMxDEIDjl3:ifOB9+McDyLr6OHxdd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666595, "uuid": "d265d84f-537a-4d47-bb37-138fe50fcac6", "value": 2564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666595, "uuid": "17e6f618-bef7-41c6-bf70-32e9e14593db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666595, "uuid": "7d0cb133-0a1a-4863-aa25-1dbb49f2839c", "value": "syslogs.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff00ff8-d863-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765658257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658257, "uuid": "18fdc9c2-5b93-4309-812f-db296d84be4f", "comment": "Malware payload (Mirai)", "value": "b9a195cb91d8c901bc7829f187cb75a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658257, "uuid": "21a9783e-a630-4d3a-bd8d-f84545c1fcf7", "comment": "Malware payload (Mirai)", "value": "dcd7ea28be8245089df51e3b086d9db7f463f56993ba78a6b4c048f8d4ad6dda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658257, "uuid": "0c2d8523-d16d-48ab-b7ad-dd997440b61f", "comment": "Malware payload (Mirai)", "value": "ce759159446601d4cf84ad7a1257130dd5d25793", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765658257, "uuid": "d0c10594-21b7-4283-b8b1-0e6bf437cd0e", "comment": "Malware payload (Mirai)", "value": "6ce582f47767646432f4b980f2e4a035f94d9c1dce073df57d002a35d9416be1fe681a6e603fe120a12f3dfbd5eb3677", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765658257, "uuid": "36b3795d-c63c-41c2-bfe9-ef6020d4bbca", "value": "T17C73A549FB614EB7D85FDD3741BD4F4529DC860722A82B752930E828F26A14F4ED38B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765658257, "uuid": "2f5f63f1-1ef9-4afb-82e8-b0ccb34a2d96", "value": "1536:pjJFSZxvdc7OfWVfnm37VltWSvtjl/0PWjsAzgfP4Gnv8VR:pzqHc6uVfAlpQfPFnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765658257, "uuid": "dd9526ec-86d6-4119-bb4c-a20370bfc900", "value": 76656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765658257, "uuid": "9ff20275-65ab-45e4-a1a3-201f76046c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765658257, "uuid": "e0502137-ae1e-4cdd-93ab-4c8cc18e0e22", "value": "nabmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3f8ca1-d879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667831, "uuid": "a58c1db1-7063-4f96-9490-e41c9cdd1ea7", "comment": "Malware payload (Mirai)", "value": "4a2b2eefb6e32984454e128ba673517b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667831, "uuid": "56740f4b-6240-43bf-87bd-526c4b79f243", "comment": "Malware payload (Mirai)", "value": "dd5c24ed84a3de64519ef019a38837251cd95b58ffca7ca78d27c3fcbf641c24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667831, "uuid": "c428f088-3d94-4af7-a7e2-c697e2fe147e", "comment": "Malware payload (Mirai)", "value": "ff0720beacf2c32e6b0b9cd725a7523af80aec17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667831, "uuid": "a05be2af-13d0-4725-83ae-644f49ab7f20", "comment": "Malware payload (Mirai)", "value": "b3fb98dcaf9b5238e9d202407eabaad492628386fb8c8839606c5836684f7183f604d416d906afc76cdf448136f82f2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667831, "uuid": "59bb8b39-4e0e-4b03-ba77-da8de4167eb1", "value": "T1CB5301C3E0A74C49B23B14762BBB2B5E556CB41BE1499136CFC07A77E8DAB6D4948B00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667831, "uuid": "c071b454-1c11-4c1d-90b5-feeff858435c", "value": "1536:TCJETAkRV9DW8rrDN1PLKdxBg5upJ9sD5qKDnouy8Gyj:TC6TdpXPN1OTK41sD5qK7outP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667831, "uuid": "5828449a-f8a2-4512-bee8-2434dd32fdc9", "value": 61608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667831, "uuid": "209acc0c-5d91-4f99-9f5b-7bb3aeb3a974", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667831, "uuid": "9549c3ab-bdaf-49f5-a692-377bf838b41b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f74026-d879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667631, "uuid": "43c93dd8-2745-4527-b1ed-809f008272c9", "comment": "Malware payload (Mirai)", "value": "470a489db2355e01dd1fa60ca280c2c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667631, "uuid": "4d120c77-d188-48de-9d95-3031464ec4c1", "comment": "Malware payload (Mirai)", "value": "dd75751046b89a642e26f1ef4e24bec7403f7773335a3059c326ae749748e610", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667631, "uuid": "4da4aa67-dcaf-48fb-bfa6-7f321861a3cf", "comment": "Malware payload (Mirai)", "value": "6ef3d8fb2873b7c589475dac90a7d87c8b4a5697", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667631, "uuid": "bcf7f7e7-06dd-4ee3-9141-0b7cbb24ee6d", "comment": "Malware payload (Mirai)", "value": "edfdd8bfc95fcca3f3c5b72a91f3ec8fec8193b893ca37ef5d328ca6192deaa9f7ebe7a3f5fd86ab35f22a500f1b35ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667631, "uuid": "ee94a20e-ecb7-46f7-a470-3b5860cc90e5", "value": "T180735D4373184A53D5A749B0253F27E183FFAA9020E0B785794EAB8946B6E331447FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667631, "uuid": "1a13b1fd-8b48-44f3-832d-b0ba9f61249a", "value": "1536:waEzvHBs6r6NdqmBDnSuGWNs/m7fARJhmnv8VRh:wPwnFsesknva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667631, "uuid": "b90a6533-4e5c-421f-aed5-847ce66198cd", "value": 79140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667631, "uuid": "e4aaed2d-474a-4d79-9f39-9f1c519a9600", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667631, "uuid": "6918cc0c-87f9-45d8-9d55-5bbbf22486cd", "value": "splppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5fb1a8-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607061, "uuid": "5850d873-c7ba-49fa-8b6b-7f9cf138e497", "comment": "Malware payload", "value": "52b5d7146e668307bc75e2598b68dc1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607061, "uuid": "2db37a87-f3ed-4c6c-a61e-ce21aff19122", "comment": "Malware payload", "value": "ddfe1a9224593ae88b37650ce04290b61b69e996276dae5d3d861558c2cdc419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607061, "uuid": "bf0f2343-a84b-4d13-bc47-db4560cd3905", "comment": "Malware payload", "value": "9383434401efabaef91fdc8a1fb5b7187ec61851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607061, "uuid": "8499bc77-f27a-455e-9afe-da120e0bc109", "comment": "Malware payload", "value": "2acf2eb4d23baa23a4779f664bccfc43241bcf27c99c0c120338f72924f777402f4fa576a08beed278947afcc320ee0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ongc-ntpmanager-com", "colour": "#F95EB6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607061, "uuid": "bbd11497-352b-4909-8ba7-6755396db782", "value": "T1D5954B25F7F2015AD2AFE139E8CE4909E2A3B942476FC6DF025E03253567BD22679703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607061, "uuid": "9217b2aa-1bfb-4460-9284-0140d7ca7f8f", "value": "86962b2ddbf99fb8355cda2d124ba099", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607061, "uuid": "c6473a0f-ce75-469c-b97a-022a97b0fce8", "value": "24576:X27nIqKO8jh3Wm8iQsN9ibyTYB20GQj8kUFexJxLqySCqN+:mUVljh3SsjibyTW20GQj8M9uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607061, "uuid": "c39142bf-2974-4319-8dee-8fc753f56b4e", "value": 1966592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607061, "uuid": "03bbb16a-585d-47c2-b90c-c51933c9c2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607061, "uuid": "1a6d25ce-ef64-414d-bc2d-9e5a0fc18803", "value": "ddfe1a9224593ae88b37650ce04290b61b69e996276dae5d3d861558c2cdc419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75de103-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650270, "uuid": "95bab7a1-8ed2-491f-a22f-a8eea30cd08a", "comment": "Malware payload (Mirai)", "value": "afe72890e6786cc34759749fd0ea4c6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650270, "uuid": "4874e23d-4286-4b03-9427-f530787c367f", "comment": "Malware payload (Mirai)", "value": "de32747205d5427dbc395af7820be35d676f9bae830e5205b9df9479560d5877", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650270, "uuid": "0f283878-ebea-40f0-a89b-ac688c4513ea", "comment": "Malware payload (Mirai)", "value": "25441c0783c8e47bbb3c4ce278e50d7af4ac38ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650270, "uuid": "d6f3ac0b-35f5-4138-8a0b-e3c6764e0346", "comment": "Malware payload (Mirai)", "value": "5a837920d69dd3965771dc39d7d8b9ba4a85e8ee90f084b440ac2a4804da7381cec62470fbf5f00b36ebd456253f540a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650270, "uuid": "710fa3d4-ad48-4f06-8369-82fd1a0c09e2", "value": "T121C42915F8809F61C6C535B6F64D429C73075BB9D3EBB2069A244B343BEB87B0B3A605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650270, "uuid": "57503e17-023d-4f9d-9248-f0e29c944eaf", "value": "12288:rpKbdtYS0XemA2m7dR+/o7bV7a8pLgTC:1KbdfmA16gG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650270, "uuid": "3352e646-1b32-4858-9e62-eabd66281d35", "value": 546960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650270, "uuid": "24b76957-2161-48b3-97de-4a96f2935ee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650270, "uuid": "373b6b8d-b083-45d2-a595-6b7eb523cc70", "value": "shadow.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23382c8e-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615555, "uuid": "708423e3-3b27-4e75-9b55-ef0a15a385b8", "comment": "Malware payload (Rhadamanthys)", "value": "c99b04e67a3fc3361734f07de0365828", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615555, "uuid": "ff66a2ed-25cc-4611-b0f8-a153fae36aa8", "comment": "Malware payload (Rhadamanthys)", "value": "debe31c4256f0ced2f1e5506cbf5b1733a4d7270aebddc7ba5113638a37dd954", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615555, "uuid": "48da2351-fa46-4478-a1ca-9977a992f45d", "comment": "Malware payload (Rhadamanthys)", "value": "f4b6576f6c901f2ea9fa6420e6d96e9a171964ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615555, "uuid": "e1a6dfe6-d944-471a-9bb1-6196e04a990d", "comment": "Malware payload (Rhadamanthys)", "value": "104e598b9168a9b1ed78908ca63629eca6868b4f80b81892a790b6939dd47db732a3878997da09ae5b21325dc0bd263e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615555, "uuid": "a83c6e24-cfb2-4c46-a128-15da392dcf14", "value": "T117A3C77499F0A8F92A7974B46FC8A8D184294047982B9FC0AB1DF7112293F717F31BD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615555, "uuid": "476518a8-b77f-49d2-b774-f6229af85b29", "value": "768:GDhd0i7J4sYKgY/CMNfWdMgrXUKrEKLzHuEAqZq5MlySLAuAAroQW+FF+Ec+0FO1:GDB7eKg20/rDrEKLCEAqEd6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615555, "uuid": "340cd6e6-9d0f-4751-9e48-f8c8d2164135", "value": 100054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615555, "uuid": "95fd8828-abd4-446b-952a-f8af721c7a0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615555, "uuid": "3380e719-8229-49ce-bad0-54e67800f684", "value": "invoice-1637482117.pdf (88).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816124cb-d7fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613565, "uuid": "0f2a0859-82c8-443d-954f-191101c394ed", "comment": "Malware payload", "value": "116161c4c36d04dc99761918fe1c7148", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613565, "uuid": "993c0b70-aa68-43d9-9485-ed86d7949770", "comment": "Malware payload", "value": "df06174adcc2eb31ff0d8f49eb8d5b7f1e88076316503ab702a4844673936e2b", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613565, "uuid": "107732f6-d5c7-46fd-871f-1b8f831fbfad", "comment": "Malware payload", "value": "db8a0df23b6e1d1873b3bdb0c33e3545e11072f0", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613565, "uuid": "d2d5649d-97df-43c9-9805-730b3a596d11", "comment": "Malware payload", "value": "94548ab3920e8801179b75e4bd099faf7e5989f9ebe6e59eddd0b3bc8ca5c73a98b1eaebf498c3bdc9df42fef8a53075", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613565, "uuid": "209dead0-222f-402a-9487-a46d51b96f4f", "value": "T1D601FE3AB310B6BAD9D924D0F0611CC0A92945DFD0239A0456C085595A452FFC23A2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613565, "uuid": "78b6fbb9-be34-481e-b5a9-11e008dece19", "value": "12:S8nnI5edGpKvhCkG1oCdzFatc8Vj0/QAYzYvQx98XhJQAYUqvOBIMW75:S8nnLcKa1Fzz8V+MYvi98Xn58QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613565, "uuid": "dbb9ae55-a3c3-4b1a-86eb-b42ca6858139", "value": 667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613565, "uuid": "3b33eb91-da42-4e57-b39f-21cd66520847", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613565, "uuid": "0d3b324b-274d-47b7-b0a6-53cd7414002e", "value": "df06174adcc2eb31ff0d8f49eb8d5b7f1e88076316503ab702a4844673936e2b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f73a01e-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615951, "uuid": "5fbcb471-17d4-4b75-887d-0f5a40cee79e", "comment": "Malware payload (Rhadamanthys)", "value": "ab03456f0cbd94f0863fa825c78f1726", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615951, "uuid": "2c50add7-9a0d-4e66-aee4-eebceb662617", "comment": "Malware payload (Rhadamanthys)", "value": "df0ad0683279247faeee491d6dcf05387c68bd8ecebd710e010afc80c75e7c9d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615951, "uuid": "003bac9c-67b1-4361-a210-79e8fda0bb20", "comment": "Malware payload (Rhadamanthys)", "value": "1ac74a664b8bb64df2734988f64952f481657f4a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615951, "uuid": "32b386da-67ff-44b9-a723-0873d040f99f", "comment": "Malware payload (Rhadamanthys)", "value": "ee7f7f1ff2f9a3386ae1f0deadc3b8948f7dd05303f4f9048ddf3e11e0e19463c4dd22b546a1571bdbb068ac9606385a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615951, "uuid": "e88afa33-95a9-4ce1-bb72-697edaf58305", "value": "T187A32A061D267EEC2B7F3ABB0C020EF5C6AEC4A6490521185E06BB59E57CF3779911CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615951, "uuid": "c4e58087-3ee2-49eb-93bb-ddcb9cca934c", "value": "768:GDhd0i7J4sYKgY/CMNfWdb8/jTy+1fGD6SQe140lRrp45YOOQFSQc5YbuivIvBoh:GDB7eKg202GrHrdJUVaAFJG6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615951, "uuid": "0600f5d8-defe-4338-8d77-d690c0d75aea", "value": 106098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615951, "uuid": "b6c73abe-1c93-4fea-8af7-752c029563bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615951, "uuid": "e63f4064-a9d8-4030-9f00-6d6f3c31f849", "value": "invoice-1637482117.pdf (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f455887e-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650265, "uuid": "f46e1303-c4d6-42ad-9790-c2e5cc8adcfb", "comment": "Malware payload (Mirai)", "value": "6d637c32a0cfd008beb602fbf3743b8f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650265, "uuid": "108d088a-13b2-4cb4-b5ea-2b33683b4846", "comment": "Malware payload (Mirai)", "value": "df1bab92226357e1441b70c92e793635490194874f661ec9ab08259ee253b2b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650265, "uuid": "e190f446-79db-43ac-a8d7-f5681380cb95", "comment": "Malware payload (Mirai)", "value": "b7863b901f9dfaa11de0a0d2e9320aa8c021253c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650265, "uuid": "eb791817-5bf8-469d-b2a9-1def33f1d613", "comment": "Malware payload (Mirai)", "value": "301e196b0d85b89c769cee90f5f4b1fdc8f3a20ec2331019c2f5e09dd5452cbf55220bd43ba9d8473cb9fa263e379b1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650265, "uuid": "96e9cbb7-d4f3-4405-b11f-15efb770f706", "value": "T18B84D096F3063E46C8D3C63914C152819799E56B33F3834A3A46A97A3C39B379F287C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650265, "uuid": "33f4f5b2-aa40-4815-8f8c-cd8728eca5b2", "value": "6144:Z+9o9qQ521GEmqToQVqS/f5GIRdI2tMD8NBN/mpp8pLOT59:oQEFHEQD/4YMD8NBN/e8pLOT59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650265, "uuid": "b7d5dbb2-64f7-42a9-95e6-aae9800fa977", "value": 399620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650265, "uuid": "4fcc0951-8ef1-49ba-8a78-22b5be866f4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650265, "uuid": "91f43dcd-f8c0-493c-9a9e-536a785edc85", "value": "shadow.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5466ab8c-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615637, "uuid": "8edde3f3-5242-4c6a-b425-b7bfb7e1c53f", "comment": "Malware payload (Rhadamanthys)", "value": "df7482610eca9d414fc4f361fe529de8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615637, "uuid": "edee4ff4-f400-45b3-8551-b68536ddca1b", "comment": "Malware payload (Rhadamanthys)", "value": "df6e001bb29331d26763c5a366106568c499d725c50547490880558f6cf89c52", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615637, "uuid": "def3c798-61cb-42fd-8d89-d44f42125e44", "comment": "Malware payload (Rhadamanthys)", "value": "5052d79950fcc1da129564be6490ff69938bdb53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615637, "uuid": "97179b01-b618-4897-83a9-2da78d692fa8", "comment": "Malware payload (Rhadamanthys)", "value": "f65c59c1cd63b4ac32ad9e6583bb08693843b0b3557665b926be81d525d81c077900c6527e764ea7f9402040f01032d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615637, "uuid": "21e8812f-ee8f-49b5-bd7c-024e8b3120ee", "value": "T1A2A3FB5D2B1FC9FA0912372D38E02775E07B66193A5D1BC5F00B73A6F10A5A6F8264E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615637, "uuid": "64dcbccb-52a2-44fb-be7e-b9c70c3fb1ab", "value": "768:GDhd0i7J4sYKgY/CMNfWdyRPRBrXFZrfLhRqYRSHJbT/VGRtRRR9AJRSRLRIyu0Q:GDB7eKg20+rPrfLWLsAZn06BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615637, "uuid": "f8d54b12-a40a-4302-b67c-d62a8a75316a", "value": 105366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615637, "uuid": "1d8de5d0-abe1-4e01-abb5-6fd28769f21e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615637, "uuid": "6ef1253a-cbd0-4491-b660-2118df2aefd5", "value": "invoice-1637482117.pdf (75).