{ "Event": { "published": true, "date": "2025-06-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-06-26", "timestamp": 1750982582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "07a583e3-2619-4ea9-bbbd-b4cbcf1611d0", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05105c46-52db-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750976108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976108, "uuid": "d6094391-710f-4a97-93d6-0f5b82aa9557", "comment": "Malware payload (Mirai)", "value": "98dba5597be04c27ffeeaf3b637d49eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976108, "uuid": "ddb8c629-e128-47dd-b875-6cacd5e20df5", "comment": "Malware payload (Mirai)", "value": "00b7944efcde8e6b2796ee0d73700033f7b6806f4430f75f2cc968bd6fe7bfb2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976108, "uuid": "737fb372-53fe-47a0-bbf5-b999b62a3ea0", "comment": "Malware payload (Mirai)", "value": "0d6c82546c08f4451ac5c192cabad59faef6ca2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976108, "uuid": "174518f7-4ccf-4a8c-864a-fd612f1a6a21", "comment": "Malware payload (Mirai)", "value": "8a6cfdcfe023daecd149b799dfc2e966a6becc5ec06b6edbcbfacdda007d2f95e0569b9bb6a55172b7f2c773122ff74c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976108, "uuid": "46418c1e-0e5c-4b82-8923-c3406ca503f3", "value": "T16473A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976108, "uuid": "cfde9be6-92c0-4abf-96c7-b700b1e38aea", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStp:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976108, "uuid": "ebdd0d98-4c5d-4372-9c19-00db20a5cf7f", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976108, "uuid": "95226682-052c-4c83-9bc0-04ad393d8287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976108, "uuid": "ffe0bac5-59c0-4ea5-a1b3-b386f4121b4b", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6837d1e7-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750977992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977992, "uuid": "d513deac-6e08-47df-8e32-8ccda6417508", "comment": "Malware payload (Mirai)", "value": "002be2bec8efce7461066a8c2115b63c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977992, "uuid": "98a56f4a-e85b-4869-84b8-fb2ad72eaa34", "comment": "Malware payload (Mirai)", "value": "00f76b8cf0b2d31a5087419b6ef2dfcb68084629a310f33882facd7f02d784c5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977992, "uuid": "85ccc45c-e0c0-4612-aaa1-e601d7571639", "comment": "Malware payload (Mirai)", "value": "104646f4254f017af9125652040277a3d1f9d2e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977992, "uuid": "fb1ac51b-c6c2-4e35-aa9d-be44144e2670", "comment": "Malware payload (Mirai)", "value": "6216a83ec10c57db9b9d0086de55a1dbc0d44e1a38becde016e96bb8fa8abd855ddd806838aec9da087c681df08db6ad", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977992, "uuid": "3603263a-91f6-453b-b3da-a65bac6d9f04", "value": "T17E6171F603524533DDAA8AE3B2A88445B245409B98DE4FF59BEC34F40E4CED8BD42E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977992, "uuid": "f8424242-8f2b-4013-b872-75788867010d", "value": "24:ItdZsHbhZknlfHmsLTB+GgJR6TnLPoNIpKksPME3hFsHscGgJsR1pk:iYFadX/B+1srLCJJReHsBgJsBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977992, "uuid": "6a6e92dd-ff10-42dc-99ae-6f32bde9e6c2", "value": 3374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977992, "uuid": "79f70262-f4dc-414d-9021-d85e0ee47e2c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977992, "uuid": "79b7fb17-c1d2-4d32-921f-f191b574955b", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc17b2e3-52a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750954940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954940, "uuid": "a16ef05d-5421-4fc8-bc23-e5baaf41133d", "comment": "Malware payload", "value": "be8a6c3e710892f1a82bc2aeee8bdaa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954940, "uuid": "8646f692-27f5-4af8-a5dd-b6fe3fc096c9", "comment": "Malware payload", "value": "02a7a6a051e771bcbbd7aecdae6f427c7f571eeec9914c3b44625a2267d62948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954940, "uuid": "48e01865-0e50-4689-a054-3798b7a414a2", "comment": "Malware payload", "value": "b75af57e58cb94c1b14a72279d38b46bb3e63609", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954940, "uuid": "14a1aaa0-a6ed-4329-9318-572bc2ec1bcd", "comment": "Malware payload", "value": "997c4fe9bda876404563cc519507b625fac5d8aa4b403717ab08873a87a007ec846c2355f8a090610879e6632f6bf090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954940, "uuid": "720145af-dcb5-4ab9-a620-e675af499116", "value": "T1D9C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954940, "uuid": "25368146-d3b3-4d87-9d28-818f4a58fb22", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954940, "uuid": "d678894a-2ba8-4b91-a23d-816a8aba1f0f", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954940, "uuid": "28eff681-edca-496f-bbad-53a597dbea8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954940, "uuid": "b72a7647-c97e-4fad-9ae6-d9555b3b06ac", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a2d05f-5277-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933569, "uuid": "d2aaaab4-8c7b-447d-b700-e68623e90d01", "comment": "Malware payload", "value": "0e041de4bca18fdfa54c525ae524e018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933569, "uuid": "2cc13852-5ce2-464c-9db8-04f3c55c0ff9", "comment": "Malware payload", "value": "03012e22602837132c4611cac749de39fb1057a8dead227594d4d4f6fb961552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933569, "uuid": "4f5f2828-b4cf-4a1b-96b2-f96f26cf31f2", "comment": "Malware payload", "value": "6b136e32f9afcb6c8d6c7d808df0ca268d47e5b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933569, "uuid": "f4a7bcc0-1dc3-4d60-bbc4-a81aff3379e3", "comment": "Malware payload", "value": "2d49511205652ffa171e7c33ded08bed0b9f8dfa8a485b181f6a3e8100c58b21cb359cfeeade6c03cc642ed2ec499c51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933569, "uuid": "e342e066-be8d-438f-ad76-2e7809fa1d17", "value": "T189147243216001C8E4AEE12D1147E61BE5F338E1CFE5744F22A2DB5FB9C2AB237A955D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933569, "uuid": "c380dbda-3d7b-4152-abe2-93d3484c35f5", "value": "c5dc0a3ab3f22aeaf807779d165c2e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933569, "uuid": "f68dc50d-87e5-4627-8411-1bb918e5cc78", "value": "3072:sfJgZmM5VlLC+bKKmVJ+w0WhLkX6dM8N+H15wJd8zXjxeoIbE:iJg1oHQV0d8zTxhCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933569, "uuid": "8da4951f-f7c8-4d33-90c5-bb93323b646e", "value": 205968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933569, "uuid": "8086127d-f3d5-4d55-ae23-5126f0c2d562", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933569, "uuid": "ac6cbb67-8897-4884-9c2e-c55c4b26e9b3", "value": "Green.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c18852ca-523f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750909423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909423, "uuid": "225f49a6-2801-4e32-92ba-2f129620a1e5", "comment": "Malware payload (RemcosRAT)", "value": "739163e30e6a3465b5f06a72aa7e744c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909423, "uuid": "bce4cfca-6cd7-4a0d-8935-d067e2cd39cd", "comment": "Malware payload (RemcosRAT)", "value": "0399cc610cf9002129dfd6666006b3c1469fa796c19e96540aed28cb4e9689c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909423, "uuid": "6c4ee46c-9b21-4787-b71f-e6c08a39f0f8", "comment": "Malware payload (RemcosRAT)", "value": "b95a1fffd291ea72701c679287aa8c760acfaa96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909423, "uuid": "589461f1-d111-478d-9388-38c6b8841a3d", "comment": "Malware payload (RemcosRAT)", "value": "e66904030d86b6ce97fcb750c1e7729451197cf78b81f2f6311c0ccacc66f32a24c05612703c5450cb4da5c3d6efd060", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909423, "uuid": "57a1d25d-b7b7-4df3-8955-354a1c454f7a", "value": "T13E25122A6DE39482D12A3F7545A3C2B885643FDD54B2C7CB6BE63C0F3A31E10F126566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909423, "uuid": "1fedae45-0f03-4ded-8e40-7ef51e098889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909423, "uuid": "1182d93c-3b63-44ef-a5f2-35fbae6158f2", "value": "24576:KgnbtTxj++lo2a9UxZEYQtow23EjYhpRvy:Ke5Ts+iTUxZU6EAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750909423, "uuid": "ff032b41-127b-47c5-8b22-893ee7e7223e", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750909423, "uuid": "f7a1b4eb-257b-41a2-9a17-866ea3c2943f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909423, "uuid": "7b539989-3c54-4b5a-be4a-84d120d9f1ad", "value": "SecuriteInfo.com.Trojan.PackedNET.3323.11759.18819", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1503b42-5279-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750934360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934360, "uuid": "d7e8f095-bae1-4106-a15c-76e445a075d7", "comment": "Malware payload (Mirai)", "value": "fdcc6b7c287975039bff986772e1ea04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934360, "uuid": "26e7cef0-ce19-43fc-aeee-ec6f8b40ca99", "comment": "Malware payload (Mirai)", "value": "03e784f33a7cd24d79b339ae4fd183129f3d4e839759987151b810ab60e9352a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934360, "uuid": "dc7fc85f-4d48-4cdd-aa23-2eed9bd9b980", "comment": "Malware payload (Mirai)", "value": "a3ca095553a4134424f4c11a25db37ca63247259", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934360, "uuid": "b1139a0e-6a34-42ad-8ea0-2118da7a4d12", "comment": "Malware payload (Mirai)", "value": "573702e919732007bb4072f1de2e08e86b73099c84974d95a220ead5a799d25ddb19152e57db1b5060342d181cf78593", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934360, "uuid": "2f9d32cd-bd2f-4d14-8902-f815dd674c54", "value": "T132119BCF25629C60CC525DD93A924819F48DD7D436CF8ECCB1CE8026E5AED047151F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934360, "uuid": "e5bb058e-04eb-454d-a097-18c92beab383", "value": "24:sEUSIbK5zOt+MB0h1Z1WktU7ktZpZmkt1ikP:sEUXK5CEA07ZkkYkakakP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750934360, "uuid": "b88f1795-4ca5-42c9-839a-e62bd38de233", "value": 951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750934360, "uuid": "4c53f2ab-98b1-48aa-b2d1-7d8665904f91", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934360, "uuid": "9783d33a-8eb2-4c28-9166-7abce131327f", "value": "sdt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95b2173-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900873, "uuid": "7bf573e3-483e-45e5-9cf2-ec061570904c", "comment": "Malware payload (Mirai)", "value": "ccde2db32c71e25702d70c1e2c5d6db3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900873, "uuid": "b34b5a3e-b07d-4df4-920d-dec934703f38", "comment": "Malware