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fe5363-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613168, "uuid": "279ea605-e5e8-4a7b-9eb0-840e3d05ee60", "comment": "Malware payload (Mirai)", "value": "5a7344c28f331a4e97c25cfac0e28ccb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613168, "uuid": "6789b8a6-f88f-46e4-9bc4-1926f836d65a", "comment": "Malware payload (Mirai)", "value": "e0f914e932115fd3d0118f4b5b46e8f5f94c13de75edec75f1924e80d6bfd5cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613168, "uuid": "c78f6408-e336-406d-be93-ad30a28baea7", "comment": "Malware payload (Mirai)", "value": "62308cc748a5d6d4584522aa417394d6a6375a5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613168, "uuid": "d799deea-0ac7-4eb0-837f-640e58f96218", "comment": "Malware payload (Mirai)", "value": "1ef58cf56db2bd974a2cd49cf8a85b83e6605438e0c882253d20d750dbf2a09de21203b1cc25f2221b0281a75961ecac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613168, "uuid": "ee58f0df-7411-4972-a6d6-37ab90a19f5b", "value": "T1F5A2D024D3456EF8DFAF5D909381C3C27BF942C7275AC8E340EEAF01651A046B789D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613168, "uuid": "bd24416d-dd08-4d1f-bde8-6a875bf8e57c", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5nTQM4uVcqgw05VxJz:mRxsSVsMD6xiJJE5zRWNd4uVcqgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613168, "uuid": "4e95ed27-9c09-4c67-9b41-959dfeb243f2", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613168, "uuid": "5c6e98eb-fb2a-452c-b3fc-66788c069ee6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613168, "uuid": "9cadfb2c-4fbf-428d-a17d-c818a5d4a99f", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecba261-d803-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765617185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617185, "uuid": "39635afa-694c-49d3-a4d5-915ab8b82fb4", "comment": "Malware payload", "value": "2501171d2842fa89bddae06891cf4ca1", "object_relation": "md5", "Tag": [ { "name": "85-192-49-248", "colour": "#ADC129", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617185, "uuid": "eb7677fd-ccf7-43fa-8cca-6f70bfb7c47c", "comment": "Malware payload", "value": "e132be181eb9a803a95b4009de529fa1db1ccc7b8fc8b19dc17d1b9eb26bac14", "object_relation": "sha256", "Tag": [ { "name": "85-192-49-248", "colour": "#ADC129", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617185, "uuid": "3e058518-0218-4a20-afeb-95537eb1c237", "comment": "Malware payload", "value": "1ffda07ab9b9904894625061d6673d9e3e5a3661", "object_relation": "sha1", "Tag": [ { "name": "85-192-49-248", "colour": "#ADC129", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765617185, "uuid": "e449de51-b02a-4bd1-a7a6-7190e9b12e49", "comment": "Malware payload", "value": "334a2742e0a03d95f0648e9a2ef72c26a61e8e71bcf25c66c5adbc645c46787b1cd3ca54e9d87b6f4311d6de26804913", "object_relation": "sha3-384", "Tag": [ { "name": "85-192-49-248", "colour": "#ADC129", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617185, "uuid": "7841f1a3-94c7-4216-8b16-d83e99f2d655", "value": "T1EF083312E39F653AE4AE463415539652DD3FAE105F1BC8D797AC3D0CCA392D01A3EA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617185, "uuid": "d1e1493f-7965-4817-95ad-4cfc580fe6b1", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617185, "uuid": "842a8118-4ee6-4403-84b4-5856b78c8baf", "value": "1572864:yyJNNnJyMXc16ffotDp7cZ1b/wT98NJbCF/Zwzj648bugSbQP0:ygNzfEl81zwTmNJb6/ZwX648Xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765617185, "uuid": "c1b28e05-41d4-4169-9164-7e12847e8c13", "value": 81076920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765617185, "uuid": "70470d4e-7aa7-43b3-a4fb-19f942e4487e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765617185, "uuid": "a05d1cf3-8b10-4929-934b-540bed0cac78", "value": "e132be181eb9a803a95b4009de529fa1db1ccc7b8fc8b19dc17d1b9eb26bac14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae72de3-d879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667832, "uuid": "cb3660c2-c19c-4269-b84d-0b2b5dbf5450", "comment": "Malware payload (Mirai)", "value": "31d9eb7b03021ec9821643861ea9a3fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667832, "uuid": "b5a82667-e2dc-4a17-bcbd-85e5a9b3a800", "comment": "Malware payload (Mirai)", "value": "e2a162b5e172b2443f0bacc738d26e69bc9bdeaec98e54e290e0041f9e7e349d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667832, "uuid": "3e3612d2-14b1-4adc-a16e-9ad449b9ad1d", "comment": "Malware payload (Mirai)", "value": "f93c651322f6a1e3433e60e6a6ac94779d8a568c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667832, "uuid": "bc77b2c5-e8a1-4f5e-90d8-cc9a6f42f576", "comment": "Malware payload (Mirai)", "value": "2f2c7655b894f7f68005cea9c937928d0fcc561dfb24f4b4502cd3a10c2c447dd11024bdac85301a7427b0606543b93f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667832, "uuid": "74517211-6455-47ea-8205-28544fbe34f0", "value": "T1AD834B2279792D2BC4C4753F31E34735F1F6174A26A8C61ABD720E9EFF246402217AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667832, "uuid": "806ec4ae-e9c7-414d-9658-6330d3777f24", "value": "1536:0rCCzRS7OIiXDuXif24eaZenvQVWx2gqDPMNj6wiZkzW7ARdQ45oHVZH/Muhz:0rvo+XSXoF42gKAjg+dtYH/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667832, "uuid": "a795b94b-6ed7-422d-bfde-51d3e709d267", "value": 83732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667832, "uuid": "bfaceab5-b285-4126-adeb-9cf0df2068ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667832, "uuid": "a6370a0e-00ea-4bd7-b9bb-1616de79e1c0", "value": "splspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b56cb8-d87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669078, "uuid": "c14a14fd-3637-4696-922d-03aa014093a8", "comment": "Malware payload (Mirai)", "value": "96c65b949cbf994afd56cb9f752666fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669078, "uuid": "e499ff75-7a28-41af-b22b-9612aed70555", "comment": "Malware payload (Mirai)", "value": "e2b95f3515821b538f6b321b43931e36d794230e760a0456e31e18e333b62fe1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669078, "uuid": "9f93609b-15a3-4700-bcae-281e79bbe836", "comment": "Malware payload (Mirai)", "value": "68602170939b21ba5c5ec12d416e93743fdf192e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669078, "uuid": "4e45270d-8f4c-4aae-9599-e9f5953ca00b", "comment": "Malware payload (Mirai)", "value": "286360a36a4797c2e4a5228dac5f29db957d1cdf053096ece6091f5bba60b61212d5079e9d4e05091317b798dd82bdf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669078, "uuid": "d723ad30-9ba7-4052-83b7-7610886d65df", "value": "T12C630274FED4F6C0EE2AAE7709B1C1D00AE2A32D69449FD8248EBFB45320E951943DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669078, "uuid": "a37aa1a5-3b32-4d4f-892e-6f6d64f02ee1", "value": "1536:Ef0PoxdXNP6pWvhY4LUAcDooOHFcCbMozW9L+ZxDSXI4u+qgw091:EcPoxP6pmh1sdiFtbZfPiI4u+qgwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669078, "uuid": "7be373d2-1b35-45e8-bdd1-07a787cf5f78", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669078, "uuid": "a92832f8-7eff-46a9-b5df-855c53191018", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669078, "uuid": "efa5fd32-339b-4fff-816b-b607aad7bfdc", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef09797-d7ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607736, "uuid": "45b88d86-9d92-4e9d-81cf-df59a56be21e", "comment": "Malware payload", "value": "40bc9a85bb99e5f4a8ae0ee435723f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607736, "uuid": "ee0aac3f-d739-49ae-822a-a25d895333e2", "comment": "Malware payload", "value": "e2cde19b6d16b7f865c89f2eb63c549b8fa3c41caddfa8ae6f1d0de008d0119a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607736, "uuid": "22adc5c7-d2e0-4b6c-bf2c-38ce27a102a2", "comment": "Malware payload", "value": "8ef94a36139d27048ab3a78f40530bdc944ce906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607736, "uuid": "9215e13c-6fa3-42f6-bd32-d131a78ff77d", "comment": "Malware payload", "value": "2ccf43780c29a48054f29afd25c7fa4be9e56804ab22aca59b531f100ba19bfd6f3244ef39757ad6313389579c0eb37c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Keroro-Software-LLC", "colour": "#039535", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607736, "uuid": "991117de-c6a2-42e9-8349-18a14691e2ad", "value": "T155C67C22F6014018F9E318B7FDFF4A9D092CBD602F1960D7568439CDDE66AE27932693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607736, "uuid": "6f712a26-bab2-4d7e-bf0b-8f80d0610502", "value": "e40aef46255c8cdf98b55fca50adeb82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607736, "uuid": "d656107d-a393-4a7f-94ae-9ae5226695f6", "value": "98304:UPHyLFj8sAJ99t1AdfhUeYWoU/dpCYvfkeFW/kacCm3stYqGMSq3qeR:Ucd8sAJofhMICYvfkeFW/gMSq3qeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607736, "uuid": "bad1c333-4216-4295-bef8-afff8ed2beb7", "value": 11608056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607736, "uuid": "7117b26b-6d9e-4f0e-8699-6e5a02aa39d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607736, "uuid": "625d2a8c-6855-4382-9ecf-ca32bdeeaeba", "value": "e2cde19b6d16b7f865c89f2eb63c549b8fa3c41caddfa8ae6f1d0de008d0119a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f041bf2-d841-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765643680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643680, "uuid": "2d0ed943-a60f-4a91-a994-bd9bbb962e80", "comment": "Malware payload (Mirai)", "value": "1effc9efa0f6c34ef8827ca3a28dcd06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643680, "uuid": "17ae5d10-f7e0-4017-8877-88532eefe6cc", "comment": "Malware payload (Mirai)", "value": "e2f79d1a2b28391b751250f39fc96fe730d95acebdca700f273e1c3d69c905a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643680, "uuid": "035ed6d4-cd36-44d6-ac81-2debef2cc814", "comment": "Malware payload (Mirai)", "value": "83386b9621cb493f6613bdf2dbf6c6ee5c1c44d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765643680, "uuid": "50cd45d2-8008-4381-9cd0-59add1cca0e5", "comment": "Malware payload (Mirai)", "value": "c7b98dd57c0b0e82607681bc48209110915447c4b839b4d7ca15b8e9c66856518d41cc2f419f10988f6b3e868b683fe7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643680, "uuid": "4d7c3ae3-2cc1-42b5-979a-437d11593ebf", "value": "T1EE530204E0F386E1E675713619A6A2A8132CDD58A0549BF7D9CC327EA8F076D490CFB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643680, "uuid": "a5a24699-cad6-490f-848e-8b3a75e5e16a", "value": "1536:yY9y2bk1UZpqxzWUyL95Bvfucl+yMOIv8HgkFlnouy8HyX:22bk1UfqIx5BHuNyC8XF9out8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765643680, "uuid": "ca73c6a9-1fb2-4588-821d-a6718779c1a3", "value": 63852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765643680, "uuid": "e9b89681-f52e-4f8b-b69b-f558fb6d9c9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765643680, "uuid": "67a110a8-4103-47b7-ab9b-b986fb14d844", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff26059-d808-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765619066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619066, "uuid": "e4336af8-37e6-4f45-bbdc-865ca4c8058a", "comment": "Malware payload", "value": "5c84e0317d7744299d3b6b9bbce20ba0", "object_relation": "md5", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619066, "uuid": "94cf711d-4953-4ba3-9dbb-5e0a65b9832e", "comment": "Malware payload", "value": "e37f9b64dac65246982ad2cb922367dd56c14b618420207844e0a939a8e5dc9c", "object_relation": "sha256", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619066, "uuid": "bb9e71da-f910-4696-977c-0b0c49e4c434", "comment": "Malware payload", "value": "cb5196d7f1ddbee2e171772b4062aa10d6a635de", "object_relation": "sha1", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619066, "uuid": "bb19e523-7d71-4ed0-ae3b-01784a3ced15", "comment": "Malware payload", "value": "4e454d36060e52617a20324ceaa43712e19a6e947e5c07661d26849b39aeea2b6e9f23dccfa0d510c2a4a666c0946ec9", "object_relation": "sha3-384", "Tag": [ { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619066, "uuid": "b7bfc73c-f4a3-4d4b-9b61-bca056562faf", "value": "T1C486339B5D8E8737D132BE6B2E6CB8E7954D26CBF1531C09B722EEDF183A01454608D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619066, "uuid": "6cfa6330-2a20-4db7-a45e-b1cfd794a3f4", "value": "196608:Q4F78NvIdnBAu0NYWe9X9qDt4ry5ppRhQOGlH2zb20ytZgawWFBtRqFV0n:978Nw3AuKe9X+tdpDKdH2/hwZgUNqna", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765619066, "uuid": "ba7e9671-0a75-48e3-8ae8-ef42effc1296", "value": 8215454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765619066, "uuid": "9f2dd49c-9308-41ed-b987-ac0fbe979af8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619066, "uuid": "7a9e0d27-32d8-4bb0-995f-96c07ae87017", "value": "BluRay.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71229c0-d7ef-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765608474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608474, "uuid": "3dee44af-8826-42de-94d6-0508ad0f3468", "comment": "Malware payload (Mirai)", "value": "aee471d599e2b6e1788cc4cdb74dcea5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608474, "uuid": "4f4a6e48-8d2f-45b0-b956-fd4f36e73c5d", "comment": "Malware payload (Mirai)", "value": "e3a8fd7f5d9a6e83dfc33e73c25644fd8967c97e97a7dca8299d599ffd2faf17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608474, "uuid": "32e87d5e-fa56-49c3-b418-e2f66f3458d8", "comment": "Malware payload (Mirai)", "value": "9f1536bb7a0fe821314b24374cea1eecc4542d31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765608474, "uuid": "9c72eebb-c1c1-4d04-97d8-0f3616aa77ea", "comment": "Malware payload (Mirai)", "value": "55b9af24c71727da491f8eb7cfb6d6261763256655b2641095e67cfdf797f322310c4bc2fc79ae5f4d0611b854dcdf0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608474, "uuid": "674acf3c-7226-4d9b-b6a7-ec864bbe76c1", "value": "T1D283F90BEF705E77D89BCE370AA90A1225CDC60762653B753534D838B64B94E4AE3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608474, "uuid": "11c690cb-1414-4697-b232-9d70e03f263c", "value": "1536:4F6vGAM3aM+uhap/bJBhJmg7wSEGmTDJIlpTzr7eF:4F6vGAMwuhIzhDATDhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765608474, "uuid": "af908c35-0266-4b9f-b417-b171ba83b78e", "value": 86428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765608474, "uuid": "1cae0803-4836-44c9-8bca-6789e36edf9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765608474, "uuid": "4742d28c-6ed6-4318-83bd-96a1f951396a", "value": "n3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a934c8-d7ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Rekobee)", "timestamp": 1765607479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607479, "uuid": "0595f577-4140-4335-af82-7000a1752665", "comment": "Malware payload (Rekobee)", "value": "ef69bc9c2260d5123c32fa10cbf30583", "object_relation": "md5", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekobee", "colour": "#AE2445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607479, "uuid": "ad445c51-4f65-4914-8e7f-774b789d22d2", "comment": "Malware payload (Rekobee)", "value": "e3ed539264312df5181b6ca9d8cbf7b0473d4df89983fdcaf2be0d6b26b2f19f", "object_relation": "sha256", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekobee", "colour": "#AE2445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607479, "uuid": "789c1bfb-c558-4ada-bbf6-3e75a802a6ed", "comment": "Malware payload (Rekobee)", "value": "33990e1cfa1e6725873a5447d12f5e5e4de18bc4", "object_relation": "sha1", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekobee", "colour": "#AE2445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607479, "uuid": "9103be84-a59d-41c7-a8b6-fa76e82f36b7", "comment": "Malware payload (Rekobee)", "value": "fb1cc6b0aeb5e0b2a6e72a68db9724ed59f8414a8189c2f598f7f861095c47f52aad6aa30852255f6fb35bba18cb721a", "object_relation": "sha3-384", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekobee", "colour": "#AE2445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607479, "uuid": "89a19067-9435-49bc-a4b0-8551b2d6aac5", "value": "T164836C43B6668DBFC859C2304F0FA436A873BD58EF66321B34405B64392FB192F29765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607479, "uuid": "5aa9583c-d66a-4bc9-8fb8-67dff4b8913b", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS0:rVqxWUTnhhW+LOoq+xN/1Zx2o0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607479, "uuid": "84cedb88-a475-499f-a5fd-1394a7884728", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607479, "uuid": "5c6c0b2e-e27c-4195-89b5-6727111b09fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607479, "uuid": "45739237-3e46-4d65-b4b4-b1379665dbef", "value": "e3ed539264312df5181b6ca9d8cbf7b0473d4df89983fdcaf2be0d6b26b2f19f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef7bd49-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615628, "uuid": "1442af52-e2c7-414e-8201-7305554773b7", "comment": "Malware payload (Rhadamanthys)", "value": "dc221b67afc15fdc650b1a5ed390376a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615628, "uuid": "2b64f86d-247e-448b-ab2b-f2f79356a066", "comment": "Malware payload (Rhadamanthys)", "value": "e3f2b6dbd8b23c7b3b2215f0316021ad2f71c3723dfd18c76082b43cea194c5a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615628, "uuid": "2389ee7e-8ad7-48b0-b327-41637406805e", "comment": "Malware payload (Rhadamanthys)", "value": "89008e1226ca0527d546290a15c910bc45a8ada1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615628, "uuid": "008453b0-82d4-44ea-a10a-2447496d7b53", "comment": "Malware payload (Rhadamanthys)", "value": "723cb67e1afd4d069d8f750b5cd5be1fb7f07d11417f1af01737adad3e8cf591c1bfda801e8bc92b0e488b1419169233", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615628, "uuid": "60270adc-3245-4f31-b525-831e0d3c5be5", "value": "T1CAA3E9101502FDAE4FC5E7197FC03DBED56AE1C211187E91A11BF7A2D1BEE24285A0EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615628, "uuid": "8e693673-9910-4a6d-a038-d1476f434ef5", "value": "768:GDhd0i7J4sYKgY/CMNfWdZH7WUHWYa70G5DnD7uhNtNiON5uA6umh5G4k0q1n4Yd:GDB7eKg202jrnrs4k3VAF0A6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615628, "uuid": "fce4a230-04c7-4fc2-89bf-8d541be5294f", "value": 101288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615628, "uuid": "07c44721-a782-4402-bb15-b24afec7855c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615628, "uuid": "b5bd910a-0ef4-4fcf-a1a1-8e3079b802db", "value": "invoice-1637482117.pdf (73).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e50ed65-d868-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765660348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660348, "uuid": "36423ed4-cb0b-4672-adb9-504770e620f1", "comment": "Malware payload (Mirai)", "value": "7632ba1f6bb24e2c7f69c033efc6af2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660348, "uuid": "f2212b76-b975-412c-8694-90b018527456", "comment": "Malware payload (Mirai)", "value": "e47c3d77ab38f6c34fc4014dcaa0a7b0f78b808b402e81ca5bedea88aca83674", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660348, "uuid": "96b6ddf7-ebfc-418a-a288-4474b932ed05", "comment": "Malware payload (Mirai)", "value": "d8caeebf90c95c4e2c918786d34b3459f9c7d3b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660348, "uuid": "91df4ce9-ed21-41b8-8031-2ee934c82202", "comment": "Malware payload (Mirai)", "value": "e72ba6edc71862de8bf8f69ec2c02e111f8b2eeaae1922caf1f0ac843c3695957071163960033830c49c66ef2b03ba58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660348, "uuid": "e9929dfa-a1d3-4206-8f73-bd2397535d4a", "value": "T1CD7312A472796DF9C8A18C3D76645BF86642152993E3FCFE354C0B3C63891C9278239A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660348, "uuid": "07986d82-440a-4d43-ae48-b949e220f4b8", "value": "1536:5yXwI1XrfrV8wvAjJPPEjLAPx6lkXAOlpBB7LwT:5Y7frq9lPPsdlkXAOlpBZLwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765660348, "uuid": "c6380615-3910-44cd-86be-36b8c2235bbe", "value": 74360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765660348, "uuid": "3e2760fd-a990-44bf-a280-7fd6843db129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660348, "uuid": "5e88da37-0848-4d81-aac9-f196cfc1c803", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8571837-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666593, "uuid": "c9af5d8d-373c-4662-b6ab-62e835e3b32e", "comment": "Malware payload (Mirai)", "value": "b24a126d362fea6ddc68b5581c8201bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666593, "uuid": "cfaed2f0-fd33-49ea-8261-dc67044891e5", "comment": "Malware payload (Mirai)", "value": "e4c2b70c6f37704d28ebfb4fdd1a7a9383847e90284b9b03db45b0d731650032", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666593, "uuid": "3e86d0d1-38b0-4462-8aad-9de6636741d9", "comment": "Malware payload (Mirai)", "value": "43206bf10ba1763c11b1b36da60c175820d2e499", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666593, "uuid": "8896b868-aab7-43b3-9074-5eb6d2e40103", "comment": "Malware payload (Mirai)", "value": "e8248f5d4000f362b205e555ac2aab0bee2141a784416012b1fc5bea2559d800e63c7cb21988cf572d50b384f09e783c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666593, "uuid": "ba3c93ac-d209-4aef-934c-f4d2e4888bef", "value": "T1C5833ACBA810DDBDF90EDA7BC4678F04B52467015F421F3BE666FDA3A9310948D19E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666593, "uuid": "99c63f0d-d735-46e4-979b-5a12cac69192", "value": "1536:mxr3YEom7EE1wS7akfGZX/Tpc8ubbSXLx6rgt235fYxD7TPBSZ:mxr32EEENak+lNkbW60t235gZ4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666593, "uuid": "026cd79f-fe9b-4d8a-865d-73bc69e693fd", "value": 81632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666593, "uuid": "f6527192-403a-44d7-8407-7fc6d6365a8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666593, "uuid": "4836de18-6273-408b-9459-2992529ad1f1", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6189797f-d877-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666769, "uuid": "b24814c8-d1d2-492b-9da9-9ea5ea77fbb6", "comment": "Malware payload (Mirai)", "value": "387a87b9ee2311e05384ac98f6d72c42", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666769, "uuid": "be40e3be-a4d6-4094-acfb-b17a57c4a766", "comment": "Malware payload (Mirai)", "value": "e512845dafd29d8b076013c28ad8a549a6fcd581ec34f47587209b350916473f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666769, "uuid": "ddf28578-0e6a-45b1-a106-f84f4e37f4a8", "comment": "Malware payload (Mirai)", "value": "137b23aace2d807bf7728244872da732ff4a55ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666769, "uuid": "dbfbb383-122d-48fe-8174-432349a737c3", "comment": "Malware payload (Mirai)", "value": "631bd50b6d08dbcb8d550176e3c4cb3873988d9fc25d11dad97b5c8d576c0c89c245b7cc56ff204ed7e4185cbde1ecf5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666769, "uuid": "b7c132cf-0558-47d7-afca-c9f71f7e4d82", "value": "T199639E72D869AD54C1584AB9ACF08EB81F03B100A7562FF76E86C9664043DBCF61E3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666769, "uuid": "92d98925-6a65-4872-9e50-d99de6468eed", "value": "1536:GaLwtx8qve3oWf1+fp+O9h3UFfw57YFsBC8z/uminv8VR:Gw9q834+EypW7ksBtSrnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666769, "uuid": "a02f65f1-36c3-4f1e-82aa-0ea3e040f98e", "value": 71468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666769, "uuid": "288e2317-3ab8-4bb9-bfc3-e1139a761793", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666769, "uuid": "4ff25992-3829-4acb-a5f5-bdf6c78b8b5d", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3202beba-d828-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765632759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765632759, "uuid": "2cff6534-b5ca-452f-a674-6565ea845732", "comment": "Malware payload", "value": "3dff2f2ba1b31bed0289491b6d2c3bb1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765632759, "uuid": "3168cd36-78d1-4a7e-b967-e6843677fdc8", "comment": "Malware payload", "value": "e52f45196be077ee4ca9521206d2e82e4e24bbec8c48777cc4c1d002283047a2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765632759, "uuid": "5cc07879-2fa9-4af4-a57d-db4c332d858a", "comment": "Malware payload", "value": "cbcc17ddda4f552d53e4291bf4b2bca61391e713", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765632759, "uuid": "e07db921-c42c-41c1-a39c-542554af1c55", "comment": "Malware payload", "value": "44ac6cdbc43771ef8725d1b046994da8b42b5dd88d50d39bc39092292984ad5199712d76dac618d643f703a3e154bb42", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765632759, "uuid": "7449f4b2-ae4c-4b71-a3dc-aa5831b8ebc3", "value": "T11DF3855A099B95615B8F3025132F2C0396CD95B78F8E8D807EDF9ECA2F115A4B0773E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765632759, "uuid": "ff7a99c7-aef7-493e-b6c2-fcd59229c000", "value": "3072:BIdSRdEXuqFfzXjdbgzchTcKOZWkD2/s2z9UO6tlEf:BIdSRdEX1zXBbP/qZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765632759, "uuid": "dd6a732e-8050-4e8d-998c-eeb2b931ce25", "value": 168055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765632759, "uuid": "f472dc3c-6a4d-4152-9f5c-276fe76684cb", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765632759, "uuid": "83b1bff0-5699-4836-84d7-ed9166035003", "value": "Family_Dataset_Temp_6688.jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1542f281-d87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668359, "uuid": "10677ffd-3578-4100-ab8d-61f97b6014b2", "comment": "Malware payload (Mirai)", "value": "d4640565ac1e31507b39ee63f32d3677", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668359, "uuid": "45660380-7c30-45fe-8e34-1edfaaa64e7e", "comment": "Malware payload (Mirai)", "value": "e542af2d0dc4810f599ede808fe5a20c71b96b07d2af31bca21543147de27c69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668359, "uuid": "b9953a5a-4f97-4356-8a4e-2f05b8e71906", "comment": "Malware payload (Mirai)", "value": "0389515319ca66842b0ddd5d197d9d120c0b96ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668359, "uuid": "715f101b-65ea-466d-baf2-3b0321d03c00", "comment": "Malware payload (Mirai)", "value": "28dcc1443ce79a14bcff621fe1811c3e8b93adfe821a6052cd52accda72f3c520bdcf215a5aeb3a58338ee9d69a04bf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668359, "uuid": "dba88980-5aaa-4c13-9412-52911c8e0d5e", "value": "T11023F1E025B61E21DB618A36DDBA4EC177A72FF850F412C72004A2F42586667777E2CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668359, "uuid": "d94a1117-5d09-4764-9b02-17511f0ae124", "value": "768:Wgh4abbtnlsqlHXrwvNf2ACn0IWPDrt3TBRnzHAkoX1qCZhzoH9q3UELHZ:ppbrscH7wvRTPNjBykoX1JZt1L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668359, "uuid": "62837250-811e-4978-9cc0-ad72bc74edde", "value": 46304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668359, "uuid": "eae5ac21-80a6-4645-b255-4f2d3ca2f23d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668359, "uuid": "26157530-cdfe-4e7e-8998-e1a88babe290", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19c71f1-d867-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765660005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660005, "uuid": "c623a1c4-3e45-49fb-b02b-c85d60e0c862", "comment": "Malware payload", "value": "30506ded912ce46c8698e6b35f3fdf91", "object_relation": "md5", "Tag": [ { "name": "01flip", "colour": "#A9E567", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660005, "uuid": "4bb6272d-d5d5-4c6b-ad24-e738ed698484", "comment": "Malware payload", "value": "e5834b7bdd70ec904470d541713e38fe933e96a4e49f80dbfb25148d9674f957", "object_relation": "sha256", "Tag": [ { "name": "01flip", "colour": "#A9E567", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660005, "uuid": "540acef2-8e67-4998-b79b-3c53275c0c07", "comment": "Malware payload", "value": "9d88b7a8d1f107a03350b85e9a5408cd5d03cb70", "object_relation": "sha1", "Tag": [ { "name": "01flip", "colour": "#A9E567", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660005, "uuid": "cfacf3bd-5543-4898-a16c-db9af92b108a", "comment": "Malware payload", "value": "02ec4903a545ed0c42d81bbe1df2ae210bc5bad0482330ea3e7eaa2913f703d4191a02a8ef212b9246493ee8e0d85d26", "object_relation": "sha3-384", "Tag": [ { "name": "01flip", "colour": "#A9E567", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Rust", "colour": "#CDE8DF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660005, "uuid": "59c84d35-5bd8-4ea1-bee3-39cd99c53a5b", "value": "T1F4159D1FB5A944ADD57EC8B0438EC5B3E72AB499111674273FE0EB203E23E609B5C721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660005, "uuid": "9ea27d1a-da62-45bf-ac2c-1ff32105199e", "value": "12288:jUa3wpcUh1eJQse7wZg/w8UtKfNitHo1jF5Vw34Wm6dbf6EnKzSkk0eEWGs:7/Y1bIQNio1R5m3fjZnKzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765660005, "uuid": "574346fe-0778-483d-bad1-848132f01219", "value": 948640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765660005, "uuid": "1fae0e8a-fa1f-48e0-9de9-6a27671a28b5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660005, "uuid": "71b026c8-5467-4d8f-827f-e4bc0af71da0", "value": "e5834b7bdd70ec904470d541713e38fe933e96a4e49f80dbfb25148d9674f957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52872582-d7ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Rekoobe)", "timestamp": 1765607474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607474, "uuid": "7776fdf0-79c3-4f5d-988c-5d6456a57982", "comment": "Malware payload (Rekoobe)", "value": "7b3906937994f3eff06d08d4c0fa8a57", "object_relation": "md5", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607474, "uuid": "526c64d1-4669-4715-a5f5-45c10d101139", "comment": "Malware payload (Rekoobe)", "value": "e6f73e0919bc69b64ee445164c1706f42147d6f81d39d0fd0d688db92ef82905", "object_relation": "sha256", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607474, "uuid": "9ddd76f0-4d2e-416e-b32a-120e012fc331", "comment": "Malware payload (Rekoobe)", "value": "6a7427d4005c0e1b9ec3b2ac690aa5abc72adac0", "object_relation": "sha1", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607474, "uuid": "368d0720-1e41-445f-be81-47d8e5e87b27", "comment": "Malware payload (Rekoobe)", "value": "aae72e18b184bce96980ca7a388514408f6bec808bbd68815075e8dacf3b5f039ec6367f8c5a0f0a38713d0c709842cc", "object_relation": "sha3-384", "Tag": [ { "name": "check-office365-update-com", "colour": "#04294F", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607474, "uuid": "e1cb5a4d-6352-477e-b9e1-d8903deb82f2", "value": "T1CF836C43B6668DBEC859C2304F0FA436A873BD58EF66321B34405B64392FB193F29765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607474, "uuid": "4776595e-1def-4306-bb6f-7429b929b131", "value": "1536:rV3T+Q0YNuV8NnUTnhhW+LUlP7oqHekyN/1H5xuM8VS:rVqxWUTnhhW+LOoq+xN/1Zx2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607474, "uuid": "4bc5ec00-5de7-45f6-911c-a59e3cb7ca98", "value": 86176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607474, "uuid": "a9a67fe5-74c7-4c49-b1fe-64d07d7b9b02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607474, "uuid": "2d933653-87e8-46a3-aa39-d7def53b9437", "value": "e6f73e0919bc69b64ee445164c1706f42147d6f81d39d0fd0d688db92ef82905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf08983d-d7ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765607226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607226, "uuid": "02ffd164-1e96-4616-b23c-6b42915f8f61", "comment": "Malware payload", "value": "9ad04bff8166acf87b6c2fbec7836e8b", "object_relation": "md5", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607226, "uuid": "1b91bc9f-7688-4510-b972-c8f54f0eef02", "comment": "Malware payload", "value": "e76867e7ec438165e2d629a0bfe2ae53f5320831cc1f8115b2a4f869f5240950", "object_relation": "sha256", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607226, "uuid": "6037a264-bc37-4238-bba2-91829ba40f91", "comment": "Malware payload", "value": "bfecfe1b206b170662f09df64c91d5fe7ce261b6", "object_relation": "sha1", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607226, "uuid": "1baa69d2-3bcd-4a32-96cd-a80622a68fcb", "comment": "Malware payload", "value": "8f0ce4cafe152199eb95966dbf7c9d12551251a694f8974e0e781b485249f761f9044a7ab013d52a9fb4ff202f74585c", "object_relation": "sha3-384", "Tag": [ { "name": "91-215-85-42", "colour": "#F13E4E", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607226, "uuid": "441efbd0-0443-4190-b290-cd22d5bfb312", "value": "T18F73E11AB201E622CC15B7758C97AEC21E30AC28DF63254634D6375C2E35AB0D77B6E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607226, "uuid": "9c96a344-92dc-4120-afbb-ff9f11ede343", "value": "1536:d7PYTNiZey1rh/m7VgXyKPLC9cpP81zuABcpobItBV:dE5ioMl/UENjCKR8EXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607226, "uuid": "a31376e0-6b77-4679-a4be-de4bcdfce29b", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607226, "uuid": "294394f1-8534-4291-bcc0-2a4eb9c85d19", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607226, "uuid": "2692c482-1b29-4c44-bc99-df2ba9be62d7", "value": "e76867e7ec438165e2d629a0bfe2ae53f5320831cc1f8115b2a4f869f5240950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5755ab49-d86b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765661598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661598, "uuid": "0572b80c-3d11-4915-92fb-1a5ac5aa94d8", "comment": "Malware payload (Mirai)", "value": "0a4da098390b714878fdfd616b7a0d65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661598, "uuid": "eba62470-c493-44d8-be87-e1c865b1cbc3", "comment": "Malware payload (Mirai)", "value": "e83d7c8472f4a4735abe0b843dfec38e881fda1dfb8c83032c83f00ef0198759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661598, "uuid": "a092d482-3226-4053-aa9c-58efae0b97e4", "comment": "Malware payload (Mirai)", "value": "abc56e9d73bc759f3c78a9dca619a1aefcb7e7d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765661598, "uuid": "96b6076b-6768-4669-857d-f8fa7fa37ea4", "comment": "Malware payload (Mirai)", "value": "f2e8eb3f4eae1868eb7264d899cbbc7dc7715914c8dbe89efe9321829efc62d68420b624a0179bfb884f997e9c829833", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765661598, "uuid": "284c3354-11c3-49da-9b5c-7881fb1c59cc", "value": "T1C3044C56EA418B13C0D3277AB6DF4245333397A5D3DB330699286FB43F8269E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765661598, "uuid": "83c6fa8b-4914-4015-96be-ab9a2365c59d", "value": "3072:x0uvcyJk0SEsawrSZaerlpnAOsgAdekxAi/G9KnSeRRM/9jOoxL:x0xyy0SzWZaerlpnAvgpkiiu90SeLM/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765661598, "uuid": "1d0d1d88-2756-41f8-abbb-a3c922045025", "value": 180541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765661598, "uuid": "f79c9cae-335e-4f38-8030-76d1943f0e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765661598, "uuid": "69d252e1-d1ba-4821-bbc1-227e3967c000", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1c029d-d809-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765619383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619383, "uuid": "0d61c167-de1f-4e5d-a60c-b58b8064ca7e", "comment": "Malware payload", "value": "e7a661ed304a67e7a6c001fc2daccb65", "object_relation": "md5", "Tag": [ { "name": "cover", "colour": "#1B1A83", "exportable": true, "hide_tag": false }, { "name": "fake jpg", "colour": "#0771C4", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619383, "uuid": "7bc1b8e0-b504-48e0-b76c-e0b8ac3b41d6", "comment": "Malware payload", "value": "eb6f2af66277ce88d8a50bb2ce9aee95b0705691dedca8fc4b92153f2cf4ad65", "object_relation": "sha256", "Tag": [ { "name": "cover", "colour": "#1B1A83", "exportable": true, "hide_tag": false }, { "name": "fake jpg", "colour": "#0771C4", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619383, "uuid": "bfeb8c42-5cb9-4c62-bf7a-82c16d126d27", "comment": "Malware payload", "value": "d5499aa93a1c894e895926c92c7a367fd82f31bf", "object_relation": "sha1", "Tag": [ { "name": "cover", "colour": "#1B1A83", "exportable": true, "hide_tag": false }, { "name": "fake