payload (Mirai)", "value": "04203b2b13b339775d9dccd550835a4d619d16363e341c832ee2adc079c3faab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900873, "uuid": "e191f5cc-c473-4873-a046-29bae9132025", "comment": "Malware payload (Mirai)", "value": "6593d8915182b89e93a0199e5f88add4da3a584b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900873, "uuid": "03660c2c-1a31-4c9e-8406-2448890afcd4", "comment": "Malware payload (Mirai)", "value": "c75ec0a44308422c3f7c473df1eef08d9b6f1b47fdce51cc9117e1ae919435c5ffafd8889d501d06bb67e77f4481879a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900873, "uuid": "19966c64-00de-4b52-9efa-2818bf50f3ae", "value": "T184042A46FB418A13C1D21775AE6B83893333DB64D3EB33029C28BFB42F867894E66555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900873, "uuid": "c280c99a-53f2-4395-a280-3031da11bf4c", "value": "3072:fR+ABIPx+9u1qn6DKhAnwioKRvrAPFujWh4xl1D0iey3uiInkh7+bV:fRXBIPx+E1qn6DWORzvrAtujv1Aireiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900873, "uuid": "fb27c89f-069f-4493-8b9c-ff90b303039f", "value": 181705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900873, "uuid": "1930941b-8587-461f-89e5-00f6f6845d59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900873, "uuid": "ce2324d0-d3f0-4f68-984d-b033f295eede", "value": "SecuriteInfo.com.Linux.Siggen.9999.21191.29378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0a69706-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905583, "uuid": "026aa386-e2b7-4e34-972f-60c341c4890e", "comment": "Malware payload (Mirai)", "value": "dbba13799ad3e6735bef425b7dfb858f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905583, "uuid": "f62c0598-830c-4a07-92b9-eb6deeed398c", "comment": "Malware payload (Mirai)", "value": "04cdc84db62999de18c8c51ede11d703ca03aab3e52f798efd1d6aaa9a5a2b7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905583, "uuid": "cea465ef-0010-4503-b7e1-351b6f8d2469", "comment": "Malware payload (Mirai)", "value": "11e488566a03eb07a7f68e640f6e65d96f121039", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905583, "uuid": "4d500c38-cd5e-4e88-9f9f-4db48e2326bf", "comment": "Malware payload (Mirai)", "value": "bc8e4065e3c1cfa614d1fb85a2e07665de15b578460aa0f4b7a0edcc4465aa870f6f7d2f9890d549bdbf8762623dc808", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905583, "uuid": "8e0a7055-ddc6-4ec0-8ff3-a3ab622aea3f", "value": "T16EB32BC6E753D4B2C9470BB002ABE7354631ED92071A8E15E76CFFF46E22682B15A31D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905583, "uuid": "a907d58e-be61-4f59-afba-16bebc54d5e6", "value": "1536:P5V5gSvKwrQVdloXkqaN+nmoctdcQ+51UG31gDZ+AbhaXUnIornmbUtep4eYc46T:H+6KwrsdloXkqaN4SdLCK40eUnIQnZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905583, "uuid": "b28b4e3e-4b98-4f2f-afe2-ff5f944ad0a9", "value": 111156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905583, "uuid": "cd7657c6-1178-44a1-92de-69297dc9b59b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905583, "uuid": "090a684a-8ad2-4b57-aa15-f03cc209521b", "value": "SecuriteInfo.com.Linux.Siggen.9999.6660.15648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa3c76f-527e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750936478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936478, "uuid": "ccf2984c-701e-42ec-b36c-64bbc9fe3f0e", "comment": "Malware payload", "value": "84109e26123866c75c4d8657f85d2d4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936478, "uuid": "a0f8b34e-bdb2-494b-800d-0730da011349", "comment": "Malware payload", "value": "0522a90b44c500fb0e8ec1a5eb665005b64ec2161681bc182ae5593cbd06d3c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936478, "uuid": "376ddb1b-7eb8-49a7-9dbc-06082079f0fd", "comment": "Malware payload", "value": "0ebdb4ffc8fa41df118a4e06b3a65aab9b0abbe4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936478, "uuid": "81d47038-0adf-49f3-a1fa-98f7466a49b9", "comment": "Malware payload", "value": "6c001041ecd57deb9b8f10f42740923627f9f60eae76482100c368c4e7789cf900a7fc2ece60f1b3adcc4174e3ed505b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936478, "uuid": "eac9fc8e-12b4-47ed-a80d-1c048ff428b8", "value": "T1CFC3C44E7E618F6CF39982310BF74F35A29927A617E1C945D26CD9101E3074E682FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936478, "uuid": "b497801e-07bf-4f56-bbbe-3c63c56576dd", "value": "1536:wJi3+rO4ooGomnqC8Zyo6vNWsqa1kRzrAa+ARPXGKRggMjrn1D864bgzu1ne7/zP:LoVDsdGzR/GKR4bFyav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750936478, "uuid": "aabd5423-2354-4f89-850c-8bf5a863bf24", "value": 129868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750936478, "uuid": "c5a5f042-811c-4764-8025-231f5bf59139", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936478, "uuid": "c7b9427f-4311-4411-a490-d07ecbb5f110", "value": "nmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1737d8c-5241-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910335, "uuid": "c469c21b-fc67-49da-8e46-dc7ff0962552", "comment": "Malware payload (Mirai)", "value": "d84b821859c1849dc99795f69fc16510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910335, "uuid": "e250eeb6-645a-42c7-87dd-a0d9a359bc9a", "comment": "Malware payload (Mirai)", "value": "054f118b4ecdef76b8bdec2b233fa901d4a69a9143412972965ee8e3f664fdd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910335, "uuid": "c7d0410a-3704-4fdd-8583-9ed05b16594f", "comment": "Malware payload (Mirai)", "value": "aee0bff07fb1f30b3a701e6952c5e224638796ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910335, "uuid": "7629ed50-f4bc-4608-8d1f-bd348facef12", "comment": "Malware payload (Mirai)", "value": "43544df6f09ec0e308a885bb99edbffa30b661a62ab193d93d44735a61c4ad25a63e623af0ce1b8663225d18ab435661", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910335, "uuid": "6ad74204-7db4-4887-b605-8e379795a23b", "value": "T1D2F317D7F900DAFAF80AE7374C5349097270F7A149921A336357366FED3A198142BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910335, "uuid": "f1630d2d-fe55-44d8-9e88-e4b750c56325", "value": "3072:fRPgdEDqr3QeuacWjcW0JcWcBXz/Bc0ayierRDVdU+LZb9v8eOe1:fQ3QeuacWjcW0JcWcBD/S0qeJL/v8eL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910335, "uuid": "a5957327-438b-479a-91ae-e7da6d54ac61", "value": 163516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910335, "uuid": "81bb1b37-d6a2-4122-93aa-06a314d824e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910335, "uuid": "55a4b239-0167-4876-90e4-b47a44c6d0b4", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4a0968-528e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750943450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750943450, "uuid": "fac95211-aca1-4016-91d6-2fdee9328c3b", "comment": "Malware payload", "value": "ad914fa609551a40bae0698f42d001b3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750943450, "uuid": "2b09a36f-8905-4b01-b187-ed8ea2f40a84", "comment": "Malware payload", "value": "05507bd577bf13eb4642883f07243ac0f972dfd711707994c39f1763405b64db", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750943450, "uuid": "ea19fbab-4d32-44ba-879c-b2db006e534b", "comment": "Malware payload", "value": "b80e4839c54bf43453a5af03bb043455d930fc5c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750943450, "uuid": "e6e1ba82-4922-488d-8333-a0b752b97deb", "comment": "Malware payload", "value": "9406b01319186b094bb25527c603e72b26edea8024816a16669edbed97ed13e9d0bf90fcd2edaa5b2ad2c10e137aba14", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750943450, "uuid": "6d84310d-edf5-40c1-83c0-ebd9c360a117", "value": "T19C7533B93DE327E7EFB5B3384B528A225BF13100D65B0E2453C20EA76359B34299E45D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750943450, "uuid": "7d1aa9d4-0c9a-4ffa-8028-85198c4a21a0", "value": "49152:9mov2Z6k3GbDjscxrR51o44yZ1rbNEcfEyBymSvC:dvS6kijv3o44ybvEJmSvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750943450, "uuid": "1b27e068-ba6c-49e0-9855-d5749ea1db6d", "value": 1589347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750943450, "uuid": "689152c4-2299-43c5-9cc1-acecf202b57e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750943450, "uuid": "8452d643-8883-499c-b081-eddccdd25649", "value": "\u2749\ud835\udd38\ud835\udd63\ud835\udd54\ud835\udd59\ud835\udd5a\ud835\udd67\ud835\udd60_\ud835\udd55\ud835\udd5a\ud835\udd58\ud835\udd5a\ud835\udd65\ud835\udd52\ud835\udd5d\u2749_26062025_\ud835\udff5\ud835\udff0\ud835\udfee\ud835\udff2\ud835\udff3\ud835\udfec\ud835\udff2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddb9a8e-529f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750950541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950541, "uuid": "c0b6088d-7771-41bf-b60f-771f369fde71", "comment": "Malware payload (Formbook)", "value": "784f7b9dd4d75f74e191e47a9c0f24b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950541, "uuid": "38de4198-9378-4a3d-8a4c-ae4404fe79ae", "comment": "Malware payload (Formbook)", "value": "05c2b088b830ff16aba8c56b691439772ed5a5df0d2725b86595d6eb29c9c05d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950541, "uuid": "c71853b1-b9ec-4297-950f-0764d36f9114", "comment": "Malware payload (Formbook)", "value": "a871b9d13483e46d687d5818ebd8710d80442117", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950541, "uuid": "e5d819b7-0a32-4097-8bf9-f5d673cc41f6", "comment": "Malware payload (Formbook)", "value": "06c2ba939d630a677a0ff117582a565f71bf345a463b830c72ce85dceb9954da9709d09d9b74c50e2c61edc52b50297c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950541, "uuid": "34248448-2dbc-4648-bc6f-4afc4bd979f7", "value": "T11385BFDF6241BB71F1510A347C2EA3AC6D2D7A2A372CF6462FA10F0C4F69671652B193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950541, "uuid": "05f81d13-ae8a-401f-a659-9bca4a086a79", "value": "5fae3562d65c699bbac99ff256b12f49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950541, "uuid": "8326c307-86d8-433e-a98f-a35fdaa467cf", "value": "24576:QnY8m6hUrSNROa+3Y/Ffm6bUyyebXLLJP1diM5sWmUYdCcxAoHUWGm47pIgI:QS6CeNDfrbge7FceoHUWGm4lxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750950541, "uuid": "812f5d41-ba32-4eac-b364-a1a8bb27bf45", "value": 1849856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750950541, "uuid": "56514de2-ee94-4838-8939-a434e2562a48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950541, "uuid": "98cae1fa-12eb-4035-bf5d-5a64ec981384", "value": "Payment Confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a45e087-5272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750931261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931261, "uuid": "16b4ecec-8237-4f42-ab1e-d0a8e537b7f9", "comment": "Malware payload (Mirai)", "value": "9fdf598f18b0ede9b41fc37659e98947", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931261, "uuid": "a5caff5f-7261-4c59-a4a9-78f216a061cf", "comment": "Malware payload (Mirai)", "value": "074afa10024290da9f50e0f1ee99d470d34f8fe18e97b4b139c3743f670de3e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931261, "uuid": "5048388a-4d90-4a27-8b33-07ce79a8cb0f", "comment": "Malware payload (Mirai)", "value": "b8b2025f51b139438814597a1dbb615cada59a7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931261, "uuid": "e45e85ea-98e9-4b95-9ac5-6b6283655add", "comment": "Malware payload (Mirai)", "value": "a0edb9ee5371d8b32a175629250c7f3394b8d0a6bcbf3625041e5e35202811117c71fac9c64425ae4e558aeeb0aa82b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931261, "uuid": "1677e2a2-6bee-4edc-bad8-dd4d6e010367", "value": "T1D9042A46EA404B13C0962BBAFA9F42453323DB54D7EB73059528AFB43F8779E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931261, "uuid": "d9c75645-3527-40b6-a652-46df3d926319", "value": "3072:hfwK4BnYyiKjJfaKAQimtuQfv2Ahgjoa+XPSorM/RjXqphN:hfSnYB2laKAQimtJWAGjoa+fTrM/Rm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931261, "uuid": "daa8cd1f-f0ec-46ac-9641-82b25fefa322", "value": 180479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931261, "uuid": "f74a0549-9446-4a2f-ba8f-6c220b351fb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931261, "uuid": "d99d3a8c-9bae-4f25-927e-26b8c7a19cad", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e62931-527b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1750934936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934936, "uuid": "9ce7d2cb-6936-4a26-bef4-581fb57b4275", "comment": "Malware payload (DCRat)", "value": "eaeba8ee3234447dda19fc9f2bf50a65", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934936, "uuid": "ae09d327-4955-4067-8def-a516b0b0b443", "comment": "Malware payload (DCRat)", "value": "07845fcc83f3b490b9f6b80cb8ebde0be46507395d6cbad8bc57857762f7213a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934936, "uuid": "9369a697-5291-4251-a980-e749006aef16", "comment": "Malware payload (DCRat)", "value": "0fd6c9a997a90eb0d8e66984b433600b27cd8d7c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934936, "uuid": "7b966716-6ddf-426d-ba04-babb9c631942", "comment": "Malware payload (DCRat)", "value": "c2d033f8cc478ddf11bb1b6b5dd7e0a36d6598500e05d0d6cc8c850bb8745e4f26051d56698cf67a821268b5f87811fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934936, "uuid": "e7db8660-9e88-427c-8dad-a254357d872a", "value": "T1DB95232853C84B01E6FF5FB43860905145B4B702EC17D79EB6D0618D8AB7B8AD732AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934936, "uuid": "9b88afc1-6091-4ccf-8043-c83508f8538d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934936, "uuid": "438995c5-f659-49d3-8877-c8cbd851830a", "value": "49152:M+a5csqCeq08moPajSQY5HYryHACW74M:XzCj/mosSJ5Hoygw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750934936, "uuid": "f8015a41-d839-48b8-81c5-83048b3ba777", "value": 1913344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750934936, "uuid": "0ad5af72-5787-409a-9c65-7d90d3ba4296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934936, "uuid": "cfcfe65e-25e8-4489-88a3-62298b00f2fa", "value": "trails.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2066201c-52de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750977442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977442, "uuid": "f2a2827c-ecb6-4349-8db2-99bb89968a5b", "comment": "Malware payload", "value": "1f2be11f7b8424f70fd75ad18d7865b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977442, "uuid": "812f0dc4-fc49-46d5-baf8-25b31fa4b8f3", "comment": "Malware payload", "value": "07917bccd05308bca39c8ca38022b0f996414b371ce53f48087a7a541c0e3b71", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977442, "uuid": "3fa9ecdc-d042-4318-9cda-0c08d4c28204", "comment": "Malware payload", "value": "e783610776196a4b3774bfd1ebf3f164149ba219", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977442, "uuid": "bb2f3364-dbc3-44b9-b85e-2d390e45d4dc", "comment": "Malware payload", "value": "8c79bc83b9bf4f55b93a5ddd956f1a3f5cdb6c116dc558e055f12ee4b10e07a26521ff89db597b22ae874991f8b7753b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977442, "uuid": "5873f897-b88d-430d-b1dc-eb33a7db0dbb", "value": "T1B131C8CE31A18A706CB4FA2B31A5481579D5E5DB54E71F2C2FEC39E544CEE087001B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977442, "uuid": "3b151480-80e0-4d94-be72-c8cdc2b12616", "value": "48:1FcxFc9Fc34EFc7JFcdFcZFcuUFchFcNFcavfyFcaIjFc1Fcw:1FUFAFA4EFoJFwFcFvUFMFAFFiFFCFAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977442, "uuid": "f3cd02a2-ee10-4ac5-8e6e-3b7ea07fc404", "value": 1629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977442, "uuid": "70cd891e-992f-4a4d-a364-8df47b92a7cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977442, "uuid": "85dfc2da-6205-4684-9914-5149833d4d5d", "value": "sex.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c76cbd-5242-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750910468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910468, "uuid": "cad27265-0336-4922-b458-942d6e376523", "comment": "Malware payload", "value": "09c07d811b94010d1e712897193b9d9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910468, "uuid": "c0698b89-7506-434b-acd7-36d9bdc0efe8", "comment": "Malware payload", "value": "0957be487b286cfe627f4a46d50e69e95f4da97202e09f5467fec668b92b1c0d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910468, "uuid": "93ac12f1-6af0-486e-8a67-1a8a4043be4d", "comment": "Malware payload", "value": "bbffdcff3c1caffc6f1bb0a0d6b91aa52804c4a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910468, "uuid": "b96a5d3f-eb95-4fc8-8969-a2945a00349b", "comment": "Malware payload", "value": "2361e3639bb2535ef80a95ec4813f5e8111d65f5c7546b4f9da551d729b1c4be7973cccd027d5ba308d7c1cb745432ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910468, "uuid": "62e4ed38-4782-4fcd-a8cc-9a8109fb72a4", "value": "T15FB402118F881F8BC5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910468, "uuid": "4f01ca5d-e048-467e-924e-ad0bf5081c6e", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910468, "uuid": "e841746b-e124-43a4-b629-835ebc0d351c", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910468, "uuid": "02b1bc80-8f95-4637-bdfa-931061d26eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910468, "uuid": "b888e7a5-74b4-47c1-a1f2-7fb9f6c91723", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccda236a-52bc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750963129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750963129, "uuid": "a8f130cc-2e63-4d82-b0ed-bcf68b3cfe07", "comment": "Malware payload", "value": "120c6ddfe74bb7c97faed86093d74020", "object_relation": "md5", "Tag": [ { "name": "alsuva-net", "colour": "#0035F7", "exportable": true, "hide_tag": false }, { "name": "caturo-net", "colour": "#63BDE9", "exportable": true, "hide_tag": false }, { "name": "CryptoClippy", "colour": "#CC7548", "exportable": true, "hide_tag": false }, { "name": "documento22062542801-xantoplex-com", "colour": "#826AC0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "xpv-qmxhuf-com", "colour": "#2D7688", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750963129, "uuid": "2fb96fb3-d699-45bd-9642-80d7bc2ca25a", "comment": "Malware payload", "value": "09fdbe63107b559f4f5284b513214b447de8ed724cd93815741597bb00bf4b63", "object_relation": "sha256", "Tag": [ { "name": "alsuva-net", "colour": "#0035F7", "exportable": true, "hide_tag": false }, { "name": "caturo-net", "colour": "#63BDE9", "exportable": true, "hide_tag": false }, { "name": "CryptoClippy", "colour": "#CC7548", "exportable": true, "hide_tag": false }, { "name": "documento22062542801-xantoplex-com", "colour": "#826AC0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "xpv-qmxhuf-com", "colour": "#2D7688", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750963129, "uuid": "b30f2e84-82a2-46d6-af0f-9616a14d8146", "comment": "Malware payload", "value": "70f1ce60cd28a454f6596ee627c4b5f38b2c8431", "object_relation": "sha1", "Tag": [ { "name": "alsuva-net", "colour": "#0035F7", "exportable": true, "hide_tag": false }, { "name": "caturo-net", "colour": "#63BDE9", "exportable": true, "hide_tag": false }, { "name": "CryptoClippy", "colour": "#CC7548", "exportable": true, "hide_tag": false }, { "name": "documento22062542801-xantoplex-com", "colour": "#826AC0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "xpv-qmxhuf-com", "colour": "#2D7688", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750963129, "uuid": "44e82cc9-6afd-47d1-9ca4-89a29ff80b76", "comment": "Malware payload", "value": "47b6fcc976f467d1628fb4aec1432b36769b81d63f4a1c4521933e078f34374afd745f03bf49012ba7663252c652adbe", "object_relation": "sha3-384", "Tag": [ { "name": "alsuva-net", "colour": "#0035F7", "exportable": true, "hide_tag": false }, { "name": "caturo-net", "colour": "#63BDE9", "exportable": true, "hide_tag": false }, { "name": "CryptoClippy", "colour": "#CC7548", "exportable": true, "hide_tag": false }, { "name": "documento22062542801-xantoplex-com", "colour": "#826AC0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "xpv-qmxhuf-com", "colour": "#2D7688", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750963129, "uuid": "3fadac76-f35b-4334-b6c7-d7b17c202161", "value": "T1B0E2B7173644A331C54203328A2FE3E54B35AC589F671522369BF39C2F73AE065B7AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750963129, "uuid": "6369d4d5-b93c-4e8a-b63b-3a77e664d069", "value": "384:+ilKjcZC2o7Jey3M5BCyx5Pey3M5BC0ioXoxv:kC5+eWMDCeeWMDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750963129, "uuid": "d52260ec-d61f-4b48-b4f7-055f1ee9dd6a", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750963129, "uuid": "48d8ea61-0f8f-462e-bc21-080d57ca67d3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750963129, "uuid": "339dba4e-0acb-4422-9e5f-b47ed5905bf3", "value": "pm-IPLF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b98beb87-52ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750956224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956224, "uuid": "51644d11-0732-428b-9b0d-133306bde4c5", "comment": "Malware payload (Mirai)", "value": "4a762225919f8e1db2f69ad5acbb0f45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956224, "uuid": "d8e31aca-4dbe-4b6d-bc7f-f967ef3bc41c", "comment": "Malware payload (Mirai)", "value": "0a17e204ab1a716b0d03020e98d1d92fb0315da992d526543b2ad39d843a782c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956224, "uuid": "846382b8-b1be-45e1-9631-e9ff2cf8d3af", "comment": "Malware payload (Mirai)", "value": "170c593a99506446268ec6d6dc65d939d95b4fdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956224, "uuid": "4d299d32-6a35-405d-a900-f83e94d22d73", "comment": "Malware