jpg", "colour": "#0771C4", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765619383, "uuid": "0fef25da-e0a6-4a7a-bb14-a9ec6e06927e", "comment": "Malware payload", "value": "7b67097170dce5ead3d33858e25cde72b92ed6324ceb533b5deb928226979bbc1ad94adbd7c69b78598ea2937eafed31", "object_relation": "sha3-384", "Tag": [ { "name": "cover", "colour": "#1B1A83", "exportable": true, "hide_tag": false }, { "name": "fake jpg", "colour": "#0771C4", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "thepiratebay-st", "colour": "#9C667B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619383, "uuid": "926471a5-6180-43f9-8047-c3fcec27b2a5", "value": "T1ED3533A76B872B60C2FCCBF6CDDF28C526D071878AF579493E9C218A5CA6410877D348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619383, "uuid": "3cbe7591-e1c8-4edc-bf22-5b26092bd82c", "value": "12288:I5f9KMfnspqRq27sXC4SNhNjdCSBUPn2Y9mH1kShBW2H6vWB92N4+YjOR38GPUE0:Iyzpmq2pM2tVk2EuxU++LN2oJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765619383, "uuid": "c1f27f6c-0f76-4a22-a2bc-0dcceecd8d7b", "value": 1128292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765619383, "uuid": "ed10ba50-af04-4065-ae6a-b474e7e737df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765619383, "uuid": "af9600e1-f898-41a8-9774-6d0dad7c1b6b", "value": "Cover 1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac956ff-d7e9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605823, "uuid": "b9e0e1dd-fd26-4deb-aed6-773d8974a62b", "comment": "Malware payload", "value": "415eb63aba4c3e32b144f3dc81fd596a", "object_relation": "md5", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605823, "uuid": "4d47e369-7dd7-4647-b49c-274da27903d8", "comment": "Malware payload", "value": "eb7188ff8c421e9c7dbdf139080cb153b7758f752a2fea8d80939721a878f171", "object_relation": "sha256", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605823, "uuid": "c35de7d3-fff2-43bb-9b25-3de0d4c916f4", "comment": "Malware payload", "value": "6364215997b2ae419bf819adef4b1aecc24246f9", "object_relation": "sha1", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605823, "uuid": "e9846684-1b61-4838-858b-f7423222d49c", "comment": "Malware payload", "value": "23b3398be99aca096c1e1b6e450d07b6f6b86f9ac4a93c06cc45fd99ab7295600e1960dfa09d5b273cd05a652131b107", "object_relation": "sha3-384", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605823, "uuid": "ddbd948b-2885-480a-9e01-35269df3137e", "value": "T133C733B4514D4FC3CC8FF4BA19A1B7D4BA2E4910C022A6D07F4D12EE9AD6AC6D3B5C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605823, "uuid": "2736826c-4e60-4315-bb40-5101f7a98431", "value": "1572864:voIESA/nxii7dwUvEBXZbY8U6KrWMWFDGZGOK2hysewWkr:wIExjwDY8U6KrWxFaQOJV4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605823, "uuid": "82c255bc-35fb-4a14-b3b6-0ccb7dd84197", "value": 55372330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605823, "uuid": "b8a3f3ae-1106-4043-b1d9-dfb1021a5ac8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605823, "uuid": "10531d59-4d5f-4734-8c97-d17cd931cb62", "value": "eb7188ff8c421e9c7dbdf139080cb153b7758f752a2fea8d80939721a878f171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852963bd-d7ee-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1765607988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607988, "uuid": "e5d08d0b-198a-4be9-bcc9-385c5b52bf3b", "comment": "Malware payload (OffLoader)", "value": "0cdaedbe7b2241454672ce9a18a08815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wenzhou-Feixun-Internet-Technology-Co-Ltd", "colour": "#712245", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607988, "uuid": "70f28461-87f3-4883-8acd-08c94c46e3a3", "comment": "Malware payload (OffLoader)", "value": "ebe2e87f819335f56a9fe8188bc3e33cd0f8b279013fabb844507fea5a234616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wenzhou-Feixun-Internet-Technology-Co-Ltd", "colour": "#712245", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607988, "uuid": "0a6021d3-08b7-4b5b-bd1e-d41c9974872c", "comment": "Malware payload (OffLoader)", "value": "e5d660d785642294f1e19764043efaf4b1338d60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wenzhou-Feixun-Internet-Technology-Co-Ltd", "colour": "#712245", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765607988, "uuid": "515cc6f0-cdd8-47bc-9cfd-f3209cfd254f", "comment": "Malware payload (OffLoader)", "value": "4a62bd214159975b24eac7a676bf0c34f57549f25cba228cfbef0f61a020c3969bc0243f0224e8315da27bcf444c43f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wenzhou-Feixun-Internet-Technology-Co-Ltd", "colour": "#712245", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607988, "uuid": "b9e05203-8840-4c1c-b0fe-77eaaa294a7a", "value": "T1ACB6232372D9733EF46E5A375AB292104C3BB961A41BCC66D7E00C4CDF2E1A01E7E656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607988, "uuid": "a736fb19-a29f-4716-a790-d075e6b5dd09", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607988, "uuid": "260f7123-6787-425d-840d-3fd8f0e3de2f", "value": "196608:wOp08WeKFJ/wgocoCQMz1s1JAWKO0LOsShn2VFn6kNQrO7ijyPqrYNh:wqWfJ4HR3Jb0Loh2V3NIO7ijGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765607988, "uuid": "456e687a-69d9-45b3-b073-261ce89084e6", "value": 11409936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765607988, "uuid": "06ddde3c-808d-48d0-9019-43642b6732b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765607988, "uuid": "e59e1967-922f-4ebb-8619-5ae7b0dd3a78", "value": "ebe2e87f819335f56a9fe8188bc3e33cd0f8b279013fabb844507fea5a234616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db916d56-d879-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765667833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667833, "uuid": "392128de-4ae2-45a0-91c4-657062f84977", "comment": "Malware payload (Mirai)", "value": "3c3e067dc3d9b2a366e907d948ea5c48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667833, "uuid": "5eba9631-447c-45a3-a6e0-1895216e8bf1", "comment": "Malware payload (Mirai)", "value": "ecc9226e5d459ca62c4787f40a2b9e2ebb34324021c20f176af602142696ee26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667833, "uuid": "1714b2ed-79c2-40a3-9b3a-e9f109908ff9", "comment": "Malware payload (Mirai)", "value": "c215e2178e04073f586e5c8d553e22f3ad0aee8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765667833, "uuid": "66055857-c3b9-47db-bf8e-7dfadca0874d", "comment": "Malware payload (Mirai)", "value": "a0064fba6d830b26c00e96ddea40088a6dd6049216adb616fd37b871345261f314f3ea94c1ad3c22c9aab6ac50ccc33d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667833, "uuid": "b0d60f8d-07b5-4bbe-952e-278a7a0dc4c4", "value": "T11353E746B8918F25C5D413BEF92E128D33276778E3DFB222DD105B157B8A92B0E77902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667833, "uuid": "05be9c34-f438-4e03-93a3-9631a76178aa", "value": "1536:HRnhCIYvDBQPhKI/m+xd2qfH+brTM/ikGqT4FIn:rYbB1Ud2qRGqT4FIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765667833, "uuid": "4dce6b22-2985-49a6-97ba-cb3e109de9b5", "value": 62648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765667833, "uuid": "bee75e1b-ba4e-4f46-82c7-b4a35c6b5fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765667833, "uuid": "d2142d87-8617-4531-ae30-250d3d34004a", "value": "zerarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd3faa9-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615596, "uuid": "b1c373c5-068e-4fdd-81f1-8601301a2489", "comment": "Malware payload (Rhadamanthys)", "value": "4df11fe56937e7219fd7c30931025a5d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615596, "uuid": "d0147c01-0c39-4340-b7b5-a9b21900aac4", "comment": "Malware payload (Rhadamanthys)", "value": "ed9a27d2c5afef673bf50e21f0547a142a895872e4e643126fb1c9872c3a2b0b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615596, "uuid": "565fcabf-afd0-4cd4-aed5-f0b8adf72966", "comment": "Malware payload (Rhadamanthys)", "value": "ac5dde6611593225c7624054c1bf458668c7b2c9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615596, "uuid": "da32f3c9-f8e4-42d2-81eb-591bf5b112a8", "comment": "Malware payload (Rhadamanthys)", "value": "2b30062e5617513bbb61f722e22c02e35a7a06530ad7a3f40ebc9613defca221e3b5ca2a2f8de2f2dc9d692a1cb64fd4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615596, "uuid": "11f610bb-7948-47fe-89f6-c23fb91af2f4", "value": "T14BA30882DEB4DAB057C110AA5B7912D2F85FE13CA5CBE07FC457A32B50D6A08B1C59CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615596, "uuid": "7d2be5e7-1a25-49ca-8da3-fe7875350d28", "value": "3072:GDB7b099Ilf7SCPMe4CBQT768O2V52iw87iLYsHqepBiKXPmMPbDhr7ZWuJK/F9Z:0IZwvaWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615596, "uuid": "ffb197a0-23fa-4ae8-ae5d-8aa7984abbda", "value": 101366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615596, "uuid": "cbeb6fe5-92d9-4fbf-973c-f0aa047dbcdf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615596, "uuid": "fd1cd772-e0b0-4816-a935-d3c665497562", "value": "invoice-1637482117.pdf (83).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c70a09-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615931, "uuid": "51a7f014-d115-4457-bb13-290716d8432f", "comment": "Malware payload (Rhadamanthys)", "value": "a222e1fc044d60730e5b5cf5983ad68d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615931, "uuid": "0cd032ce-dd94-4ed1-b02f-a447b32c3f4a", "comment": "Malware payload (Rhadamanthys)", "value": "edd684ce3beecc69f82a8d40b868f14a3bec18d650ccc6d480b365f3a09bb2e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615931, "uuid": "bd8da094-68a5-454c-8e9f-1a57bcd60796", "comment": "Malware payload (Rhadamanthys)", "value": "607915eadcdc85515597df30bb086c5e5f49a15b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615931, "uuid": "f97f7975-4bfe-4728-9c39-267bf2714c76", "comment": "Malware payload (Rhadamanthys)", "value": "e301f9d512c6dfc5d36fcb0a7d3a249d200b1ac7241026f856d922115de9e81ffb1c2434db6cec87f5cec865efe3bce3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615931, "uuid": "ccc04df9-4285-499f-9643-d91b8744b251", "value": "T1D69309816B333EF3A6B56AFEB9C86AE0D11646318D42F0E405937750D98A6873EDD4C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615931, "uuid": "7a85017c-3a73-4a84-80e8-a9a7eb8283ff", "value": "1536:GDB7eKg200CfyxqcyHe4hLLwUA+T8L6AouDV+YQ3bPzjYFbYkgACCg1rWdWYrzwS:GDB7b0HA7PmU+6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615931, "uuid": "c7a4b566-bbdf-4a9a-806a-2afe717a3a19", "value": 96925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615931, "uuid": "c023e056-6850-4928-9279-97d96924632f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615931, "uuid": "0e17ff66-84a1-4fe3-90ab-cd9a1e7fef7f", "value": "invoice-1637482117.pdf (7).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52976a09-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605326, "uuid": "9230a6a7-3d52-43ed-90d7-d348235562a6", "comment": "Malware payload", "value": "4830ebf6524d48ffcb685abef0148657", "object_relation": "md5", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605326, "uuid": "ef51dfec-10c1-439b-817c-61792eae4dd9", "comment": "Malware payload", "value": "eddce7c8a0222efb4713660b2310a27e376eaebeb7a7b046478042f7ca2d7086", "object_relation": "sha256", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605326, "uuid": "f4f6a4a3-f221-449b-82ca-97713e8b6d9b", "comment": "Malware payload", "value": "bd3b6d7f1e350e96b80c9b97c5f2b79c0efc4807", "object_relation": "sha1", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605326, "uuid": "c951d9ab-453b-4797-a217-3ff084d986fe", "comment": "Malware payload", "value": "a9570810ae511d93fc03bb1eed674f43b6b60e9ef8448e35087093bf3d2b3c529237e4798e215cf8fe4342ef8c2c6715", "object_relation": "sha3-384", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605326, "uuid": "ee79012f-e422-4a75-8f06-92b9a97f0d4b", "value": "T14A86337ACA095C40C25EEEBD9C9DD960E6F26FC52C2312C175A2546D7C7F8600FA13AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605326, "uuid": "b0e63e4b-3a4e-4b0a-8a17-a4ce8a5a8732", "value": "196608:/ec6cscKitZ45YkFQ3M9BZAYtcxpqqNyLckJt3rNJMHhK2gJO1Ds:/xbKitWah3AfqxpjR0xJqJgc1Ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605326, "uuid": "fe29a707-72ec-4017-ac08-aa4afbedcf13", "value": 8030272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605326, "uuid": "55a50745-9247-4dcd-8ee7-8d29cfb1e210", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605326, "uuid": "2cfebd0f-c22b-4558-b8ec-670ba35ec64f", "value": "eddce7c8a0222efb4713660b2310a27e376eaebeb7a7b046478042f7ca2d7086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb3d46ca-d86d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765662652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662652, "uuid": "be57b7b8-d90e-4d82-be78-36fbfd6d12ba", "comment": "Malware payload (Mirai)", "value": "14c5a91999f2646b53a7fddf06d4a9f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662652, "uuid": "95cc5b1e-920b-446f-acde-4069e98742e0", "comment": "Malware payload (Mirai)", "value": "ede6272fbe317069598e1b37b896db31da557188a7d78e89493e53d23d7734f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662652, "uuid": "0fc7b9eb-4146-4bc5-b6ce-7af94ca2befb", "comment": "Malware payload (Mirai)", "value": "a50e0859cbea5b296b8b7c58abe5df513b90df07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765662652, "uuid": "c001dc25-cb97-48da-af48-50a0d79485d3", "comment": "Malware payload (Mirai)", "value": "322fff2a45291ed958c1198192ba3bb74ba12cab7ade9ba81f459c9e2c380768bb489d99d34eb2509ae01b9b59de1728", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662652, "uuid": "e0b21473-840b-495c-9e83-146bebcce03e", "value": "T135735CCAA408CC7DFD0AD6BB84574A11F92467017F5A0F1BF666FDA359332C48D1AE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662652, "uuid": "d17ea2db-667e-49e9-a313-7b0fa9d3097b", "value": "1536:IdoZxQoxt/EBs4oi8izUQJi8u5Zb+Tdp91t3tWETeXv7TPR:IdoZxQaE+i8izUck1k15tWETiv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765662652, "uuid": "f72e7bf8-ffd7-4bea-ad7d-ceaa60ee35d9", "value": 75964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765662652, "uuid": "4811e25a-4c68-4b32-865c-9c84f4dbf4a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765662652, "uuid": "62e61285-ddc3-465f-a852-b2bdb5d8ff54", "value": "nklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f522fbc4-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650267, "uuid": "f043f8a4-38d3-49bc-9073-db13eb76e695", "comment": "Malware payload (Mirai)", "value": "1d3dbdafc825409d2a03d73ddc93f47a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650267, "uuid": "baa7c656-6dd3-4a7b-9713-acdae6da4aba", "comment": "Malware payload (Mirai)", "value": "ee17619fdb9958ea06dc210a684037a2efc7d85ce8aa500c2083ecf5dd7dc7e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650267, "uuid": "2ec6ccdf-b8f4-4b39-91f2-6140e4d374f7", "comment": "Malware payload (Mirai)", "value": "7b58c94f84064b47164088d71cfb5f3c7e7a3cf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650267, "uuid": "3de71cf9-835d-4080-9f14-6a857c484986", "comment": "Malware payload (Mirai)", "value": "acc2bf22c46ec23412f2f2ba13d1514ecc0e6ca20cf5b10ad47ee76909c083a3315f9580afe6b2477435e6340c25c8e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650267, "uuid": "73123298-68c6-4b40-9a63-fb95c1c33ffe", "value": "T140F46B1BF2F370FCC197C13047ABDA62A931F46561216E7B62C8DA313E16E60271EB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650267, "uuid": "1d0f127f-541b-4f98-a395-ada4f490757a", "value": "12288:1OVt8q34k6CHsGFuOu9n3O05WyJoeLq51:1OVS04k6CHnoOu9n++f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650267, "uuid": "0dacf44b-b8fc-4692-8c12-e7170a6d81e3", "value": 731488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650267, "uuid": "9d2e2887-4ab8-4658-a635-f1396636a7b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650267, "uuid": "ed035736-b0ec-4cb0-9915-c0825feb74e1", "value": "shadow.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c856a7db-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615832, "uuid": "9d8f3292-f0d1-4860-84e3-5af67334cb8e", "comment": "Malware payload (Rhadamanthys)", "value": "736518de9d9be7be2b2f33c1634666ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615832, "uuid": "44b3a8d9-d88f-4553-b2ed-953128e8305e", "comment": "Malware payload (Rhadamanthys)", "value": "ee1a08d0da250a5686b55ada09e4186a9b6eecfceb87a90bc64c1f2d21f9f5bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615832, "uuid": "7bd63182-4f42-48d5-af8c-85e2a8295f95", "comment": "Malware payload (Rhadamanthys)", "value": "306c1e9926c3b7b2e7437b4882527fbd5c86137d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615832, "uuid": "229bc108-0428-4a54-95ae-57d107f08749", "comment": "Malware payload (Rhadamanthys)", "value": "8328a419f1b2dc79ade7565c5f88df30cde812882dcbfd9858984db211175e364278a00c72536dd5132a8c7fd4a14114", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615832, "uuid": "9dccef10-b23f-46a3-b312-b209637e2d47", "value": "T16FA3F9D15C4F79F015B039E64DC15CB9CCA9A7216E9BB10A4C1FF629A34DF482B6B283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615832, "uuid": "f09780d7-8724-4add-8ba2-9548713827f3", "value": "1536:GDB7eKg20gl+1+HrMrrzw+ws+wT+O+a+PAo+h+Y+WH06BkQWJ+aY:GDB7b0glcuinw2JTLDu+3ZH06BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615832, "uuid": "9bc4ac1a-a213-4b2d-81c7-b9990ff5f2c2", "value": 99475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615832, "uuid": "f4f74272-6fb7-4536-9d94-61dadef55a74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615832, "uuid": "7c51db9a-9815-493d-bebc-097491ee4ca3", "value": "invoice-1637482117.pdf (33).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514116e6-d87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668889, "uuid": "cbb37194-f405-435e-b313-975a39ebbf88", "comment": "Malware payload (Mirai)", "value": "83841553d71930797b813707c21c8fd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668889, "uuid": "f27c28f6-98bf-4bf4-ac34-eb6b09e4a17a", "comment": "Malware payload (Mirai)", "value": "ee68481763a4d960d57207806856eb7cc57a9d3f47ca28495511faeadce2813e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668889, "uuid": "1949aa7c-7ef0-4afe-b91e-dc0be5077ac7", "comment": "Malware payload (Mirai)", "value": "e1acc68758fbcb847b60ed6eda3e849e9ce4790c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668889, "uuid": "e2ce8eaf-500d-4307-9e08-b2673ce69327", "comment": "Malware payload (Mirai)", "value": "c1e05ddde67636e588bcda4b0acbcbc0c09bfd34c90002308ae1083b601a4df0a73565dadad0d7a86a80afd82254089f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668889, "uuid": "5dd79955-94ed-49a4-a4c6-a1698a4d05fc", "value": "T1ED533AD3E804ED7EF88AE63BC64B5A04F131B65059410B23B776F957A9730849CAEDC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668889, "uuid": "9bb0ee9a-5821-42d3-a37c-62e90c5d7788", "value": "1536:zOEd+0a1EhhwE3+c8u2zEUJopOCsQ23Daz87TPwV:yEgV1EhhwEutnogCsQ23ewoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668889, "uuid": "34ebf969-2efb-4029-aa30-ad662978c2e5", "value": 62824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668889, "uuid": "8f6b4ab4-fccb-42b2-ac19-b6d62106b6a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668889, "uuid": "926cbaa4-fb5e-4fa2-b0da-9262f1190576", "value": "nabm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f9beba-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613165, "uuid": "6b2c1c7d-25a0-4e50-a9c1-d230bfc22355", "comment": "Malware payload (Mirai)", "value": "4d63d9736774c925aca7cc41aff3936c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613165, "uuid": "3a73cebd-db0f-4963-8652-f4f9c0731c96", "comment": "Malware payload (Mirai)", "value": "ee825510867d6535fa1e6d2a2d0c3cdfd7503eb507f3d345892075f4b7b3e88b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613165, "uuid": "805161c9-1a5d-4a32-bf80-7bd0f3e9207f", "comment": "Malware payload (Mirai)", "value": "d7b0a3cea862bf1cb39131834ea02f93f56068c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613165, "uuid": "62b72a24-3c1d-4539-a10f-e0f63b0908f1", "comment": "Malware payload (Mirai)", "value": "e3573ae6acb0f671d1490f1bd4daa318fc2b4a77b4b4d85c78ee47a0e6a17c584b0906813b97b095041928fbd6a383f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613165, "uuid": "54b20bf0-5b47-4140-bbca-1d7adb8d9dd9", "value": "T121330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613165, "uuid": "5a06b022-bb72-4adc-a410-175b58cbc0d6", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGE:r/hqaJMcjeqK806MHdMfQXoHuCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613165, "uuid": "1e1dc1ef-e56d-4cad-8037-ae09bd24e0cc", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613165, "uuid": "15c3bcee-f38d-4fef-97bc-26b313ea48d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613165, "uuid": "bbd22ae7-7a9f-4777-a7d3-21ec391bdbdb", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a666afd9-d7fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613627, "uuid": "236cff46-cd32-4f84-b994-6f365c010352", "comment": "Malware payload", "value": "3fab4877ff835864fd66c7b3cf1b3d5f", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613627, "uuid": "96e1a2de-2455-4cb1-8b6d-0b97f178c65e", "comment": "Malware payload", "value": "eeaa87c9a844002d35868e63e2b52c00e3b6597af063ae32dcf879caa0c4c69d", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613627, "uuid": "e741abd6-3bc9-4a67-b336-f039c03e697f", "comment": "Malware payload", "value": "6b060cd5b095df54f7e58cab454dc5c1adf99ca4", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613627, "uuid": "fabd58f7-b98d-4e45-b9bf-78dccafc339a", "comment": "Malware payload", "value": "06293b7e02da0bab3c81535c3186232861ea32a842703d6e0e03fd8c7511470d7e911f1aae158026ddf48f3f51e5767f", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613627, "uuid": "5257b4da-d1b9-4cd6-89f6-c820ee883aca", "value": "T14B43E05DA08114BEFA16627753413A5BF7ACF5878233A90225322A7DCAF70C9DA9C706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613627, "uuid": "a9707a0f-21aa-4d63-bd1a-437a2787a387", "value": "1536:/mhJSGUkbPVhPwTmSypn4C1nYLOijq0xzLvG9KNrwgQyD2zerj:/cSUbTwXyR4Qn6PzzzGKMqX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613627, "uuid": "6d996efa-667a-4bbb-a2f8-9a73c14afd95", "value": 60240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613627, "uuid": "b615dfa4-639a-4b7d-8973-82a2f6084c1d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613627, "uuid": "9494c83f-b10d-4fcd-974e-7fc3683926b1", "value": "eeaa87c9a844002d35868e63e2b52c00e3b6597af063ae32dcf879caa0c4c69d.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0626bc73-d871-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765664039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664039, "uuid": "c41879f5-653b-40d2-b24f-5bc967d9acc7", "comment": "Malware payload (Mirai)", "value": "e3fdc9b4d99cb91a5c767c79188259ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664039, "uuid": "d41c06d0-3e69-416c-a0f5-43cee3eec357", "comment": "Malware payload (Mirai)", "value": "eed7c52ac85867006c8f7a291e335d6f636cf78278c8666ff6ce62f760a0248c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664039, "uuid": "ad71d0a1-3886-4b70-ad2c-7e46521c2aeb", "comment": "Malware payload (Mirai)", "value": "e8ef1bbec9fc85255e1505ec495afb2dc68a7c86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765664039, "uuid": "81283f87-82ff-467c-a6fb-a575edb4a6ee", "comment": "Malware payload (Mirai)", "value": "71d36d545afa8e2079cfb616be2a0a53885c48f158b091afdc386929707343760a7a1ea71a8168df8fc52af651cadafe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664039, "uuid": "03072320-aabe-4aa1-a7a4-9944935f1d08", "value": "T13513F16707D47988F524A27F5CEEA81E7C94FD8F59D345E923805103EA86F9416243F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664039, "uuid": "04b13960-4619-4db8-a933-f4ffd96df869", "value": "768:O899GL0D0A60HS6TOeRW0imlp4Kv0UhWjhX6xjd4IWW2D+mtnbcuyD7UHQRjX:O89sYU0ycR4spt9hshq3WW2D+Inouy88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765664039, "uuid": "de791c35-0f66-457a-b2be-4320bd8a0666", "value": 43140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765664039, "uuid": "97382949-c83a-4fac-8400-f391597dd6b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765664039, "uuid": "77c2979b-13b0-461e-ab4c-6220d6337e8e", "value": "x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3a722a-d7e9-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605639, "uuid": "8ddc6098-dbad-429c-bbb2-b9acd16e1ae8", "comment": "Malware payload", "value": "419950d1a68f98117eabb62deaf29c6e", "object_relation": "md5", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605639, "uuid": "4c240d61-3ac5-436d-acd0-bbf5759161e1", "comment": "Malware payload", "value": "ef1325e7df07db9b2701f873fb06fde9b6d0923042511ef6ceaeab9a80d530fe", "object_relation": "sha256", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605639, "uuid": "52c77c83-4569-4b37-8271-6adcdf1b9008", "comment": "Malware payload", "value": "cc2120406f87b832e23d4f5ca85b6147f9e0a959", "object_relation": "sha1", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605639, "uuid": "43b77798-cba6-4ae4-9992-bf250a05c725", "comment": "Malware payload", "value": "f45b756a4ae6074d918beefbf78d5ceba1fbb0339ab21b98a5ff74ead27f9ae2b298c40a91ddee2aaf3905b02b1b54e7", "object_relation": "sha3-384", "Tag": [ { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605639, "uuid": "e4ef8ed4-bf64-4cb4-85fc-2ff4c143218d", "value": "T1A40733F4D8B891D9CC9FE978C04A6F24E26B1D923E139D8875103627F74A501EB36F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605639, "uuid": "9e26fd1b-a0ea-4947-9015-303a76f1813f", "value": "393216:xcbiv6X/xnpt9aKXqweeIJpeMRJuNT1q6A6fpA0UD5GnkdDwaidOMrllv1Yu:xc9vnf99Wqqh6xgD0lNYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605639, "uuid": "df3a46b9-6a88-46bf-a06b-82a7c2796327", "value": 18135925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605639, "uuid": "60c3eee6-b109-4d00-8007-b65544aae3f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605639, "uuid": "561c43ad-1ec5-4039-987a-a3239c40482c", "value": "ef1325e7df07db9b2701f873fb06fde9b6d0923042511ef6ceaeab9a80d530fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05e40e4-d87c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765669076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669076, "uuid": "092b280b-9530-4929-af2a-213548a4b953", "comment": "Malware payload (Mirai)", "value": "2819bb3b7948e70aafa6d43f1fbc9448", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669076, "uuid": "f8e75f99-02ca-40f0-9fc8-8380d07b7d4f", "comment": "Malware payload (Mirai)", "value": "ef31846f8d265aafd1270df025c64b31285a00ec361a51bbd5ea87677e073502", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669076, "uuid": "d52de15b-fddb-4d5b-af93-43d1664df794", "comment": "Malware payload (Mirai)", "value": "cbaf41a395f10e26234f9f2828d7bbc9f1aa3a07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765669076, "uuid": "6fec7725-9794-4165-94f0-5526cc70f39e", "comment": "Malware payload (Mirai)", "value": "f1138bc93bf406bd2828bdc4612687ed9e0b0812d071dbdacb252b5cf0e57f2126d64af4d90d92122819c4f7aabe3cbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669076, "uuid": "c8f660dc-fe15-40cf-9a5e-e7e87c0d8869", "value": "T1AC13F1F7527FA1B0C876F4718C096604D9B96807B8992FDF4EA5B1EBFA728841135DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669076, "uuid": "211361b8-3cec-4eb7-aa41-d1a1de7a6a93", "value": "768:d/oKd/38fWybwPiEM/LavbGAqoMZWqWBfb5SwC/Ay6osn9wFJPK6Cs25x0rzN:11h3wXb0WaqoMZOyd9/SwTPK6XSgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765669076, "uuid": "8cfc09c1-87d7-42e1-95cd-752a3c5d36b3", "value": 44460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765669076, "uuid": "cd1f6bd3-b47d-4a2e-989c-5b6a217983aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765669076, "uuid": "450a143f-70ff-4d88-80af-9ff3882549ac", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f340d1e7-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650263, "uuid": "bad7391f-037e-4eec-99ed-aa0cba988ade", "comment": "Malware payload (Mirai)", "value": "65be7208373db659bf9557e78059ece3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650263, "uuid": "2d552437-bdaa-4259-940f-73c8c78ced66", "comment": "Malware payload (Mirai)", "value": "f04469059aa4eea48c369184ce565ca918401c22a3f83c0de986cb3a5f9a27b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650263, "uuid": "bbccc8eb-35f3-44a5-9ef6-79b34425c713", "comment": "Malware payload (Mirai)", "value": "b077b1334fefe410a8a8628bbd016cf37e6fdada", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650263, "uuid": "b545f6ec-149b-4f46-830e-6309936343e0", "comment": "Malware payload (Mirai)", "value": "78d1bcc5230f975013faed057e784c6a18a9ae45f90667fd45da2a9272b80e970e7e2264d8e45e479d5cfce690172c27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650263, "uuid": "ffe4224c-254e-4ed9-b2de-723ba9319475", "value": "T1D0F45BC6F7D3D0F1F55301F0205FABEB4A31A127A057DAF6E6841A667860B925B0B32D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650263, "uuid": "4fa4cf9b-1c2c-4597-a884-6079f1361a77", "value": "12288:FK0amflGg15USX0hAjhpXAM7bbTfYNvgrnBdv/mFKggyIpJ5LerVt:FK09lNfUO0hAjhiM7jYNvgrBdm8/jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650263, "uuid": "74347d11-93e2-4a1a-b033-d999466a9d84", "value": 730884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650263, "uuid": "85ea5335-9d0d-43d5-8a82-72b1c25425fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650263, "uuid": "069126d9-d7df-45ba-9034-ed89a6d9b8c9", "value": "shadow.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a68c402-d868-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765660395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660395, "uuid": "b5b8b703-c1b0-490d-b677-a5abae784089", "comment": "Malware payload (Mirai)", "value": "6041c62b50f3b154b3775c5c70c81cef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660395, "uuid": "85226880-e6c8-4bde-a01b-a13138b10c6f", "comment": "Malware payload (Mirai)", "value": "f0b3821d822f475b2d43e7d2f75ea1019eae594e3c5197e0be2ae1e5c7ea5fc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660395, "uuid": "1ad38e40-53d6-4a87-8d8e-7bc39ecb753f", "comment": "Malware payload (Mirai)", "value": "46c5800c8561132672e5e0f6fe49c19bddf1b8b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765660395, "uuid": "a9a9a417-04a7-4c4f-87a3-c49f50be07f5", "comment": "Malware payload (Mirai)", "value": "22c5b3061e1a9e59e57406f94558db20467e53b02245e97dd09671367cdbb0003f93278ce635ff6709193bbbce9c4a26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660395, "uuid": "4d8778a5-9050-4525-a090-1790afe348a7", "value": "T19A242B43F9518F12C1C212BABB6E418D37136BB9D2EE7202DD246FA037868EF0E76555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660395, "uuid": "9a6a28bd-8d7a-4610-8238-023273d29ac7", "value": "3072:Y54Duln/+3Ro2QH5pSXigRca1oqiQIgjq7q5rIRpj6hh1kZRNx+:YGal/CRvcWXigya93q78IRpNjNx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765660395, "uuid": "ea81bb90-331e-4a98-b228-8ab73d9c962f", "value": 213012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765660395, "uuid": "709b5945-c08e-4e35-a447-7c93d5babb0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765660395, "uuid": "233454d8-b300-4bf5-880c-a938b61026b7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758df4f5-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615693, "uuid": "9e90b704-470f-451b-9a87-be5b98459940", "comment": "Malware payload (Rhadamanthys)", "value": "f4cdc533640ab977271f19e4a23168e2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615693, "uuid": "b9876c72-af6d-4ffa-934f-3082010192f9", "comment": "Malware payload (Rhadamanthys)", "value": "f1010b00f001c034735d936676904e0ef7c2c440def4a5d0f48de5b39fe3f5c0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615693, "uuid": "c7b5770c-c8de-4b70-8d2c-3bf3f8a4db66", "comment": "Malware payload (Rhadamanthys)", "value": "c07a1488c0aeee32464ae59316d5bc7554276a45", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615693, "uuid": "858bf944-6a2c-42a2-8bb5-81fc4e1bfe98", "comment": "Malware payload (Rhadamanthys)", "value": "9183ae8493782e016a5cbab0c92331661d07b0349a65b0a2e0e48ad2ad65416b246957d823a49209b4eb68d599eba91f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615693, "uuid": "71e63826-4f4d-4737-bf97-05f1ed007174", "value": "T17BA31B1925372DE87763B6F11BEB21B4A07AD6018E2916C0B526B6420ED3F0D4F4D7EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615693, "uuid": "2131d5cc-85f5-4620-b948-f706f01803ca", "value": "768:GDhd0i7J4sYKgY/CMNfWdBkk6rXSnrhFX6aIHHgS8IAvbs1YikUn4SLAuAAroQWK:GDB7eKg20wrOrhFK1/AOds6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615693, "uuid": "134a2cb4-36be-487e-9493-1335137ab661", "value": 100740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615693, "uuid": "db2ab5ca-2e9a-4ebe-990a-91b40b910ebd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615693, "uuid": "c068e316-8990-4916-aa4d-e7294aa79e09", "value": "invoice-1637482117.pdf (63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf99246-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615866, "uuid": "8f22636b-3c53-4a40-a751-b61c71109c9a", "comment": "Malware payload (Rhadamanthys)", "value": "dc2019258e2a22d63dc186519533bf71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615866, "uuid": "97c6bdf9-90c8-4a76-bf64-d548b614db8d", "comment": "Malware payload (Rhadamanthys)", "value": "f1842738ab2c9365619c04c37c7903b6c2439fa00f61b915d0201579b2b5dbfb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615866, "uuid": "77638b93-4625-41c0-a000-f8c74cf50adb", "comment": "Malware payload (Rhadamanthys)", "value": "1c830eb66d99b67112814e156c1b3b4f8fbbac42", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615866, "uuid": "5949d26c-3f49-4977-b2de-bee316c91bf5", "comment": "Malware payload (Rhadamanthys)", "value": "b2e952f87d45a7bb5fbdd9bb15e23ac7c9a1cffe33acdb556566e7bccaa1b938ba8295e87119208471073a22e94f85bf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615866, "uuid": "0e390c93-3732-4c9c-bcff-759980b443be", "value": "T191A319C5AC42ACF4058710A745C437F1AF9A0A1C3A2691F5E3772F501888F3BFE996E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615866, "uuid": "b9aa8e5d-aa51-465a-9e34-44373f73e10f", "value": "1536:GDB7eKg20fjXkQCJlTgQ92tNrXQ/xPvZnVnpmZ9rFIkDCkQBkQekzEwlrtXq9or4:GDB7b0CDXKgUW6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615866, "uuid": "7a8b0bf1-8b98-46ed-86d6-acdbca4be01f", "value": 98058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615866, "uuid": "66adc150-48b8-4da6-b10a-13d6cfe374a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615866, "uuid": "e057cc4c-c5ad-4c62-a78d-74d528e85578", "value": "invoice-1637482117.pdf (25).