payload (Mirai)", "value": "29fe2656b5316fb2cc8ab16d4884e21180d0a6865c5f84b8fc04dc6c2e1eab3813048a1a9166a9d22d54122dfa8cb624", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956224, "uuid": "88184680-1ab1-4026-bcc3-8803a1fcafc9", "value": "T1B5148D79A82C42EFC07A477F1E4752342F36DEAC1B134B686B2D6A348D523348F5999C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956224, "uuid": "4e0acc74-57db-4ad8-9fc2-8a2132fcdb89", "value": "3072:+NS6Smk+bzJomMfKcZgW55PYiqRluqtIJirQ03SBW:IS1+ZomvcZgW55Pzq2qeJikISBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750956224, "uuid": "8c6542b6-2de6-4c04-933e-83c3a8ebdc7e", "value": 197240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750956224, "uuid": "539c7b61-2dcb-4169-8bc6-bc6b6885cacf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956224, "uuid": "94faf8a2-83ad-4364-beee-282c28efcdfa", "value": "csky", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fff0312-52b0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750957846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957846, "uuid": "568dfae2-21b4-462a-92d8-babf916aefb2", "comment": "Malware payload (Mirai)", "value": "340fd3ac9e113fdaf0f991fafd986ac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957846, "uuid": "32761df3-619d-404a-a938-d4b0deb47a04", "comment": "Malware payload (Mirai)", "value": "0a4e9303a9f9b28bd61cec449a01c5a7f9e373255983cc89a18cdf625220dff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957846, "uuid": "b2ba2208-5ac1-4456-898d-241484e29f6b", "comment": "Malware payload (Mirai)", "value": "5a144b747d8410903f762eda80e436f429942089", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957846, "uuid": "59918a17-ed7e-4e6f-a929-42f81994b609", "comment": "Malware payload (Mirai)", "value": "30912e46aefb08f822e7a24967f2c4869e7b672a668dead3beec0b5d7a980519f08a1a6a287edfa100213c731154f695", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957846, "uuid": "aa606d22-7b2e-4278-a364-17fa8c84c683", "value": "T1A3D3AEA7B34F1450C82606F417CB57AD2A3325014F7B96E73C6F763A1A3B9DA580A3D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957846, "uuid": "00de1237-0c74-4e7a-a122-1235ef161fb9", "value": "3072:C62OV99eX/DAlgMONorhPTxb4+gGT9NaHbKz8GGW/giCGlCttLyiWBq:C62OV99KDAlgMvlxbCI9U7q8FW7C8Ct7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957846, "uuid": "b6c47056-10e9-4779-b387-17426f3ed2d0", "value": 141324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957846, "uuid": "4dcbb683-cd0e-4019-974a-94d2bf5f5f89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957846, "uuid": "dcc820ed-38d6-42bc-b24d-158b02917ce9", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59db951-5277-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933562, "uuid": "90a43b2b-aa7b-44d3-a0db-cf6d6011c687", "comment": "Malware payload", "value": "e48431ba5aa7a42ae0a32eb7d859d7a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933562, "uuid": "39c868d4-0195-4660-84c5-c2f4ac6d38b1", "comment": "Malware payload", "value": "0b85ad058aa224d0b66ac7fdc4f3b71145aede462068cc9708ec2cee7c5717d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933562, "uuid": "a6dd52da-faf9-41b1-9a94-0e4bc5850e40", "comment": "Malware payload", "value": "8a14d44743af6a702c7425f80f38d21e4ae8e05a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933562, "uuid": "7b28781b-e77f-4858-85b9-392776d588e5", "comment": "Malware payload", "value": "6fc3951b61a3d53f4536b9fb0750532a275a86eec942052fdabc313d24f3e56b1d3534998c1b3b20ef5b9a0847cecf2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933562, "uuid": "1f14fc91-90d1-43d5-89bf-c719b9accec0", "value": "T152243E43A15001C8E86EE12D1142A51BE5F338E1CFE1B54F2612EB5F39D2EB23ADD5AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933562, "uuid": "3523f1ad-1e69-4baf-a59c-6b2e8603378a", "value": "c5dc0a3ab3f22aeaf807779d165c2e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933562, "uuid": "05b7048b-a4a9-4267-a4b9-782a4e7064d6", "value": "3072:xWPodyZ9vzOpGfrl3zzNeYGjwKlIJVq23H4DX+atH3EIEC9GqBVSH15Fqe:QwdSLrB3Gjw0IJvna9XERqBMpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933562, "uuid": "8113da86-c660-442d-86b1-6d3446aa2edf", "value": 211608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933562, "uuid": "f327d295-6efe-4185-80f9-6c3cca2bff76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933562, "uuid": "a6882042-7150-41b3-9975-41dd741da2ef", "value": "PuTTY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfe36a6-52b7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1750960956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750960956, "uuid": "642e1cbb-3bca-44ca-9493-2ff15148a053", "comment": "Malware payload (Gh0stRAT)", "value": "c98ff1a58269abe50b586af03c7efe3c", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750960956, "uuid": "9281fd41-a046-4b32-86ff-ecb54321b71b", "comment": "Malware payload (Gh0stRAT)", "value": "0c6f9f6df4b27e2d56345389f30ddc6e81ac59788429940fa8246e0138cc891b", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750960956, "uuid": "e26d1219-f641-4190-9bfd-e606c187eb67", "comment": "Malware payload (Gh0stRAT)", "value": "2c223edcac71e7ccbf05435c1921acfbcfcfe040", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750960956, "uuid": "595e733e-69fb-4d5c-8604-524e48124a5a", "comment": "Malware payload (Gh0stRAT)", "value": "b5880629994450409789a140c717ce6c03f24cf4fb8bf02ed6117544617b9195c34ec85eb3e589b00aa992890d7e3654", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750960956, "uuid": "46394ea1-a19b-4abb-b398-abbd3cf8f19c", "value": "T1F418336FE69A303DC166733542B3B20024FBFE9DF5127E1A2AE4D444DF611852E7E622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750960956, "uuid": "67e10b7b-7be2-425e-8eb4-b76cc6c31cbb", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750960956, "uuid": "36ba6be4-e631-4e7a-a8b8-7409e595931f", "value": "1572864:p9TTi/U/SkIHd14iC50IQGRUgZw5Y9tUcaOvXcK5t1RawEvA3pmKofRki9:PV/dIHd1dN6Ugi5Y9tUniZt1RawEI3pY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750960956, "uuid": "b3ad84c1-676f-4a26-a8ca-4992a0369f9d", "value": 92436069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750960956, "uuid": "57013f3a-e335-4125-81a0-2bb147ef8d97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750960956, "uuid": "e891bfbb-f943-4ba7-8d88-1ed93f30a41b", "value": "orfkkr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd52c92-52d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975557, "uuid": "3d74d6bf-a713-4f26-ba38-976f12e46e9e", "comment": "Malware payload", "value": "f430f97a736cc8c4aadb3f01d1a334bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975557, "uuid": "c818ee33-4643-4ab3-8e10-4c5699f28d49", "comment": "Malware payload", "value": "0c8bc192101eed4a2a054cb070df4a22beda91eee15eb7eb78e0f76302d0bed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975557, "uuid": "6ffd4fbe-5505-4bde-9ce8-37e0b1a136d4", "comment": "Malware payload", "value": "f96f6269ebb770699171e33c2eed7027b461096b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975557, "uuid": "d9e63b29-863c-4f7f-b965-451fb1fcd3a4", "comment": "Malware payload", "value": "a85f40696bf78d8365b9b8cef734039d6c1d0284a74ed196636e7c2264e03ee7112544f66d2a92bf033f9d17b1958c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975557, "uuid": "c7b3827f-9ec7-4e44-b92c-0f6b7075e681", "value": "T1C2A41294E9819B62C2C801BFFF0F41BC77A31F69E1EA71068D16EB2662D745A4F7E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975557, "uuid": "570b6209-7dc3-4804-989d-58a0d3e4c357", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975557, "uuid": "c087d43a-5ae2-4f5b-802f-ab65ca28752d", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975557, "uuid": "f9706716-f3e9-4001-91f9-252b32a01982", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975557, "uuid": "dcd9ceec-92ec-4197-bc7e-e7b2150020d3", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aafe23-528d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1750942769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942769, "uuid": "12003c74-9624-42d5-9237-5c923c76a935", "comment": "Malware payload (SnakeKeylogger)", "value": "c133a40d81bd619421e07f7114b4bbb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942769, "uuid": "f7e09ad3-78db-4a15-95a9-e7321f0071c8", "comment": "Malware payload (SnakeKeylogger)", "value": "0ccfcbd467b949b1658d188651152bcc945adce590e0e15f39967da1813d5186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942769, "uuid": "b541a68d-0252-4880-9bc3-a8260413dd51", "comment": "Malware payload (SnakeKeylogger)", "value": "c24cfa68896729261ce37769771a82fbaa0b65b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942769, "uuid": "653fc0c5-f1d7-4ae8-bd2f-55a009431a86", "comment": "Malware payload (SnakeKeylogger)", "value": "9f750619faa88528915196fda49ae6418c813378c17e3df248c9272f2280a10eadbc4d68954415f2650f3fa804263bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942769, "uuid": "87f08cd5-dba8-4402-b01e-9fbb166544f2", "value": "T17735AE0273D1C062FFAB92334B56F6115ABD79260123EA2F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942769, "uuid": "81ba529a-3906-484e-a8ef-6f2cee4bf1de", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942769, "uuid": "50a6531a-a185-4a9c-8cd7-427f5936e983", "value": "24576:N5EmXFtKaL4/oFe5T9yyXYfP1ijXdaiVZWC0W4T:NPVt/LZeJbInQRaiVmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750942769, "uuid": "b932888b-b31f-4aae-ac59-b63290dda6c2", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750942769, "uuid": "6648e485-781d-49d6-ac99-17ef0eb73a06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942769, "uuid": "e875d934-a769-474e-8b75-763326cd9e0c", "value": "NO.482515-RTM166 CTNS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b607b4-5248-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750913168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913168, "uuid": "6129add6-ba35-4258-b69a-7f03bb82f148", "comment": "Malware payload", "value": "8f27084a9539f8f3f2169e6102f4ee3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913168, "uuid": "e1eec3d7-81f5-4aac-854e-3b6a40147fd2", "comment": "Malware payload", "value": "0cd8d20f723f99445784df2954bbca115bdd89379af3ecd456d6c18a48bdbb56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913168, "uuid": "abc88df1-a15e-480b-8330-c4d466a956b9", "comment": "Malware payload", "value": "1cfb3798442d9c8c05a0c1cced9eb7042d5a44c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913168, "uuid": "edfff306-8014-454c-ab0b-96080465c7fa", "comment": "Malware