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7675ed94-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765616124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616124, "uuid": "83357fd2-b984-4927-ac6c-fc789ca8c022", "comment": "Malware payload (Mirai)", "value": "922f93406f8aae557fdb5b87478c9443", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616124, "uuid": "9b1711a1-a561-475a-a13a-467ff86aa0a6", "comment": "Malware payload (Mirai)", "value": "f1a19132e8a268a2a2c80e2db753861177427478be27448973992e1fc9f07325", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616124, "uuid": "1af307e2-1e9c-4c51-ba6b-ca6aeb3d3616", "comment": "Malware payload (Mirai)", "value": "ca3d90297c3fd3ad3d1ded9c1b287caff422f8d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765616124, "uuid": "c0b716d0-a5c1-4147-8263-ef46e936178e", "comment": "Malware payload (Mirai)", "value": "0a40bf6c54709427402d6e5bf311f28a962fcf871e61e883170be66c4df10108bc069e500138b55fc7aa90bace0e9d08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616124, "uuid": "81720efe-6aa4-4830-99c1-b1f0ce95f7c9", "value": "T17BC3E799B8819E22C5D116BEFE1F52DD33231BB8E3DE3207DD156F2436CA91A0E7A441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616124, "uuid": "bec880b7-9b71-45e0-acf4-8c7e4961870b", "value": "3072:QJ68tJqtJfZhX2p9QugEYPRd82tx24MSJKYXirQktnP1qn59:QJzittZhX23QuRYpdfYjXYyrQk1c9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765616124, "uuid": "58a267e1-648a-4d34-9a89-3ed8e45369a4", "value": 124184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765616124, "uuid": "ca05acef-c71d-45ea-87c2-62ec76b0c1d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765616124, "uuid": "3869ce1c-9c27-47be-80f7-64f96492eded", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37b9fbb-d7be-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1765587557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587557, "uuid": "43b1663f-f0fb-4e25-a187-e47b8fdf2b3b", "comment": "Malware payload (AsyncRAT)", "value": "f54fc4d1f234afb6fd5e43099e39ef92", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587557, "uuid": "d70cb54f-3f3e-4061-9a6a-f07761b34aaa", "comment": "Malware payload (AsyncRAT)", "value": "f1d19242c06d094e74499da5be564a40d0a217c56007591647c8cd309c0a7d33", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587557, "uuid": "71e0c053-096b-445a-805b-fba3afe1c138", "comment": "Malware payload (AsyncRAT)", "value": "026693d8a3af426462f9904b5bcbaa962a30df5f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765587557, "uuid": "c33e855a-aa0c-45cb-bdef-eeed275dd92c", "comment": "Malware payload (AsyncRAT)", "value": "41be7a775fc2506448ac1393e7523379f57ee8be02620e1966089983ded023c38413fc3164961b5aafc747890dcb93de", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587557, "uuid": "1a6e73d7-342b-4b00-a7c6-11627d087fe7", "value": "T1C7D3E7C026848C9DF5590EB09DB576C006B58D731012AEC96C8834FB5B7BBF6D6336AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587557, "uuid": "7841172a-c97c-4619-9f9e-082a22ed52f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587557, "uuid": "f78b6897-0baa-4ed4-8631-5c8fa976be32", "value": "1536:tJ9V/upaCkMhA1v58VTGbb8wnQblGU3xpdiINS8VclN:z6paCkMhApmGbb8JFdDk+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765587557, "uuid": "c7dd6da3-95bc-4467-b78c-4be930940533", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765587557, "uuid": "5fc810cd-cbd6-4d69-b860-538bc46c8746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765587557, "uuid": "4b5f92eb-372c-4e7e-8ec8-8d3bfb09fdef", "value": "update_version2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4df58d7-d7f5-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765611101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611101, "uuid": "1977ee27-d5c9-4cd3-af5f-49630a7eb3fc", "comment": "Malware payload", "value": "7eba3dcefb459dbcca2e3c6a3e9dbcbd", "object_relation": "md5", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611101, "uuid": "6f783175-3571-4daa-bc5d-4db034aac60b", "comment": "Malware payload", "value": "f2592ce0dd019d0e1b1abfb341fd5ea8b8ca26022c519c2b3310b038daf3f3f3", "object_relation": "sha256", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611101, "uuid": "8b177a55-6ee0-4b0d-93ef-1d020090b6e2", "comment": "Malware payload", "value": "2490dd365a1bc3a7657e160f95d17397fc867d1d", "object_relation": "sha1", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765611101, "uuid": "cb9631dc-c266-4fd0-8775-7415702ab5a8", "comment": "Malware payload", "value": "4b87eca273d782a9607bbfc47b4d9b604b3eb238390f0b237ceb623195ac78eacf48071d38d4cf2fb74c0941a9a53f4f", "object_relation": "sha3-384", "Tag": [ { "name": "backupallfresh2030-com", "colour": "#76B081", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611101, "uuid": "6515c8de-6397-4fd5-b173-d97b3d26d0a7", "value": "T1DAC08087458955695947C3D51055DB99D54D9505D1969442137284A0E4971DC814C3CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611101, "uuid": "23013c3b-75ab-4fba-8cb2-816b3fd4e5bd", "value": "3:TXT2rGjCMeasGSHCMeasGSeASZJWOe6khROrSLkueDXBiGRNQrhXXQ9i+2O9221P:P2ijPeanSHPeanSKZJb4uGLkue97NQrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765611101, "uuid": "63b04650-4d60-418b-9035-9fcfb97d194f", "value": 169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765611101, "uuid": "c788caf4-7bda-459e-ae90-a910f7bc45ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765611101, "uuid": "a76464dc-44a9-49a7-8909-0733913cb778", "value": "f2592ce0dd019d0e1b1abfb341fd5ea8b8ca26022c519c2b3310b038daf3f3f3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b522f2fc-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615799, "uuid": "44d6014d-572b-4dfe-a5ef-8cfda9eb1143", "comment": "Malware payload (Rhadamanthys)", "value": "c6ac7259ea462055a40d129ca36f05f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615799, "uuid": "5672da85-a49f-469a-a3a2-2ff6e1d78b8e", "comment": "Malware payload (Rhadamanthys)", "value": "f2ccadd915c71a798259049ed91885055c31f15755e0cc34b6f426f0a5c3d0aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615799, "uuid": "045c92cb-928a-489c-9807-5bc9f8e2c35d", "comment": "Malware payload (Rhadamanthys)", "value": "12d65d995f6b945b6b6aa66100300939fe701594", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615799, "uuid": "21795057-51e7-4eeb-95f8-2ad3b6c4e495", "comment": "Malware payload (Rhadamanthys)", "value": "f6bd643f38d8acc79868f8a2c922f9d111ebf0deecbe8590ad37e72c8660bed313adaccf26a6850142940b9b45f78bed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615799, "uuid": "4787e3c5-bf8b-40f5-beae-718d5dcccc14", "value": "T1E3932A88BD7175D22135EA992CDA47A8A93F7CFE0A04C597EC6FE210107D7259C60ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615799, "uuid": "dbe3b6fd-62dc-43d6-b07a-6f9d55c6ecac", "value": "1536:GDB7eKg20Ezr7rK4uniNAv8t6BkQWJ+aY:GDB7b02Hj2iI8t6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615799, "uuid": "0fd749d1-c18b-4c9c-9da7-9fe7982327cf", "value": 95480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615799, "uuid": "4dfd9f66-4035-444b-a7a0-51696dfe79a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615799, "uuid": "891e5c47-b4c6-4b98-bd30-73a328397904", "value": "invoice-1637482117.pdf (39).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c10f43-d7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765612195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612195, "uuid": "84fa68e2-fbf5-4faa-ab2b-9d22fb712c4a", "comment": "Malware payload", "value": "fd2af417eb7eebd7c62ea64c7d971cc7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612195, "uuid": "51562703-56d6-411d-97c5-506d6d34811b", "comment": "Malware payload", "value": "f2fdbad34df5ef7fe74c6079e0b090b5148ee88379a077d94670eb52880b4bb0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612195, "uuid": "0a6bd142-51c9-4720-897b-97a16161d58a", "comment": "Malware payload", "value": "c48c2a41986856499de44750bc880dd9e0dbfc61", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612195, "uuid": "7a603455-5e0f-4c79-8306-f1c6de844e82", "comment": "Malware payload", "value": "0d25e8b5094971207528e4eff0cd899fc16412183086ebf710e0563fa4d04270f6805e4997cf5b609c8d12322b1cdac1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612195, "uuid": "b77173fb-8eb3-4465-b6f8-d6906522eae1", "value": "T1F2A1E3C9FDB173B34EE4DE1DF2A6862F708AA090A1215FA436CD70FD74EBD44AA01255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612195, "uuid": "2ed3bbff-304e-4143-babf-6d7fa7478cf2", "value": "96:1xe/eMe1jewe6ceGeHXXkZsqM3dRiPiwi17i8i6giKiHXfNK1xu66EHXNnxPRvBe:mmb1inAVHXXkZsqM3dRiPiwi17i8ipin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612195, "uuid": "6e400f29-58ea-445c-8130-51764ce2b64c", "value": 4807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612195, "uuid": "c3580e0a-05b2-4d6b-bc11-d8c51219fe71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612195, "uuid": "579787b3-6641-4075-a305-1c2ed5c74c6f", "value": "q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b86c53-d876-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765666422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666422, "uuid": "09d44e29-fbc0-4f7d-8ab2-a0aa9d6a166c", "comment": "Malware payload (Mirai)", "value": "6d84d74e3812b64917531017327c62c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666422, "uuid": "2c884ccd-71c0-4df6-92b0-422887abf2f8", "comment": "Malware payload (Mirai)", "value": "f4120dc9c20302a27ad8a1e462f9ca34b6693ea066c65d46a43ff8f73229c0d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666422, "uuid": "99f9d463-494a-4b12-95a6-a0e832398ac2", "comment": "Malware payload (Mirai)", "value": "e64dd8e150ab594e3e1e8a40a214152ecc4ffbfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765666422, "uuid": "3db823f2-7875-4fd5-bb71-3941ce1df273", "comment": "Malware payload (Mirai)", "value": "18e737578c3559b09566ca1e23cf550470875d749e73b3ad22afb204b7bf7b2278dc6bb35f23f1a67150c9fe9b2a1f58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666422, "uuid": "aa09474d-3b89-49c8-95e9-df89d28467fa", "value": "T11A83F846B8818B66C5D552BEFA1E41CD331327B8E3DF73139D106B257B8A82B0E7B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666422, "uuid": "a4f2253c-fc5b-4f9d-9a8e-1e0072e1a753", "value": "1536:nxnVavEc/9Ka01qGIkGLtvs6UGpEUnwAbcjM2iHp6yk18YI+7++Y2nv8VR:yEm9GUtUyEUSMp6yk18YI+q+1nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765666422, "uuid": "943d6847-de31-44be-85a9-11c4af35690e", "value": 83128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765666422, "uuid": "66a052ff-ef54-4dce-a5c1-d9c0adfc73a5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765666422, "uuid": "202436b9-d6a8-41d5-855c-048cd6f9371d", "value": "nklarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdea37e-d847-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765646305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646305, "uuid": "c83d5bd5-6b35-4b04-8e52-39a55ea9e6d1", "comment": "Malware payload (Mirai)", "value": "68986a15a9d043f61a7e4c1af26a2f92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646305, "uuid": "364a9d3c-793e-4c95-8155-ba11619fbbe4", "comment": "Malware payload (Mirai)", "value": "f429234e2dc4bbe6c69ba4f7d7061f6b523e9f3627f846519aced4f72c161e09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646305, "uuid": "4621b067-2774-411b-bd9a-91deee80f4cd", "comment": "Malware payload (Mirai)", "value": "498c8f785e1bdc6063bbadc0531b418a2d0a35f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765646305, "uuid": "f0e6392d-6e3d-4e16-99bd-1e94c1527079", "comment": "Malware payload (Mirai)", "value": "3db45cd13cc5b38dd2315d3b995765f9e16b8022299f1e056da41b9a6346fe43c92fef153cd2cd14a0bb245e40645a67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646305, "uuid": "a79e5d3c-45b5-41c7-92c4-5e7a90a8dcf0", "value": "T16093E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646305, "uuid": "d2e27fb7-08eb-4c6f-9951-5ca9f45ed1a9", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8Un:8+tsCurVDN+ouw8L1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765646305, "uuid": "f91b22d3-5597-4ee1-8a99-5943794e07cd", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765646305, "uuid": "111f2271-fca4-400d-a995-2606c4da12ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765646305, "uuid": "83c0e1af-2b5a-4868-8c6d-5d40cb8a631e", "value": "frost.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a1e35f-d7e8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765605257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605257, "uuid": "de027b1e-b699-41ad-8ea2-4cb93f7a8ba6", "comment": "Malware payload", "value": "9b18623938385d626c3132f8b77f7f2b", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605257, "uuid": "aa517337-564e-4b58-9f19-04a92e754e30", "comment": "Malware payload", "value": "f4413cc494d83a92a9db308e0df03b5dc42e8f3b3ea2b49fc020b92ddae63272", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605257, "uuid": "9d8547cf-5ec9-487e-88e4-1d77ac607999", "comment": "Malware payload", "value": "5860600bfa88f1886263526ff0455a633f7eb631", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765605257, "uuid": "370b2660-f14c-478d-9e4f-18d8d72a4d8d", "comment": "Malware payload", "value": "f44ee82742975297af146ade10592c0d90d8d2a7dea9599d2b3e542f1acb0acd2de6917bf4ed54dec80c5cca7c402813", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "SparkKitty", "colour": "#408061", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605257, "uuid": "e160b67f-8930-42ef-b1aa-c610226a87e5", "value": "T18E842AA3E7482404C3B846B58A2D5358BE35FB4C5B7013BB3B50A2FA9EF93544D1AF85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605257, "uuid": "a29426a3-1ed0-47cb-b573-0f972d7694fa", "value": "3072:8FCm6KEKd70hmXz9m5/XZleSyg/MOHyA8uVUy0oMzraRbgqkg1+Wxgu/pFGJPHnm:traF9a8uVB9MzrU9+PHnuiuNGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765605257, "uuid": "b0353775-f4e4-4fed-a633-ec5ac4d63c07", "value": 390448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765605257, "uuid": "8589721e-c57f-43b8-967f-53fd2da6799a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765605257, "uuid": "6e759627-a917-42e4-9b20-c44c9c82bbdd", "value": "f4413cc494d83a92a9db308e0df03b5dc42e8f3b3ea2b49fc020b92ddae63272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5436df74-d87a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668035, "uuid": "c3f84ea9-c612-4b68-a9e2-6f11915805e6", "comment": "Malware payload (Mirai)", "value": "9636ae1ba8dea38a36bb6083bd8ee4c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668035, "uuid": "0d3b567d-b9c1-4611-9601-a97fa497cc63", "comment": "Malware payload (Mirai)", "value": "f4437a872c17a269d468dbc030ba38a0a427aaa77ea1d6dfd8b0646bde1f8205", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668035, "uuid": "632b17ba-53ed-4393-97f2-6362bb263480", "comment": "Malware payload (Mirai)", "value": "dc777e22d3e645185a37de7da79fabade9643c07", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668035, "uuid": "9105072c-9257-404d-9f2c-651a8ab3a0e5", "comment": "Malware payload (Mirai)", "value": "825161c5a51dc68eae276f118f3bdba1c8f65978897e41b7911a3783b2f863fbb04acebc389ffc6882b345f1300a3e4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668035, "uuid": "a10943ae-44dc-4fdb-aab4-30cefc220d37", "value": "T19E837DC1F643D0F5E95208716077F7339E32E1BA0129DA43DBA5DA31FC62A41E62A79C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668035, "uuid": "a807a1e5-7d3e-4da9-8826-284090701bdb", "value": "1536:kTeaYrBn6hWE0HDgcLB5kEZS7thKsjnFVRlzTw3cH3pTYVEOld/rCbqZuSwh:4ePBnSWE0H00BWEchhKSz83cH3pvO/zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668035, "uuid": "87b8cfc8-5952-49a1-b102-46736f6a2281", "value": 84144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668035, "uuid": "3512ab5b-997c-4f43-af54-e04694714e56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668035, "uuid": "a97e7c6c-df65-4259-84b6-60d73c4155b4", "value": "x86-DEBUG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3eae24a-d853-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765651553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651553, "uuid": "7d35811d-2602-4910-b439-431ec5fdff09", "comment": "Malware payload (Mirai)", "value": "7c6553f2aae4ec345b2fb976c29e892f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651553, "uuid": "63bdbf98-6791-47d0-ab16-4bd3b2855600", "comment": "Malware payload (Mirai)", "value": "f455963fd10bef9afb8dd084018bfcefc1a4ea5a64b2ee3ecc44d5e9f7f44f65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651553, "uuid": "558e5358-cbcd-4651-8f67-7a3b2322cee0", "comment": "Malware payload (Mirai)", "value": "db88d8f0c92b4594001ac09e4361dedd2fd1cd32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765651553, "uuid": "d6f16f99-a2e8-4ebc-aa3e-60b124b2a3d2", "comment": "Malware payload (Mirai)", "value": "9cae03ff20eb17e2caf972cd6a7db9b555dff424bdb3c17fd4e4f16d399d294746897b558ebee127d60d84f4f244a494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765651553, "uuid": "4515bc67-2b77-4db1-bca8-874d646c310c", "value": "T17524E71F6E258F7DF2A8C73547B79E21929C23C722E1C646E5ACD3105E5028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765651553, "uuid": "6b0e368b-9c6f-40e0-b5e4-43178f2584f2", "value": "6144:uU9P+8/PYk0eb/MHkHVXsTxn+fxKvyFt2siOqucg9:FXlK+f8yF1cg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765651553, "uuid": "341b23a9-cbae-4cb7-84f0-7bf008c28806", "value": 222044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765651553, "uuid": "08cd8abb-b488-4e41-bed2-0250ac47a04b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765651553, "uuid": "e6cd44b4-2633-447c-8ccf-9626149fa39b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dd69d8-d833-11f0-a129-42010a9c0007", "comment": "Malware payload (CHStealer)", "timestamp": 1765637616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765637616, "uuid": "fd796eb5-2972-4ce9-ae21-b54266c73264", "comment": "Malware payload (CHStealer)", "value": "48ae38a2344badc4cfae0eaf52a0d401", "object_relation": "md5", "Tag": [ { "name": "77-83-207-208", "colour": "#FC267A", "exportable": true, "hide_tag": false }, { "name": "DESKFUND-BENEFIT-NIDHI-LIMITED", "colour": "#D7E91F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765637616, "uuid": "a58bc67b-26a1-4a39-ab78-1b589cfbdf53", "comment": "Malware payload (CHStealer)", "value": "f48ad6037d1719cda1e8ce86b917b12f460275e002f074ac46ac0376e500097e", "object_relation": "sha256", "Tag": [ { "name": "77-83-207-208", "colour": "#FC267A", "exportable": true, "hide_tag": false }, { "name": "DESKFUND-BENEFIT-NIDHI-LIMITED", "colour": "#D7E91F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765637616, "uuid": "85b4624b-b7aa-4a6d-88c4-7ed5541fd37b", "comment": "Malware payload (CHStealer)", "value": "f955a2dda0461ae1386d294ef5d97b690f6bde65", "object_relation": "sha1", "Tag": [ { "name": "77-83-207-208", "colour": "#FC267A", "exportable": true, "hide_tag": false }, { "name": "DESKFUND-BENEFIT-NIDHI-LIMITED", "colour": "#D7E91F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765637616, "uuid": "01342fb5-6170-4016-aff0-746a04ed37c0", "comment": "Malware payload (CHStealer)", "value": "cd3d7b7356cb2a05bdc3bd95a558abed7ae50c027fb8fcb90b9b9de51c67f350bb8ae8f8695413c86b6e2a2f83a5e543", "object_relation": "sha3-384", "Tag": [ { "name": "77-83-207-208", "colour": "#FC267A", "exportable": true, "hide_tag": false }, { "name": "DESKFUND-BENEFIT-NIDHI-LIMITED", "colour": "#D7E91F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rezipped", "colour": "#AE75FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765637616, "uuid": "98bc9b73-9a61-4254-af04-4f092c45d3e8", "value": "T13046120664A60FC5CD9C84B990DF1B9676ADAF4A4466D35F87A0E23F3FB33B08C144A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765637616, "uuid": "55ff122f-0e19-4f20-b9a8-665b5fea4e6d", "value": "98304:mQ43zTyKMjkOVyR1inscnNtFHrVLmXFQLgxKz2G/njo2Qpl0q3mt1W9nU:I3HyKGkO01inscn/72FzXmqM1W9nU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765637616, "uuid": "153d1960-5954-49ae-868c-ca74ff6a555c", "value": 5520377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765637616, "uuid": "be19869d-11b2-4cf9-97b4-c465b10766c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765637616, "uuid": "5aeb3279-78e9-4bee-82a1-509636b2ee0a", "value": "No Other Choice (2025) [1080p] [WEBRip] [5.1].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e0ab89-d85a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765654163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654163, "uuid": "b071130e-05c4-4e89-938a-1f6c111f686f", "comment": "Malware payload (Mirai)", "value": "9a0effcf8a77943702b7dcd3bbc2f1d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654163, "uuid": "4040230b-0d9f-4b69-98ec-7c5cf2d8dd38", "comment": "Malware payload (Mirai)", "value": "f4a1aaf7bf729bd2ccc3729e8676d1d04eb211f88abdaecc72edda6d71931219", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654163, "uuid": "ccc90546-8e4b-47a3-8e23-efd6de98b56b", "comment": "Malware payload (Mirai)", "value": "3ad5530d7657bf9728d764bf7f1b0d6834846a43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654163, "uuid": "c2e598cc-609c-4de0-bc61-b2c6b5ca8b3a", "comment": "Malware payload (Mirai)", "value": "10a935540005389d828b44c6517b9c222616c5bebcbe9e580f29d44f3d68b97bd9d2fdf81d891745fb714af8e8e20fa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654163, "uuid": "4455975c-8ea4-4e1f-a91f-7a860bafe2e4", "value": "T1B0833AC7E400CEBDF84EE6BB84170B04B524B7515F920F2BB65AFDA36A321D58D19D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654163, "uuid": "fbdd7529-bc92-4f95-b334-8e55926e1c89", "value": "1536:1QQMzfXSB76/dJEmnxrAhQuliktj8uMbVtAxGRNP48a7Tdp7TPb0e:1QQMzfS7oEWFAhDiM6bSGnP48aP/j0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765654163, "uuid": "78564e4d-0158-46aa-ba20-616937681333", "value": 81468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765654163, "uuid": "c2ff397b-7f0d-44b3-83ff-0120ba47c9d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654163, "uuid": "39d5ebb1-b119-4ad7-8e79-0372a25994e7", "value": "jklm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a232d3-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615664, "uuid": "686b4db3-ce61-474d-9a3a-7475124df26d", "comment": "Malware payload (Rhadamanthys)", "value": "ae16342a035e37915eac2123095c3772", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615664, "uuid": "d87088f6-bcfd-4c77-9b6f-2c693fc963eb", "comment": "Malware payload (Rhadamanthys)", "value": "f4e4933066908cbfb5b47557f24f86caebfe6817c1700186ff2e2c56dd02d2f0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615664, "uuid": "05c973a1-b614-4dec-ad73-eafb36a02d77", "comment": "Malware payload (Rhadamanthys)", "value": "8604ad337bad88d83771ae91fc9641fb5ca5fc58", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615664, "uuid": "26ae40b4-25c8-4f66-8d74-6ebfec9640ba", "comment": "Malware payload (Rhadamanthys)", "value": "3f3e9cb5fb25376445e87ffaadb7373264c4de82949b52390bcabe877720498f4873312c353ef651425827e4f864b26e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615664, "uuid": "98bc0108-549d-4060-b5f0-75e7248573e3", "value": "T16CA32B59A8A3FF30620676617D4B7AF48B3FF561A7D53990E0873F20728DE1111CACA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615664, "uuid": "1d6e1fdf-0d5e-4852-9196-dd655b233cae", "value": "768:GDhd0i7J4sYKgY/CMNfWdj5RP0W1ptLaAApYYeAVAo1qDi4Vs3KDzO5HXNh8BzAK:GDB7eKg20Wrrr6rvnDAe7C6BkQWJ+aY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615664, "uuid": "c17f93a4-15a2-49bc-bc31-a3aea27b6cc3", "value": 101303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615664, "uuid": "1319f9c6-a155-4ee3-bc3c-ac67048d51b3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615664, "uuid": "983955d3-f3a1-43b1-bc15-1dc521f6483a", "value": "invoice-1637482117.pdf (68).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fa1055-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Amadey)", "timestamp": 1765615959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615959, "uuid": "2f4988f3-ce37-43d5-8e7b-eceeb388e3af", "comment": "Malware payload (Amadey)", "value": "b1aa438194d968942e1971004fb3d628", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615959, "uuid": "0cda74e2-e160-4580-8747-d11c9bbfe1f0", "comment": "Malware payload (Amadey)", "value": "f5a90a24084cad14af5df6aa3164edad769a26e3649c2b8243e2a404983e7b90", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615959, "uuid": "9737e4ce-9186-4ae5-b3b6-696de881f4b6", "comment": "Malware payload (Amadey)", "value": "acf622c7eb1fdee888f57ecad30c25442deb8d85", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615959, "uuid": "a813133f-c97e-459a-a6ee-41a97f898fa3", "comment": "Malware payload (Amadey)", "value": "05d5cec76388cf232aec24af4820d7269c7ff1a29bebd143e6131b1d72881a298d306cc0ce8e1674aedae2322f1b472b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "b80777", "colour": "#51B6C2", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615959, "uuid": "7dc9f5ce-3825-4f24-8e7c-bcdc0beb5cf2", "value": "T16D148C243680C072E4B7027145FC9B32597DBE624BB11ADBB3E80F9D8AB45D26B31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615959, "uuid": "7cd86f46-d6c5-4aba-9519-f383dbd8d0a7", "value": "9d20241135260a6283527b95f11fc551", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615959, "uuid": "6395b4c6-f029-47f5-af6b-f86b12117b11", "value": "3072:mLkiHgZn7CNFBneOI7Aeq63oNZ4rKypSiDX9I24+lgNd+F0PWMelS:mLkiHC7JOI7+5Z4rWk9IHDd+FUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615959, "uuid": "ccc3fad6-eaa0-47c4-ad10-500f83c2ed56", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615959, "uuid": "93f33c34-34bd-41e4-8b85-0e4a450d62ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615959, "uuid": "30551697-05f1-4739-bf01-3906b2c5120c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0354b3ee-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639123, "uuid": "e08d83df-9e59-4d6c-a0cd-768705d4b1cf", "comment": "Malware payload (Mirai)", "value": "76f3b151b4cee435e71ec64ef245ad0d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639123, "uuid": "3cbfad5d-5e54-41f5-b9d0-1d344cad5b11", "comment": "Malware payload (Mirai)", "value": "f6446f0ddd218ccae232aa7f187492652c7cdf1e80482987f745bdec090eae45", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639123, "uuid": "d8ddc4db-0a07-430c-9ce2-b3f6f3cbba70", "comment": "Malware payload (Mirai)", "value": "f85a4d40319b0569be008e71ff1b3dcc1eefbb12", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639123, "uuid": "2d668443-8686-4662-9e06-2eaffc98f0b0", "comment": "Malware payload (Mirai)", "value": "d830b3aeafd91bc8b8c4e83874a059376280df4b92aa5aed40116c4f2dd5bf01465faa77bf0cade784fc4080be4353d6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639123, "uuid": "f5a4df40-fca9-462e-b8d0-fda8a1c1fe79", "value": "T119118E8E23909167DF09DF5C7D6BAA1CBE8083DCE5B14718A556A83942BC304F047F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639123, "uuid": "9d30bcd3-9d30-435d-87a7-f8d1a6bc21c2", "value": "24:3J3TqsObJqsjIXsqsxNI5nlqs1rKDuqsUpnqsd+2qsfspnqsBCqnqstukjqscxP2:1eZocAFxyikDMqfMDIqDQkvur6toux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639123, "uuid": "2ec6819f-9430-45b6-8b36-9cb804f4467b", "value": 1042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639123, "uuid": "fa53046b-d7af-48e5-9980-d8383d3b66ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639123, "uuid": "2f4d7c9e-2896-4002-b57c-01dc5c4e90b9", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1845fc-d859-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765654009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654009, "uuid": "21808563-ae08-4e3d-b678-ab6602f837b2", "comment": "Malware payload (Mirai)", "value": "d5dbbced25bb32e7f635a6254711e61c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654009, "uuid": "2134b1b9-d512-41bb-9808-9a61b1e96323", "comment": "Malware payload (Mirai)", "value": "f7e6e8dd55d8239b4188510b66869692cb1bf79fedc91e4040da48e628dbb41c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654009, "uuid": "df9d8e26-0178-462c-8cd0-f53d1df84a75", "comment": "Malware payload (Mirai)", "value": "a2137631980cf3f8ec084229f6972b036cafe648", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654009, "uuid": "905efa59-a79b-4aaf-b2e4-b9a8a7741ca9", "comment": "Malware payload (Mirai)", "value": "7401a600260ac328bbbda02ea2f29534d691f5736997012c817671bf118d1a1402883ebf29578d0f65cdd04364647cfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654009, "uuid": "3856787a-72a4-4bb2-aa83-8071938078b3", "value": "T1C0732B86B8818A13C5D552BFFA6E42CD332523A8D2DF3307DD11AF157B8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654009, "uuid": "b4fc25c0-46b3-400d-a4a3-b2f608bcea37", "value": "1536:0uL+cbaaUnfVswcyaskPlwLl1A/nATJtIvFnv8VR:0uL+ayMlwJ1A/AbuFnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765654009, "uuid": "695017d4-fe8b-4906-b3ed-458b6da21a86", "value": 75632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765654009, "uuid": "51a21bab-7e6a-408c-95be-8cd79a83dd6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654009, "uuid": "ab126323-69b7-412c-b34d-b37a8921879d", "value": "nklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52df86a1-d7f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765612199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612199, "uuid": "f4470f94-266a-45a3-8dfe-4cf84dbebb2f", "comment": "Malware payload", "value": "96343f760292239399d064ab555affbd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612199, "uuid": "006dfed7-8dc4-4fd7-bea0-0679323334ff", "comment": "Malware payload", "value": "f840226f302b05cebdd3fe3ba8d3fdf59c40c007e42f09dbe03fcae32b35fbc0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612199, "uuid": "4c05196c-ebcf-4155-95f1-eb64dc8451ba", "comment": "Malware payload", "value": "3bbd57c5f5dc07a9a5ae31564c8e5e2f43145be5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765612199, "uuid": "04ac9caf-0638-412c-ae48-7ae60a172321", "comment": "Malware payload", "value": "e32f508c455aae6d457b0992e7099cbaa9bae24f8381573d8b5c5f38a1ccc302c49ec58bf32521576610503271359e97", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612199, "uuid": "38d3dfc0-5bba-4980-b0f0-c84361b357a6", "value": "T101A1F2EDF8B133338DD6EE19F616892F704690C08A219FA4B6CD70FD74EBE469A41215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612199, "uuid": "3cd6f20e-a0f8-4aa6-a442-9a2502f6cba6", "value": "96:1xeUe3e1oejeNceBeHXMKG7GyGkGSGFGd/Iioi3i1ki7iNgihiHX/Syl1mxN6vHs:mzu1viV4HXMKG7GyGkGSGFGdwioi3i1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765612199, "uuid": "b21b31c8-6653-40d0-a90b-00c03bac8546", "value": 4807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765612199, "uuid": "b723381b-2940-4645-8753-42453da9343c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765612199, "uuid": "f0bfb6eb-882b-43ae-8237-1d7538a4c29f", "value": "ru.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99bcfb6-d7ff-11f0-a129-42010a9c0007", "comment": "Malware payload (ParallaxRAT)", "timestamp": 1765615431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615431, "uuid": "385cb4fa-b8f3-40b4-8f6e-559f9781716b", "comment": "Malware payload (ParallaxRAT)", "value": "946e2562d56418c29e8c8eed976baa1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615431, "uuid": "f1ed4c01-04b1-4ad9-b0a8-3b6a77713439", "comment": "Malware payload (ParallaxRAT)", "value": "f85cfe9466ca6d61adb2a4b1e498c2e6617ae57d9c21dccf7081bf83f8070778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615431, "uuid": "88f22a90-90ea-478b-8ca5-8e57c2ce17dd", "comment": "Malware payload (ParallaxRAT)", "value": "f473a0e1148fb033bbf8c45ed040b75042cacc00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615431, "uuid": "cbe313ff-d84f-4bd9-a8b2-8463437a94a9", "comment": "Malware payload (ParallaxRAT)", "value": "581d60d5523e92e3742ba59ae2f6b339c244e6f672d915fc7fee335eb076927e93021fd8e02b1e33028b62b1f88c4b18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ParallaxRAT", "colour": "#D46E6B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615431, "uuid": "0b3904f7-5cc6-43d7-8ba2-cd0ae93de309", "value": "T1BC568D12B244A13FC07B1E3A487BD74499BB76747A32DC1727F4294C8F35A80BA3A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615431, "uuid": "75bff929-adf9-49e8-8b31-2b897fb050f8", "value": "bc50a3e71cc030cbaf213881a3e0ec9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615431, "uuid": "e6116b0d-7eeb-4279-8d7f-2abd6ab99c5a", "value": "98304:oi6OHh0yN1rhl2Dxnan0NFbx5AxoehR8/tl:C4hgxnanOd5+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615431, "uuid": "f639fa49-183a-4e53-8dde-49c49aaf4420", "value": 6140928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615431, "uuid": "498e35ba-ff11-4783-9667-735ccb1f7e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615431, "uuid": "909a77fc-200f-41cb-9e02-3a2e4ff05275", "value": "gooogle_account_data_subpoena.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36d8a51-d7fb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765613622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613622, "uuid": "0f9774e6-f5d0-4c7f-abf7-1ed136098bba", "comment": "Malware payload", "value": "c7e10bae93ecacb5a8c3fee798170048", "object_relation": "md5", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613622, "uuid": "35da0538-4a07-4cf1-888d-dd0005de2253", "comment": "Malware payload", "value": "f86e26d5ae83a581b3d485121c2de43437474e2bb85d0b01c60c1fd56299b2cd", "object_relation": "sha256", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613622, "uuid": "62074cfa-5437-41c8-b8d7-409acb383f01", "comment": "Malware payload", "value": "1cc6af95a31429105df62cd7103a11083e26b018", "object_relation": "sha1", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613622, "uuid": "c1492845-53bc-415a-9cba-83debdfb0184", "comment": "Malware payload", "value": "2036c129ff25af20a1c2dc0112ed0a8c4dd1f2ce136b26654f76998a3b7c919ff3dbb629fce96c3ef566995164c0d2a8", "object_relation": "sha3-384", "Tag": [ { "name": "109-230-231-17", "colour": "#ED7838", "exportable": true, "hide_tag": false }, { "name": "bulinco-duckdns-org", "colour": "#52109F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613622, "uuid": "c4fbc379-465d-452b-867e-1bbb30c3ed14", "value": "T102D3F1BAD28B5C07E69E163C6201C73EF3A36E07A4C2525D42E1B7BC57739D8BD52214", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613622, "uuid": "88a1b548-192b-4c79-80fc-8fff5e9cc9a1", "value": "3072:39oIWNLcRvvgONyRhqeK1CDY2Z2Pp1n3iswmCVE2s:3GNL8vvgOkRhpKKY2kPj3iswvC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613622, "uuid": "e7434a84-025c-46a8-b2f5-3c4787e3a79c", "value": 130299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613622, "uuid": "0224f9c1-a40a-4361-a474-010c02ccbb83", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613622, "uuid": "cfd85871-e892-4b5d-bd80-77e7e9ab8e89", "value": "f86e26d5ae83a581b3d485121c2de43437474e2bb85d0b01c60c1fd56299b2cd.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c48951-d837-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765639126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639126, "uuid": "ed622a95-b465-44da-8936-d353ea9e9fae", "comment": "Malware payload (Mirai)", "value": "66dcfb2955dac71b7e473e291f26154d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639126, "uuid": "570b330e-e8ab-43b6-8ce7-2c767c0e6be5", "comment": "Malware payload (Mirai)", "value": "f89fc3b6674d20f8e344d3c91c19bda7db7dbf242e4b04825e09408df107a813", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639126, "uuid": "47aeaff5-6a8b-450a-af7e-7a0ce95f8fff", "comment": "Malware payload (Mirai)", "value": "bd896d4cfbb13acba4ff9760a278a2183d5e25f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765639126, "uuid": "3e1c077d-027f-41e4-992c-04da9d222962", "comment": "Malware payload (Mirai)", "value": "393cc079bfebb6a777f2d30f463e418fa26122f9d9c825ce1b5d1b200d96796ca8ef26e0de2d8bbaca6ea3f206549eec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639126, "uuid": "0191dc68-a10b-42b9-b80d-34776657dac8", "value": "T137041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639126, "uuid": "dafb14eb-5b84-4109-8d21-02e637284228", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMaEzvQ6WJ9G2/7ZiYlTBVmJTr:J3CTRdrD5GFnrPUBsNzZt0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765639126, "uuid": "0e2efbc4-ef60-41cf-a7e1-cad2f5e435a5", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765639126, "uuid": "fd70cb30-c50f-4de8-87fa-07842926f464", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765639126, "uuid": "8b6deaf4-f5aa-4fac-bd9c-da3f4554c34d", "value": "frost.