payload", "value": "c77b4ceab8679292827e346781512428bb73dbeba47fe1af36ba274541eae8dbe6662af10f9251b28fda12272fc37d86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913168, "uuid": "8fdf5583-7b77-4a9e-8d52-61e2ad196a09", "value": "T190C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913168, "uuid": "b79207a9-189c-4c51-a8ee-d7b16031fe3a", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zz:W7v+mrY2xzf03yvZ/YIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913168, "uuid": "eddf34f6-8331-475d-acf9-cd9832f3d9e6", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913168, "uuid": "b28000e0-09ff-4c51-8913-3d4ed062ad93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913168, "uuid": "a0748e9f-ae59-4a99-833f-ab2f2fa89078", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3e55f2-527d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750936041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936041, "uuid": "2f38b410-3401-4768-afa9-41f7e1111311", "comment": "Malware payload", "value": "07f1d0c53915907db57048beaa8bf2f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936041, "uuid": "8d6a31b5-2749-4dd3-8cf8-02d2627b2bfc", "comment": "Malware payload", "value": "0ce237c6e018e7d977e876dc3bc24a1f95fb315078c951c6ae31561dd8381618", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936041, "uuid": "35a15685-565b-45f1-be7b-512674d18764", "comment": "Malware payload", "value": "a57d84a243f44cbb9cde1a2219773498924b98a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936041, "uuid": "486dfa86-ea5b-4248-8990-dab4f8f2707d", "comment": "Malware payload", "value": "83056674ee2162051b285a73d2de70fd628065b63f5fce1069ee0c18d485f4333064db1e42b3353175522955e30f069a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936041, "uuid": "26e13ee8-c99e-4e1f-a08f-22eda98b3c4b", "value": "T124B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936041, "uuid": "309a506e-7dc1-46d5-9a28-a557e0f12dee", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750936041, "uuid": "57b89382-b954-42b1-9895-41038f7bb2e4", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750936041, "uuid": "11158637-a318-4176-aa36-374981066dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936041, "uuid": "1547dd7f-f8f5-4c69-bfc7-ceede29a9366", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236e7752-52b1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750958120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750958120, "uuid": "f0f7afd5-6a70-4371-9cdd-ccbca17b3da6", "comment": "Malware payload", "value": "f57459c1eb5d2740c7248c3ee95db589", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750958120, "uuid": "e56ac8a0-01d8-4c89-b350-d8fc17113f23", "comment": "Malware payload", "value": "0de39f3447abe899232069d809176c9c34da313715bc36a50333a88b5bb2a185", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750958120, "uuid": "89d714c7-147b-48ba-99e0-2de79a41c713", "comment": "Malware payload", "value": "d48210dff1bdece319e81b20c7a0d9b288b38841", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750958120, "uuid": "79dc1143-36c5-4fae-932e-ebf9927831b2", "comment": "Malware payload", "value": "4e29a73a96e0258e565a5612f65ca3195aafe4cd379858e5db9c7d6038634ca3fa8c04dfb5e8e788b4634093024f98ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750958120, "uuid": "51a5f5cd-5301-416e-8c68-62aaae99d654", "value": "T156B402118F881F87C5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750958120, "uuid": "f00e4616-5740-4fe0-8c3b-a040af0c158f", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750958120, "uuid": "0356f1ec-72cb-496c-be09-c53d60a6529c", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750958120, "uuid": "03ed8dcb-c063-4d22-8627-a53738d4d09f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750958120, "uuid": "b65eb452-ad10-4a88-9219-d2cf1bab15d7", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21bdae8-5279-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750934361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934361, "uuid": "4efeb402-69e8-4699-8d39-2b4f52f4a360", "comment": "Malware payload", "value": "840365f335f095e0d4b9f33dbfa89bb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934361, "uuid": "7fdba0ba-b6bf-469c-9b23-21f24fa12ae9", "comment": "Malware payload", "value": "0e28460f89933e84af530b3426141f2e13aa6205086756ce32baeaf5b0a982bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934361, "uuid": "5a4f1365-1a46-4833-b848-1bd9c9684fe1", "comment": "Malware payload", "value": "83c5916ad0b1f4461f7e60b15c19c3647bf104fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934361, "uuid": "5a716929-aecb-4997-a14f-54fddd4e0611", "comment": "Malware payload", "value": "c8303f538ab9bfdf6073d16b9bae457eba0363fa921cec28c6621a5be1c26626bd6fe8ce17b294a411addb7ebc490d15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934361, "uuid": "918ed676-6e2b-4e91-bd13-55e332fcac46", "value": "T149A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934361, "uuid": "15805d1b-ebf7-4765-bf4f-24e9de328d07", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750934361, "uuid": "acb0dca5-8447-435a-9df7-869c765ba610", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750934361, "uuid": "b4f636a1-f3f5-4b22-936f-24fca1a03b82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934361, "uuid": "c7e465a7-6c8e-4df0-9dc0-dd341db46e1d", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a5ad87-52e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750978287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978287, "uuid": "3b69be9e-5121-4421-b416-b201b7726b6c", "comment": "Malware payload", "value": "32bedc56a767bbe741ee04fd5317927e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978287, "uuid": "fa77e4df-34e0-4bd9-8681-8545241b822c", "comment": "Malware payload", "value": "0f55bd5c33d405f2a6eb7f7a2ca5392194464ef6964bd9280aa5ffa4c2152717", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978287, "uuid": "2e0be8ef-3059-4e8a-9fa2-0e57fd51d66e", "comment": "Malware payload", "value": "6e1e317fc16016915f3bfb31896586188104ac9a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978287, "uuid": "e93fea8e-668b-4f5e-a3bd-15ac7239b0fe", "comment": "Malware payload", "value": "b12585e00dac5a0e5a513395c17d5aab2308848fd3ae05da68d3a78be840db8e162eb60a86063310be488cfbb10a46b3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978287, "uuid": "dd64e360-dba6-4c90-9ddc-e30b4965d3bf", "value": "T14221928FC36D4D020569CE01F016D6ACA901C4C8A9FAD3E1F860DB724E871307204B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978287, "uuid": "687c06d4-74f1-4591-8032-000915b09a64", "value": "24:3J3eh33IMhwSIVhxNIejIohKLK/I/hiAfIkOhmwI7hysIXhft9ICh9lI6h7n7nIO:Yh34MhwHVhDkohKLJ/hiFkOhmZ7hy1XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978287, "uuid": "e5fe1445-0eb2-4b39-9d0f-a9aeb87c5a53", "value": 1174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978287, "uuid": "39e1f1e0-aca2-42cb-b05f-146bc55150d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978287, "uuid": "37b5ede2-5b00-4259-96f9-4e6e1ff3e5de", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3d8b8a9-52af-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750957584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957584, "uuid": "a9e729fe-acd8-4f57-a14c-216d86f10a3a", "comment": "Malware payload", "value": "8e37753a372c90a9423210a835847a51", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957584, "uuid": "461b30db-9c5d-49ae-90c3-27c2192a21d5", "comment": "Malware payload", "value": "0f824d44fc3451ae342e2a64264e3b13d70eadcd009d876ca1683484a2cc2038", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957584, "uuid": "ebc10e59-471e-45b7-83ca-6cea4ad33ade", "comment": "Malware payload", "value": "d3d183dcd5a4aea2248534797c783585c2976b98", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957584, "uuid": "8169d45c-f9ee-47da-9f27-57a75ea2ce60", "comment": "Malware payload", "value": "5db411f4fb65c27ec53dfd629089a1ca25f31b10d6f8ade8c9de1beb88608cd2f38a720581bfb7399e66a4d60ae99431", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957584, "uuid": "7f5f3789-c486-4942-80bf-05efbadca4b9", "value": "T182220FCE1290F760CA868E477E62A5C9D145D6D47CE23BCEE9DC98AC52C6FDBB041831", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957584, "uuid": "1f59c5b9-db34-4d9b-adeb-36d5322099a6", "value": "192:2IYlSw5oassDoEUc5V2n3ipdpFpEjvqVVQZtz6ZBOrnXZBOrnh5V2n3kpdpFpEjt:jw5oassDoEUc5V2n3qXvEjvBU5V2n3Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957584, "uuid": "86a29c8f-ef03-4941-a8f7-b4bbbaa66882", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957584, "uuid": "96eb71e1-43f7-4050-8759-daf093c24d3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957584, "uuid": "16ad471e-b1b7-47a2-bae3-b36f40c2fc67", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a7aefa-529f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1750950443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950443, "uuid": "2917b42e-e7ea-484c-b7ef-931f4744ae4c", "comment": "Malware payload (VIPKeylogger)", "value": "4a139bcc31cd675c8ad4de70c8a98338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950443, "uuid": "0f8a0f8a-789d-474a-acb5-e60e55926d44", "comment": "Malware payload (VIPKeylogger)", "value": "0fb23b46d07fde7bc640a6cd0165db0df3096482eee913bda834b531d72cbf06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950443, "uuid": "af9193f8-e634-4d02-a1e3-42a30b1ad9dd", "comment": "Malware payload (VIPKeylogger)", "value": "2629339ca2913cc56c74255eeded19c2a1084729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950443, "uuid": "9aa1dcd7-6d31-4915-b9d1-dd977fc1cc33", "comment": "Malware payload (VIPKeylogger)", "value": "0098e75a059b74ed6e05e053c681a1ca30ad2366a871b6ab827572e7f547b3ae93f1ae5d5935714940077cbf1e82affa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950443, "uuid": "1607c417-e635-48b7-82ce-656f94b56723", "value": "T10AD423102150D079D6031AF44837C27A20E0EEBDA956AF077B64BB6E3572B94AF4D7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950443, "uuid": "e59b3cad-7067-47a2-b216-fb34f9ed1e99", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950443, "uuid": "c950ef8a-e1aa-49c6-a1a4-15d66b7eb4f5", "value": "12288:tXhQC90JUzlvCihqAT2ZKaK8HiFss//uy4W4hBRyUvbcVU7CrJzqq8bwL7eK1:tXhQi0ipT2Z5HiFv/soBUkHSI7eu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750950443, "uuid": "44d5fe3b-6f9c-435c-923d-f7a67290ee26", "value": 653848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750950443, "uuid": "3e709342-73de-43da-8107-5b23c44a2f9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950443, "uuid": "72bd6850-4778-4d48-8389-4fb42f36a567", "value": "factura-N11088966575pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d074a0-5258-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1750919973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919973, "uuid": "668b00aa-cf5d-4881-b2a4-36a297fd85ed", "comment": "Malware payload (RedLineStealer)", "value": "02820b28110c19f3084ba705a39e4956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919973, "uuid": "e14ef45d-42c4-45b4-9dc8-556a16de6a51", "comment": "Malware payload (RedLineStealer)", "value": "106c6fcbfe6af29e20fa66915f533e4b38e2fa103b8b4d7ec88295d8fd511764", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919973, "uuid": "2c728708-76ea-4e43-9b53-47dee55e4910", "comment": "Malware payload (RedLineStealer)", "value": "72e4baa41ad987502daeb9cdcf83393f38141826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919973, "uuid": "ba5be426-3dab-49e6-8331-eeefa71e213c", "comment": "Malware payload (RedLineStealer)", "value": "db64bce4a6b3755d9399b2b3d1e140ad19a17a7068fd267994f37a899dc2912bd6adfb19941da82c1243c85047a39d5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919973, "uuid": "648a9ceb-273a-4e5a-93ba-29a4184578fe", "value": "T14EE42351A7812820C3655370883ACD8089753DB1AE11676FC72EFA5E6871387FEB3B5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919973, "uuid": "37dbdf0c-a1b0-4286-8348-8ebb1d2ffe5c", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919973, "uuid": "f682579e-54e0-49a8-a7cb-0be3c40df466", "value": "12288:Qz7hU5I5yuNHIgzSFKxWltRohBfSTso93UcULNBcUkC8RJKGbMTOhXQNhjpl:Qf+iN57Gtene3aBQXRJLbPi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750919973, "uuid": "e2cb2aff-4736-49f6-b87d-b8367e97b17c", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750919973, "uuid": "1232f63a-2162-495f-9f1f-0f590b81492d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919973, "uuid": "6677f9bd-bbfb-4119-a9c6-fdd970f0dbf9", "value": "\u7dca\u6025\u8acb\u6c42 [PO_2689068_june2025] ST89076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6900d719-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750977994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977994, "uuid": "0c1224e0-040f-4217-a936-40fc7d862c3d", "comment": "Malware payload", "value": "cc882400bbf1e96d5f337a316a347137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977994, "uuid": "41aaa86b-5e35-4ec4-a7d7-13859ee1ec36", "comment": "Malware payload", "value": "109fb8ed8daf0bf8a0d959193b6f6076897b8bdf889fe7cebe215b0adcc56812", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977994, "uuid": "24de1b94-adf4-4d77-a7d5-10a1ecbd4b04", "comment": "Malware payload", "value": "410a711b2cf58006659bdd4dfd63a65fb0486b9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977994, "uuid": "adc994a4-2be2-48ea-af8d-307b15855f26", "comment": "Malware payload", "value": "24174857a4c166b8a4fc7fcf1a1f639a8804c72093af63fad4ea4c8b07eecdd9d37f52d90a3b1a893201ac871efef096", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977994, "uuid": "1378eb72-844b-4e5f-bc8e-2791a3f7a1cc", "value": "T10A03F131C5A1EF9BFFAB7E71AF3682C2739A075A3783087321801701398E4159916ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977994, "uuid": "041a4528-4416-4ab9-aa84-ed03cba36341", "value": "768:a/WfOwEzy7+j/UzxOf4Ebq0RDknyn3utwBdwe0pWii/2Lq4uVcqgw09r:a+A/TaxOf4Eetyn3Ye0pWJ/kq4u+qgwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977994, "uuid": "2eab744b-0c0b-4472-8be3-2e52ebb4d401", "value": 38168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977994, "uuid": "d8ec5c94-79dd-4174-9d4b-901562d3afe4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977994, "uuid": "91ebdfcc-cd51-4ca1-a631-5d6040438cc6", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79fbfe42-5255-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750918752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918752, "uuid": "b7ae3b07-4850-4f00-99e7-62cd5224016b", "comment": "Malware payload", "value": "d4ba424e6371652640c68e56fa7b873a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918752, "uuid": "943de21e-613a-4e1f-b20f-c799a75df4f0", "comment": "Malware payload", "value": "10f719adad81ab4634f277b173d59777faf8a8e27288dc7d8b9f13b0129d29cd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918752, "uuid": "1176ea46-d8b4-47bd-b76e-fd2ab8b9783f", "comment": "Malware payload", "value": "f2a922e7de49ad6f130cd7074f7abec28c8718aa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918752, "uuid": "91029d5f-0e5b-4db5-b918-cd51b922ae8c", "comment": "Malware payload", "value": "f20ae4631c53402449086cda0a72f57a258524a0b1bba9f5d36289f82627f654669e362bdf5d678b6e405a3e0a946e61", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918752, "uuid": "5ee932b2-bd2a-4e5f-813f-acb7da0988ee", "value": "T1FCE0273295B88C53D0950A70350D01D7C90AD0DDC1D5BDABF33562F27D034643F49B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918752, "uuid": "079a2fd3-e3f9-419b-ba30-be3c140e7f43", "value": "6:5j0lRImwT/b/nZeAASRhjpSN/uWYvPPjLK7yGKx0lqTIm3t+l2/:5j8RIFZhzjpouWCP7Lx2qTIWtam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750918752, "uuid": "e6a634f6-b387-4957-824d-3e7776660166", "value": 302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750918752, "uuid": "1ebc27ae-ed48-450c-a5e0-10f7449d6d02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918752, "uuid": "bd3b788f-e457-4fcf-96cd-018b7b03c312", "value": "Purchased_Receipt.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d905ab3d-527c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SSHdKit)", "timestamp": 1750935661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935661, "uuid": "a877cb26-ee26-46c6-b6f6-b6d36cd1f721", "comment": "Malware payload (SSHdKit)", "value": "c475cb5b4f4d57724e2af99851bc2827", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935661, "uuid": "8f809126-22e6-45c7-888e-3bcde01955f7", "comment": "Malware payload (SSHdKit)", "value": "11af3c9e3c824624726b2998e7c8409fa6a1a1e91ade93ab2fdee8b83096f707", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935661, "uuid": "11a81c54-bdff-41b2-9574-479f65b3d8a7", "comment": "Malware payload (SSHdKit)", "value": "1eed136e0ab79dc726b3a38e427aa0f714936b21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935661, "uuid": "53784d26-1bcc-4d0c-b438-7fec6df175c3", "comment": "Malware payload (SSHdKit)", "value": "0f2f1752b8ab459a975f4bcd34496d6491a1896f8eaf77cc726177623d744c4d77d564e95d81acaaef1ab04dfab38ccc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "SSHdKit", "colour": "#7E370B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935661, "uuid": "7a6e83e3-44ea-4fb8-ae5d-7cb7997a6559", "value": "T15C356D56F9808EA2C5D8177BF75D835833134B78D7DEB102CD08672877AB95A0E3B982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935661, "uuid": "57971912-8e34-46f5-9533-70f0146d4569", "value": "12288:E8dASOYRNCAJump208iJftl7zmnSrlcaUxQ5TVFQGl9eLtRajZa6ZTxIVL7bLv:E8dbbsO38+TfgRinIVnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935661, "uuid": "10218dae-4675-4056-a0d2-bb8812caf257", "value": 1110304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935661, "uuid": "7d3128f9-3319-4102-a3e6-ee6781b28e3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935661, "uuid": "de7b721a-21b3-4668-acf5-8b7ac84eb865", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b906e3f5-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955365, "uuid": "46cbec6d-4094-4d50-8662-3bb76b777399", "comment": "Malware payload (Mirai)", "value": "5fbbea86d214aa10f85ced817cb24084", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955365, "uuid": "9fd8cf6b-f259-4113-a464-c94eea901849", "comment": "Malware payload (Mirai)", "value": "1273cc5ed2c4331f1a596d2a706c2d669068fe6ca80816aaff534412f7f561e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955365, "uuid": "301b28a0-9d76-4b31-ad2b-7525ac62fd75", "comment": "Malware payload (Mirai)", "value": "9d48e228a41b5efe949285c0a5252f096ff53d31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955365, "uuid": "1bd77d49-d085-44bb-9b90-3b4c999196fb", "comment": "Malware payload (Mirai)", "value": "afaf72f0c8582b8ffef06f6d18b78a87756c65a414ee18ef77f8c41e2b71e662355cbf55afbce7b1cffba51362aee2b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955365, "uuid": "73ca20cc-78bf-46a4-a0cd-2303e5813339", "value": "T1DEA2D015D345AEF4DFEF9CA096C1C2C276F647C62786C8E240EEBF016916046FB89D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955365, "uuid": "d01aee14-da7c-4267-ab80-610939a7d994", "value": "384:7/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C58vtIM4uVcqgw05VxJu:7RxsSVsMD6xiJJE5zRWNSB4uVcqgw09c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955365, "uuid": "7458d51f-de91-437a-b163-78e7ef2c42d8", "value": 21892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955365, "uuid": "59d57b6e-7179-4e4f-aff6-34e39c915508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955365, "uuid": "77b2da03-f195-4cca-a939-6b4d338d4b43", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5044a383-527c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750935432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935432, "uuid": "25ef320c-ce59-4c42-8076-5e73354cf9fe", "comment": "Malware payload", "value": "e929c1670fe1260f88dd551ce6e6e1e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935432, "uuid": "b2bed464-5d0b-4ac5-9e9a-06209a2dca57", "comment": "Malware payload", "value": "12f454e9299d7c3b9067f2038ca21b29260996d6f763870d0ab8e5d41344e9c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935432, "uuid": "0d01ace8-b56b-47f2-a18f-25ab6efad84f", "comment": "Malware payload", "value": "89452551b56dcf8be75034dded818c56818266dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935432, "uuid": "77c6eb93-6668-4a88-b1a3-ba9263f04126", "comment": "Malware payload", "value": "55073113d95836515d0798b8f577f6442a3540086f47fb27cf63375082ee5c96aa28584127fe49a304e9b063d64955bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935432, "uuid": "cafc45fe-2499-4a2a-92d3-1b21c1f88567", "value": "T173E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935432, "uuid": "b0b066a6-5e60-419b-b6ea-bb52e7d87b95", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935432, "uuid": "06c260ff-5b07-485a-a124-c38488cd48b3", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935432, "uuid": "bb200720-c5bb-4bdb-a570-b758560d436d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935432, "uuid": "19e10379-89bf-4fe9-a2d2-e163410799dc", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb96a5f-5272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750931264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931264, "uuid": "c4ffed56-b597-42d1-918e-d001f90226d9", "comment": "Malware payload (Mirai)", "value": "3e3e94dd772d8549ec847ab6ff218891", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931264, "uuid": "64296df0-28a3-4266-8367-62ee0a0e5e08", "comment": "Malware payload (Mirai)", "value": "13e6edbfacd24c3e4d5a3a4bff579b6aadfa39d486e7312592869559ff7a3615", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931264, "uuid": "bd1df19b-593d-4ee4-9812-c541319ff212", "comment": "Malware payload (Mirai)", "value": "fc0a557c7c9852b5766d18705d49393efa33a2da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931264, "uuid": "04542e4e-1874-442d-b914-0f770b00a782", "comment": "Malware payload (Mirai)", "value": "a3ff13767a0f727b9cbf17df6fbfbca41f1be420d7c279c32506478419f51e8de1814dc8a27874129e5ee7e2550bc869", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931264, "uuid": "52d85e67-e56c-438f-9f66-72c3cd9a29f7", "value": "T11FD30745F9819F13C6C562BBFB4D428C372A1B6CD2EE72029D246F21378B95B0E3B146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931264, "uuid": "51e89702-af9b-4d32-8a89-6ea34067e00b", "value": "3072:tamHvRktn6QgKDwy5vxZb2F8ldKmTynBE91jiO2OP:hRkt6Qgy5vxZ9ld/TyBexP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931264, "uuid": "63865bbe-c7eb-45f2-8792-1e8527c7f9e7", "value": 137084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931264, "uuid": "4802861f-087d-45c9-9e49-5c4e263ffc8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931264, "uuid": "701534d5-8b68-4231-a31f-f0152824ae2a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24bcebba-5278-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933641, "uuid": "44fc6bab-247c-4d60-a496-af89b26d0aab", "comment": "Malware payload", "value": "c5ae3cad2c4f771cbe16179ac648c78a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933641, "uuid": "0b49872e-8283-4cb4-a26a-b229904593b0", "comment": "Malware payload", "value": "1562c4d2b98a3d70653d121340c82650212f1ee44baaf4ed8f20ca3fdd2bf258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933641, "uuid": "7b962ebf-4560-4b71-8826-ee3ebea471f4", "comment": "Malware payload", "value": "e032c576876284c2b523ad6359c2eef501a0c221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933641, "uuid": "4a526882-a2fc-4446-bb08-56f736c05726", "comment": "Malware payload", "value": "6b3c522ff165c21aeb37cd966fb90b615179da0e8063835e26f2efd1388e3241db1f7794b68f5d2ca224264b24426467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933641, "uuid": "36a74c91-ed6b-4fee-8e64-dada6955fcdc", "value": "T1F2E36F43A19011C8D5AEE23D5141621BE5F338E18FE1B04F2652EB5F39C2EB27ADD89D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933641, "uuid": "e4527e44-90bf-42a1-8704-e349775e17aa", "value": "c5dc0a3ab3f22aeaf807779d165c2e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933641, "uuid": "51851103-93ff-4f59-a3a0-96a74beb312f", "value": "3072:/eKYHVvrjXm2oTYq55+tDxpaxhXKPZXwW4BH6B5sNwLlse7X:GKYdX8b+chXKPhsCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933641, "uuid": "12edf4ed-762f-467a-b06a-3f5f8729462a", "value": 154768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933641, "uuid": "cb96f570-66d4-43c5-9da9-6dc3a4fc08a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933641, "uuid": "13816a45-2713-483a-be57-672f80dd5936", "value": "twain_96.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9566c9-5234-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750904666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750904666, "uuid": "d9ffdc42-43f2-454d-bf7b-063177c040b8", "comment": "Malware payload (Formbook)", "value": "f48b2703c89561f717165f787cdea51f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750904666, "uuid": "58b14a2b-6b98-48da-bc24-4671a4c7519c", "comment": "Malware payload (Formbook)", "value": "160096756f8da7a4062e730f4f7be5cb4c254a55b6e68332104707209c078781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750904666, "uuid": "5204fd63-4033-4392-aa09-785e860e7a84", "comment": "Malware payload (Formbook)", "value": "e3c8a8eb6adceccc3cf7bb8062773a9e75c8eee7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750904666, "uuid": "c15c8f2f-ac3b-4cd3-a793-9b01484fcd15", "comment": "Malware payload (Formbook)", "value": "5e4e17ff3b50e8aefa8b632164c048799e66025de69ac8c789927acb48e347b898c0fbe546964dd43ea2fe0ecfbf25d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750904666, "uuid": "fd951058-158d-470f-abad-029cc3911093", "value": "T1DA55CF0273C1D062FFAB92734B56F6115BBC79260123A62F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750904666, "uuid": "10ba913a-f66d-4128-9867-f4b675248729", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750904666, "uuid": "2b2443d0-1b62-4718-9b52-887232a5012f", "value": "24576:W5EmXFtKaL4/oFe5T9yyXYfP1ijXda5KIlH8L0zFlY7d+MS7:WPVt/LZeJbInQRa5NlcL0z/Yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750904666, "uuid": "63f18274-c30e-47c9-8729-cfe4e86c6832", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750904666, "uuid": "963c6741-a3bf-409c-8935-b32a13bec3de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750904666, "uuid": "c0b1bc11-e513-49be-9eda-04391b94d079", "value": "CHQUE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdb460f-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975958, "uuid": "1d22ebb0-308a-4f3b-9584-49800a7c745c", "comment": "Malware payload", "value": "fd6af3f3ce3a0ee6209bc46882b0aa7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975958, "uuid": "c3f39501-de01-45c4-b3af-290078a4499c", "comment": "Malware payload", "value": "1634d703dc8c5bf5a3dca0f71cf71a732b87b6318c4fac84e501486599126678", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975958, "uuid": "b5c7aba6-39e7-4366-b723-ad352affdc2a", "comment": "Malware payload", "value": "b783e3dc4f2e4255d7ea218776b315a222d9dd5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975958, "uuid": "ebf37ba2-5280-4d5d-9d19-cb0ea1dc1bda", "comment": "Malware payload", "value": "0cbad4e1a07c04d3dae2ea597aaa97963b757ed8cc074a071109048ecaa653d36eb1f147fcfab5306bd10bbe57dd8cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975958, "uuid": "f270ff47-3cba-4012-b15f-629dd8c2ddec", "value": "T198B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975958, "uuid": "6841754b-9c2e-40f7-96e8-98f27ac19fb4", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975958, "uuid": "12fa038f-32cc-406d-a78b-49b24ead94d2", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975958, "uuid": "e93d7ca4-b818-4f0f-946f-0ae15b1057da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975958, "uuid": "be5b6d13-1c0b-438c-b95d-067a6ecdccbb", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0e2f35-527d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750936042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936042, "uuid": "1d160cc7-6123-4d95-94bb-54ce4ea743fa", "comment": "Malware payload", "value": "b84d05ab2f57d0b93ca7ce050028dbd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936042, "uuid": "c0543003-a624-4abe-8a4b-58e6e0de6a2a", "comment": "Malware payload", "value": "1698eab2a389a4df2f3ec7970a9f2179b6cd38ff73b26887229980a6650d9ec7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936042, "uuid": "37b11e04-9056-43ca-82d3-db33badacb6e", "comment": "Malware payload", "value": "207edce9550ccde30f9c4670742999c6ccfaaf4f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936042, "uuid": "7b07148e-7b35-4e1a-9977-8cae0e5ab717", "comment": "Malware payload", "value": "235a9d3002b774d264866c80a3ae62e49e651711ecb2ef49d2a15de8920f815fbd36454427f954fbc0af28cbcd4e5560", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936042, "uuid": "7b43e1a3-b446-4c42-b6e6-2b1938f33184", "value": "T1DCB32849FC819B01D5E426BAFA5E51CD33130BB8E3EA7116DD211F2167CB91B0F7AA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936042, "uuid": "4a0e5821-3bcd-4ba0-b38c-f6a348a318c9", "value": "3072:K+RXcwzxJ53/8Udj2a3cksxD+6UT5ly3t4kcIj9qNrek:KSkUdjl3ck8+6UTLI4kcIjoNre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750936042, "uuid": "051835d8-5271-4a6b-b6e3-50ffdfa0c4b1", "value": 117532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750936042, "uuid": "699ce085-a2cc-47a6-9afa-94e6aff65a6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936042, "uuid": "3d3fbf49-cccd-48fd-8774-111907d284ed", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b394a2-5279-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750934359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934359, "uuid": "6c6f43c9-a13e-4276-8901-b60199dac265", "comment": "Malware payload", "value": "cb0eac29985e08dfad7471c95f75cf60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934359, "uuid": "dfcbd6ac-46a3-462f-8c2b-e0d3f7d0886d", "comment": "Malware payload", "value": "16ced39e7b2de7e91f6c95981e49a907f023cff163261c565167b8b7d2b9c210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934359, "uuid": "3a2f0a3c-df51-4c18-89ea-ad4aafd9748f", "comment": "Malware payload", "value": "1ee649d65ee1a4627dcf794a426d13d3b225a59b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934359, "uuid": "bf5b1c71-1483-4499-82c6-9042c9e3a414", "comment": "Malware payload", "value": "78a7e4dd4030937497504cd6ed83293cee6dba98031d20a1f107000cd569c49b6aba62da4f5bbbccf6e3bd2544e8d0f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934359, "uuid": "c234c065-2014-401b-a760-740aea5b5857", "value": "T165E4F1037308A756DF4BA83A82CBFD31B7C2799113D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934359, "uuid": "c86af7fe-dc25-4657-9218-3c98bd934f53", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750934359, "uuid": "9889742c-db89-46cb-9324-6a9b395327f2", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750934359, "uuid": "dfafb15c-0c09-4fd9-a303-4065f27b8384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934359, "uuid": "cba721b0-f5a7-44ad-8349-5bed25d02020", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d55bb3f-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750978001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978001, "uuid": "792dfa43-823f-4f55-908a-ca4d7fdad8c2", "comment": "Malware payload", "value": "ea2d7de90179fafc05a0cc4151fbd32d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978001, "uuid": "bce16a7a-4e67-455d-9430-335101dd0d18", "comment": "Malware payload", "value": "17f2222921714acae0d87738dd01794b4c598f236914c9e483b42236de0e9aca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978001, "uuid": "2a98d436-9127-4659-b157-9eb8362ff411", "comment": "Malware payload", "value": "077516cae5cc6a23adbed469d443cb1496ef5548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978001, "uuid": "6fc4b454-9e8c-459a-b0ce-196ea915166e", "comment": "Malware payload", "value": "d0eb2dd76692106cea99a6a36ee815c3d307ffff01e59e32b3d9730c3e15fc594a2176b9bf9cde83566151c5731ccfb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978001, "uuid": "e2940ef2-8d50-466b-81e3-68f80b13d056", "value": "T17A03F19194B10BDEC70E403228CFF96F4D28B405B66506EE96FD17B918B6FEE2362351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978001, "uuid": "bfe3127e-fdc6-41ed-a28e-5dc1c62dfe3d", "value": "768:j+b3SQi0CnbBmFME90tL3PuTnZ087fer99aO5NYowQrqRTnbcuyD7UHQRjD:jMV8UFME90t7uTnZX40O/YoNrQnouy8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978001, "uuid": "648b022a-6a0d-4fe7-a9e9-7a8567248065", "value": 39432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978001, "uuid": "129d946d-a844-4078-97ff-283674aba4e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978001, "uuid": "8a35cee8-1d7c-4a5b-ae1a-5a144fc8dbc5", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83b2fd2-5287-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750940411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940411, "uuid": "ef2c91f7-4f40-4bca-96e8-8416630ad038", "comment": "Malware payload", "value": "fda854cf0c060ebd5f90e2ec34f6af8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940411, "uuid": "9488adc2-0005-4df1-b9e4-2c244c567f43", "comment": "Malware payload", "value": "187dd331d17dc0d077806f2e9ea62488cba0607367060617d7e6f4e1b8f288f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940411, "uuid": "3e616136-784d-4f15-b51e-e944912b8d4c", "comment": "Malware payload", "value": "50f38b312635e45552a70dfb00a8874431e3750f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940411, "uuid": "b16fb151-7afc-40d8-9cec-31994db2846f", "comment": "Malware payload", "value": "b5be73cfd2a64a8bcd96fbbdeee40e10e6f045685694a97a4e1c05c363ce0f3c4b5aa7c9278e8ca3ef9490f8b44e717d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940411, "uuid": "0718a447-ee89-4bbd-860a-e4ff42bbb626", "value": "T1BBA40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940411, "uuid": "eaa97c61-3be8-4a85-91c6-ef8d8ec27718", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750940411, "uuid": "2e7d2268-d612-4ec3-86ae-dd2aeeaf5bcc", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750940411, "uuid": "5bc97cf2-4d71-4388-806d-d15506a171fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940411, "uuid": "8f71a44f-cd37-4773-9c91-18813e635067", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbe9a0d-52bc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750963080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750963080, "uuid": "d2cd59e5-cfe0-445d-9e35-aa98a4e122db", "comment": "Malware payload", "value": "6af041b58fcfd2868e186dd57e505c9c", "object_relation": "md5", "Tag": [ { "name": "alsuva-net", "colour": "#0035F7", "exportable": true, "hide_tag": false }, { "name": "caturo-net", "colour": "#63BDE9", "exportable": true, "hide_tag": false }, { "name": "CryptoClippy", "colour": "#CC7548", "exportable": true, "hide_tag": false }, { "name": "documento22062542801-xantoplex-com", "colour": "#826AC0", "exportable": true, "hide_tag": false }, { "name": "xpv-qmxhuf-com", "colour": "#2D7688", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750963080, "uuid": "6736692c-9b17-4ec7-9f17-0f9c15f3adb0", "comment": "Malware payload", "value": "18899b3afd5e60088293673411ca57a084116c03e1d38a6a80cfe18f4e123c38", "object_relation": "sha256", "Tag": [ { "name": "alsuva-net", "colour": "#0035F7", "exportable": true, "hide_tag": false }, { "name": "caturo-net", "colour": "#63BDE9", "exportable": true, "hide_tag": false }, { "name": "CryptoClippy", "colour": "#CC7548", "exportable": true, "hide_tag": false }, { "name": "documento22062542801-xantoplex-com", "colour": "#826AC0", "exportable": true, "hide_tag": false }, { "name": "xpv-qmxhuf-com", "colour": "#2D7688", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750963080, "uuid": "08838c12-b943-47a2-b67e-e9ed831ac9c6", "comment": "Malware payload", "value": "7caec7817676fdd6b54e18193ee9ba98f6ba02f1", "object_relation": "sha1", "Tag": [ { "name": "alsuva-net", "colour": "#0035F7", "exportable": true, "hide_tag": false }, { "name": "caturo-net", "colour": "#63BDE9", "exportable": true, "hide_tag": false }, { "name": "CryptoClippy", "colour": "#CC7548", "exportable": true, "hide_tag": false }, { "name": "documento22062542801-xantoplex-com", "colour": "#826AC0", "exportable": true, "hide_tag": false }, { "name": "xpv-qmxhuf-com", "colour": "#2D7688", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750963080, "uuid": "eeebc32b-feb8-446d-8ef6-cb5e608e9286", "comment": "Malware payload", "value": "307f2ab8b80655401459dd9c828679c067d4da4c6cc941f2c8747d66e70f1b27c7f5e38a09213fb6375ec07646f876e0", "object_relation": "sha3-384", "Tag": [ { "name": "alsuva-net", "colour": "#0035F7", "exportable": true, "hide_tag": false }, { "name": "caturo-net", "colour": "#63BDE9", "exportable": true, "hide_tag": false }, { "name": "CryptoClippy", "colour": "#CC7548", "exportable": true, "hide_tag": false }, { "name": "documento22062542801-xantoplex-com", "colour": "#826AC0", "exportable": true, "hide_tag": false }, { "name": "xpv-qmxhuf-com", "colour": "#2D7688", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750963080, "uuid": "185b002f-1007-408c-9ef9-fdc5bc78fc20", "value": "T109F05C87766D1690D0695970EC8EB6CD608DC4C10284BF1424A277E62D872D5AAAB272", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750963080, "uuid": "031eb8b8-1645-4c7e-9f0e-f02ef00272d7", "value": "12:5j3zav+vA3vULDDJIZwMlwlmhQuQpYrr7qa8:93AmqULPJIipq/7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750963080, "uuid": "00877eaf-b912-4afd-a239-18bd67e33247", "value": 465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750963080, "uuid": "fbf35ead-4c27-4576-b844-7bd021cbf95e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750963080, "uuid": "39e5771b-1689-4ef3-a3e6-75a82e9071d0", "value": "d.o.c-26062.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bdc6a9-528d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750942853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942853, "uuid": "40906bc3-e37e-449d-9d59-0808d5d61054", "comment": "Malware payload", "value": "6bb86df6f01b86c9a1d34ec9a1da36bd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942853, "uuid": "48add8b8-fe74-4497-986e-9aa879afa30a", "comment": "Malware payload", "value": "1909716f367471c89657e4789dc9d072099ad9705b02831cf221ac251a455242", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942853, "uuid": "05d49a18-069a-4272-959e-770a8b9d777a", "comment": "Malware payload", "value": "3b3d8590d4024fa04ac9bef4888aed85804b309e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942853, "uuid": "78596d63-0afb-4479-9c32-d3c6fd108391", "comment": "Malware payload", "value": "3d4234216b956efcc49e3cf76c7f43732918b436530ebee027cdd17c20c2ee5e6d20bd2859c8c81f2e896ec0f2933004", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942853, "uuid": "32bb56a8-699f-4d69-ad49-68dfd67aef28", "value": "T1A666121175CEC376E5BE813465AACB3A91F53ED10B7284EF53E0896E0E325C10A7AF52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942853, "uuid": "7376503d-44f7-494c-9af7-57ca7009fbc8", "value": "196608:0M+YyfVEuFBGQ1jH/IviVgJIu/ZW3xAC:0MXyfVEuHZR/AbJIIkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750942853, "uuid": "1201ef83-641e-4d03-b48f-b11e898061eb", "value": 6908928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750942853, "uuid": "ad9be60d-148d-449b-b715-6d6655f79df9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942853, "uuid": "6701d170-e585-4fea-8476-11820b3769a1", "value": "flashcenter_pl_xr_rb_165892.19.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6610e153-52e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750978418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978418, "uuid": "ea0eaebf-5629-4e1a-a3fa-f2d3c7705f44", "comment": "Malware payload", "value": "2b8addb2bb8f99944799453701e27e93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978418, "uuid": "51ea4e0b-8e4a-4578-8ded-14677fd219b2", "comment": "Malware payload", "value": "19830442415c8da0e3713a7746a76f1aa4feb0549362938b3ba48fdc126ade2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978418, "uuid": "59740136-aa8f-48fc-9579-f1ca9099f247", "comment": "Malware payload", "value": "f9257a4be33e36a89a2342dad79958e4faf83197", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978418, "uuid": "02996b75-0558-4769-8665-1abe3125be8e", "comment": "Malware payload", "value": "ac1608b84fae3bf471e2310e31b8ecf6936c2806c834ce0cbeae8c3b0ded54ef0a50dd47a1f7c520ab4085a162ee5bb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978418, "uuid": "2d93e7d4-dac6-4e07-ab17-036d19ff2304", "value": "T14FB41228EE4E3891F3D1E378DA0A4BB1B05B79D0C166C1B2BA41E25D95EDEDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978418, "uuid": "bb8c21cc-f8ec-4cd1-8615-ff6930b4a4db", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978418, "uuid": "eaf7a477-f5ae-4634-ac1d-c1971dc86fbd", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978418, "uuid": "e5a6598e-9700-4845-a66d-4a96339cbac9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978418, "uuid": "a0bdcc0f-cc27-4e9c-8f8e-69812a480d17", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3629ea0b-5289-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750940972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940972, "uuid": "1ec8f156-e954-40bf-93a2-f65caec22279", "comment": "Malware payload (Formbook)", "value": "3434e481c5c7e26dd7485ab9482f9fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940972, "uuid": "923cf563-56ae-4384-ba24-f07068ffc973", "comment": "Malware payload (Formbook)", "value": "1aace65d005ccd6fb6d04dc4ae6d59956f9457667e179316f6f580f24096d691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940972, "uuid": "10a71848-9a12-4a7e-a631-3fd292137382", "comment": "Malware payload (Formbook)", "value": "0096fe124a712dfb9f34306fec8bafb9fb9eda46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940972, "uuid": "7c2fbce8-9345-4887-9219-f3f42a8276d0", "comment": "Malware payload (Formbook)", "value": "1c99c11dfeccfdb8d62056d55fb3984c57eeadf5e75b29e36c7cce81e5d6fd3c55c2a023827ed27cfa1723c903964797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940972, "uuid": "32301de5-418a-42dc-bb95-0d072b31f496", "value": "T119F40168229A9F03C0BF07FA1512D0F4537ABECEA151E3198FC22CEB7D657960506B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940972, "uuid": "d91377fc-9cf3-4db4-b32f-1d6a6b802def", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940972, "uuid": "b1932a89-cd92-4cf9-917b-89e45c63f855", "value": "12288:Ggr/Qnbx3Gomp3ux6JomvfYFREhQEBW0WzCNVUvbwFZIrsO9n:vQnbx3Gz3Seoos6Q3WNmbwF0sO9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750940972, "uuid": "34dc4875-e769-4269-b161-1b78b95be233", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750940972, "uuid": "fc2eb1f4-65c8-4602-a501-c742ab699354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940972, "uuid": "8895777e-bf89-4321-a668-e3219b6edafd", "value": "HRM_LETTER_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32e1b02-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975944, "uuid": "f0e54efb-878b-4597-9438-c1151cda9a7b", "comment": "Malware payload (