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f263a3-d801-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615927, "uuid": "29bebcf7-bc42-4053-a15b-4238fc67e1c3", "comment": "Malware payload (Rhadamanthys)", "value": "798220a73a4b5b68abc2e34a2903530f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615927, "uuid": "06841338-4680-49f4-b5aa-4b722c552fdf", "comment": "Malware payload (Rhadamanthys)", "value": "fa86223cd94fff0de43fd5a66146f78b5a02c4d019cbd2702767f9560434a9a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615927, "uuid": "d082e156-2328-4dbf-af7b-f9f35a42fb11", "comment": "Malware payload (Rhadamanthys)", "value": "a314162adf32065c572b469f609ac382006923cb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615927, "uuid": "e59b5fbb-6c7c-44d8-88cd-ad2fba0f1f2c", "comment": "Malware payload (Rhadamanthys)", "value": "f1b93794a7959c563a4fe9a238211186e6e5782b763ee21f6dddeb12dca8aa3c5731c5f56add8e8a3e6b796024029d11", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615927, "uuid": "8744b811-c06e-445b-8980-f326c54d2725", "value": "T163A396865D257DD0C6FCBA666CF929AE0BA51D4BD00A24B4F044FAB40DDCE67022BDC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615927, "uuid": "bdfef78f-1026-401a-ab94-d2174bdda39f", "value": "1536:GDB7eKg20DF8rdrL1r78mXjcEAjTMTLm6BkQWJ+aY:GDB7b08hJR3Lm6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615927, "uuid": "bab28ee1-08e2-4873-b1e9-95eff70099ba", "value": 100641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615927, "uuid": "b78d1697-316c-483d-b843-85467aa367f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615927, "uuid": "3ec837fa-a02f-40f2-ab9c-02cb14d5d482", "value": "invoice-1637482117.pdf (13).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a014f8-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615822, "uuid": "5f46d645-94e5-47e2-96e3-f23c1afc9c3f", "comment": "Malware payload (Rhadamanthys)", "value": "2d7aaf8047f9ddf9f532837459a87e10", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615822, "uuid": "b9fedb7f-aa0e-4e36-983e-d541762943f8", "comment": "Malware payload (Rhadamanthys)", "value": "fae2c97f20dad5193c4163472ec6ccea1568827d120c859fb5745d1445775057", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615822, "uuid": "4f64b72f-8059-4cf0-8b0e-065bb51b282e", "comment": "Malware payload (Rhadamanthys)", "value": "40417db76665eeefd81ef180db53b37599bbf36c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615822, "uuid": "1b0a0ca6-e118-4645-a404-18e5d93a5921", "comment": "Malware payload (Rhadamanthys)", "value": "f49d304337c36feea0d302949855248f371307382756d1e9e80705d1dc4d905bc0d3ba580984f9beb74b13507282d8e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615822, "uuid": "8fdb206c-7c89-473a-b635-6c80937ef154", "value": "T12EA3F9692D138CF01A2EE1922C1F38E9853E7AE15A917D549C8FFF68197CB8675C20D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615822, "uuid": "8f3c1e36-9701-429e-a6a9-d74f86a19159", "value": "1536:GDB7eKg20K+cd2V9eRdii1NrWmBDkA+TrSTr/kRYNT5SFMomHF4Lb85UcbrksAfq:GDB7b0I6w5jT46BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615822, "uuid": "dcbda0e9-0fd5-4269-8ea1-2dec25eb903d", "value": 100128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615822, "uuid": "1c57c9b1-eeae-4e17-9ef1-b7e493be904f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615822, "uuid": "2c271bbb-30f1-4081-9b32-10a564412f36", "value": "invoice-1637482117.pdf (31).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa3a22f-d7eb-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1765606521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606521, "uuid": "8f42ad0d-515f-45fb-8f2a-e445486df853", "comment": "Malware payload", "value": "cd00589a87ff374612f9daf273cb78db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606521, "uuid": "3fe1a35a-5a93-49c7-a787-cb861cbec7be", "comment": "Malware payload", "value": "fb0ad7fec7f420f7a3c673cd3e62203a615aab186591ba520a026bcdbdc5eb34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606521, "uuid": "ba987244-fd78-4cc9-a8f7-ff74d7130622", "comment": "Malware payload", "value": "814556a024abd717e57445dfa23693425912a3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765606521, "uuid": "d134d25b-6137-42ee-a23f-7ebe429d801e", "comment": "Malware payload", "value": "d13da9ff4f96fae679b35bc6a407bf407d6823917efb2d022cf93a5930bf874a23ac46e0b731835365cbf982a20e86e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XRYUS-TECHNOLOGIES-CORPORATION", "colour": "#D2DEAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606521, "uuid": "4f78e13f-2a36-4103-a268-462be01a27bd", "value": "T1DB45D875FE5EC4E8E9575139883108279B23AC1A3B9025CF118CF6A6FE32391057EA77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606521, "uuid": "394780c7-ed32-4eab-b85a-e2fd6f7ba184", "value": "06cb741e390a5d3929c93b7d12c2f317", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606521, "uuid": "37820573-c58b-4c11-970b-390fd7386816", "value": "12288:33IUcH0LCUOIcVgjX08a3uSne8wkomkKPHqoHvxKX7:HdcqJlRjkN3uSne89omkKPKMm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765606521, "uuid": "be7e96b7-9282-4420-bcc0-d709626b54dd", "value": 1175128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765606521, "uuid": "1b84a846-0e5f-45c5-a55c-f0a9a1cc24d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765606521, "uuid": "c1940e22-9e91-4c80-9d2c-f8fa0d088892", "value": "fb0ad7fec7f420f7a3c673cd3e62203a615aab186591ba520a026bcdbdc5eb34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6115cc0-d85a-11f0-a129-42010a9c0007", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1765654563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654563, "uuid": "82615007-835d-4d29-b050-a383882e6917", "comment": "Malware payload (Cobalt Strike)", "value": "cb6046c1f133f7842fe6ae419cab4eed", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654563, "uuid": "cb50c363-8943-4908-84ef-e3c517ea57a0", "comment": "Malware payload (Cobalt Strike)", "value": "fb49a3c2bf8466798f0346639a3d94a0829524afd365dda714eb42863e8502e5", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654563, "uuid": "40b78a15-7cfc-4a76-9626-3efcb090881d", "comment": "Malware payload (Cobalt Strike)", "value": "36ce73942c0206916b9eef2819a811f7befe4c8b", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654563, "uuid": "c3384dab-1a10-4952-a878-e855a40e1961", "comment": "Malware payload (Cobalt Strike)", "value": "fe13cd72f5b499a98a21e341cec2507c3ebb7a879a4117509b0f6b0bf7c9523a3cc6d56fe720cdba97da8577782834f0", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654563, "uuid": "d5b3cf42-6796-4aee-8c55-232fdca3eaa8", "value": "T12F65CFA6E4DA44ECC45BB5FE5BDA9E76EC7730520E305BAB43F007352A278D5CEA2110", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654563, "uuid": "5658d1bf-03fb-457e-a550-df389de43a39", "value": "fc0268739c81f6e6f671d1b04dd27b7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654563, "uuid": "d9877263-5d1e-462f-84d2-a0f364acc3f7", "value": "24576:9oGoFo9c2DObUtXPDs8ryQAlfnZ5vkX1LgPWLkVwA:9oPKXDNy3lfn7kX8Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765654563, "uuid": "823adfcb-64ff-480c-b322-56c5570b0314", "value": 1455616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765654563, "uuid": "6af0cd85-cab3-45f7-83a9-b44bd9dc00eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654563, "uuid": "bec67a76-9f35-43a6-ac52-12b1c48edd16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58247b0c-d7cc-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1765593310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593310, "uuid": "03859661-becc-4425-9488-b366e76fcf40", "comment": "Malware payload (Gafgyt)", "value": "2e235d1be19250c807611d0949b3ca0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593310, "uuid": "5a35ecf6-a212-49a8-b7da-c2c0d78ebba2", "comment": "Malware payload (Gafgyt)", "value": "fbeffc678b3931304d95983bc5d9d817d132a0c5d3e2e23f4a27e501afa663e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593310, "uuid": "fa23d18b-dfa5-466d-b15d-28435398d95f", "comment": "Malware payload (Gafgyt)", "value": "f14cb77d2f44cef48cbb7bf066c2eca7a5a48221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765593310, "uuid": "90d42d4d-b2dc-4d8f-9dc1-8cd4adbcfb4f", "comment": "Malware payload (Gafgyt)", "value": "bd29f42b4bb0eaffbb6e2e4b3e2415fb1cb2c5b4eb36a1f036c0e41b45a556959970d3ac3ad0579999c98e4e667f18fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593310, "uuid": "3d3d073d-76fa-4f7c-864c-aedb1fa7e5da", "value": "T199F3A71777608EB7D81ECE3306995700208DD59922A8BB7B73B4C61CFB9A54E0BE7D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593310, "uuid": "b2c18759-c04d-4b06-97d1-ec33a4a59242", "value": "3072:3VfM4PcmEtxT4iFB7g4OX1aJGTx1TJ4i5k5uZ2qpO3Q21uaDFjCTr8xd+kQokebe:3VfM4PcmEtxT4iFB7g4OX1aJGTx1TJ4s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765593310, "uuid": "6f7b4e6a-dda9-4da7-84d5-9cc86ceb5a57", "value": 167221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765593310, "uuid": "ff768d72-809f-450b-999d-2a9e091d8923", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765593310, "uuid": "28c34249-c16b-450f-b652-7db67e422a8d", "value": "ionetworks.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75e75b5-d7fa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765613199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613199, "uuid": "6f7e4c49-711d-44dc-ada5-77dc91dfd582", "comment": "Malware payload (Mirai)", "value": "d3c444a228404100835c32cb14c0871d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613199, "uuid": "59c0eab1-f14e-4dc1-87ac-fddf358a89b2", "comment": "Malware payload (Mirai)", "value": "fcb85108cfe1467e5ed2101f8cc1e1339b17d147784fc49cff7739659be163ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613199, "uuid": "c8f5da53-ddda-408d-9c54-03fd3a57669d", "comment": "Malware payload (Mirai)", "value": "856af4a03ece5c965d2e97e5cd9072c0ca010d06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765613199, "uuid": "f7e2cd96-83a7-41e1-8126-867c7bc1d770", "comment": "Malware payload (Mirai)", "value": "c901b30e8cd900ca1862a7b23765b5c62a4e58601478afc7c9b3cc5097cf61f23fd16567bfae48d39e10a5f4344612d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613199, "uuid": "6c960978-0d7d-48a0-b59a-c750dabf1a0b", "value": "T1B1630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613199, "uuid": "bb6922c9-c41a-4003-b8e0-012079a87b67", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765613199, "uuid": "fb8b0043-d831-4012-9701-3f33241cccc4", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765613199, "uuid": "aada8e1d-6632-4e61-9eb5-87ec2dbbef85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765613199, "uuid": "82a00aaa-a8bc-46b3-a9c2-3a56c944e24d", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece358aa-d850-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765650253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650253, "uuid": "883936ed-856e-43c9-bc64-db6d32023ef6", "comment": "Malware payload (Mirai)", "value": "cebe3c33373fbca81609dc74321a30d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650253, "uuid": "2ab8e54e-d0fb-49a6-a4fb-10927f7146b3", "comment": "Malware payload (Mirai)", "value": "fcf58840871d50031548e82e608bb401ad3cb73a6cc9d7dbc955c1cc936d2318", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650253, "uuid": "9488dbcf-cafc-49f5-ab70-278b908ad5c2", "comment": "Malware payload (Mirai)", "value": "908dbae5a7f0fe07957b6f48d06d5c2f311f39e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765650253, "uuid": "4ac5a9d3-5aa2-4059-b650-5ab4b4d0eef8", "comment": "Malware payload (Mirai)", "value": "0d9d42f51fe33f319b90a387a62217d307928f4bcf125f71f71751b7a9c1a1016acf027f4f33867154c90b13ecc5901a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650253, "uuid": "b8436ccd-6285-4c93-8ea2-ec00efcf77ab", "value": "T13E258D12EBF10256D280873586A2D7507B46ABA664E0034FCF618EDFEF672750E85CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650253, "uuid": "dcf726b9-b494-45f6-a4e5-22c4e1abc213", "value": "12288:GprUfcYCd5a/7XxwvlWEKJeyYv9s55Zc0s:GprUfu+Xy9WEkeL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765650253, "uuid": "26740461-942b-422b-99d7-081cf8aed614", "value": 1057288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765650253, "uuid": "a41d7291-fae1-45d5-9533-41fca4a9088a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765650253, "uuid": "4ac89281-7633-49b2-a260-1a535e4df91a", "value": "shadow.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa39d46-d800-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1765615809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615809, "uuid": "caa89ed5-e8da-4fc4-9c28-9199f561662b", "comment": "Malware payload (Rhadamanthys)", "value": "8d7307b9440dba3c1de2ef754032efd8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615809, "uuid": "637b121c-6daf-4884-a3a4-fbac37895054", "comment": "Malware payload (Rhadamanthys)", "value": "fd796c8decef88277ae3de5d4ee3e8cfd811f785fceeb48a88167baee75cd582", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615809, "uuid": "9bfb3cc0-a189-42f9-8899-1ce63d9ea36e", "comment": "Malware payload (Rhadamanthys)", "value": "efc7e4233e55ca132d2316c96838b38b911da374", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765615809, "uuid": "c593370c-d336-4e4a-8978-651d2cf84583", "comment": "Malware payload (Rhadamanthys)", "value": "2465fbcc852308c8232ca30e8b40a1a841e85a24afb82cef66afcab87489073934aa2884e81fb9165690b43c0326c322", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615809, "uuid": "2b716836-4539-4b1f-a17c-64ffaf1184b4", "value": "T11893D7C5DE37FAB0B1816B3DBBE00532D93898C65C1466B5DE6DBB20A08CF1977605B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615809, "uuid": "e81af466-4510-41aa-bb28-ad9126e71809", "value": "1536:GDB7eKg20ShmWzmJFKv9ibolF3o+nk6zS6+5GyeUPrYYRIrxAtrlzdv0bff28Y5H:GDB7b0d8SIU4N6BkQWkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765615809, "uuid": "69d94389-764c-47d5-85de-cc09969784af", "value": 94812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765615809, "uuid": "9704ef78-7d7a-4004-a7f7-19cae06ce60e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765615809, "uuid": "403b1bbe-2ebf-48a3-9991-7ee4c4da54f2", "value": "invoice-1637482117.pdf (35).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc3be75-d859-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765654011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654011, "uuid": "8c0db090-298c-4684-8c57-a168e36ba41b", "comment": "Malware payload (Mirai)", "value": "777b3252aa0b6299476c938728f4722b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654011, "uuid": "99b73766-8322-4abb-bd86-18d7f8acdc48", "comment": "Malware payload (Mirai)", "value": "fdca0e08cf50ff8f3881b54ea439c955082fe6abb69b047318cec96793780f0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654011, "uuid": "790a040c-62bf-47c1-bf07-d1bd909e767b", "comment": "Malware payload (Mirai)", "value": "c55d042ce10954e39cdcbbe4448c63ad5d3e49ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765654011, "uuid": "15ac64fd-36de-4dd5-9d1a-fe5a129058eb", "comment": "Malware payload (Mirai)", "value": "5d48291ffa2cb48630ea25bc68b47221ae8a05a79e6208a8bc4b23330ef38d2dbcba78254570360c3367ba227505fd17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654011, "uuid": "1e87c196-c720-4c8f-8ebe-f152ca5ed366", "value": "T12FA3B40A6E51DF6DF76C873547B78F31974833D23AE4C681D16CE9045EA024E682FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654011, "uuid": "13af53db-2e7e-4799-8fa4-ffb902b1a8a8", "value": "1536:u9BaY2NCsDhrjMBaT1caqq8VlqSqk6q286qqlGSTyqcade/nv8VRxs:xYUCEPBTeDlST7e/nv0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765654011, "uuid": "e3154832-9c6b-4a5c-bfc2-a25fb48b4d7e", "value": 102200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765654011, "uuid": "7be491ad-7a4a-4c95-92ee-04eec5b4a7f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765654011, "uuid": "a6322c3d-bf5e-425c-97b5-35758cbe6f43", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2715b6b7-d87b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1765668389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668389, "uuid": "6e937f3f-7bc1-495d-b93b-ffe8494f8cf0", "comment": "Malware payload (Mirai)", "value": "4b0afbb5a935b4e6828b44a56add5a4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668389, "uuid": "688a6417-8cbb-4f85-a37c-2cd977bcd3f8", "comment": "Malware payload (Mirai)", "value": "ffbd97444df42648a8a654ca2d8ef4a404ba2cd31e7945547315750cef752b39", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668389, "uuid": "fb293250-901e-423e-8891-01ad7e527087", "comment": "Malware payload (Mirai)", "value": "df208ddabeeb56efb639a01f08bb00c5ca860089", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1765668389, "uuid": "be0285b6-57ca-4a40-8054-d85cdb0b5bb6", "comment": "Malware payload (Mirai)", "value": "bac5a3365d16f921f59cea1787d24eb738d954fa8af965a54e1ebfd5f5023dcf1f3d9515501ad7cd243059eb688bc6c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668389, "uuid": "7f827fd9-1640-407d-bb22-68a5bbedf132", "value": "T193A32A56FD828B22C5D512BAFA1E118D331357B8E3DE7212AE205F2077C686B0E7BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668389, "uuid": "49ea3ab9-ae66-4216-a035-35de4a039577", "value": "1536:I/nBmE+E+w8XJquftPo6ZIuM7W2Pbc2aLTK2ghQgM5iWy7GOyk75z5HYa3d:aH+EQJBftWbc2aLJy7GOyk1zB33d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1765668389, "uuid": "6f30f8bc-65ed-4aae-834c-95c1c91272d1", "value": 104048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1765668389, "uuid": "154cf9f8-668b-441f-8e7e-61a4f2b64720", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1765668389, "uuid": "cb2018fb-4893-4625-b896-1007ec5d6d47", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }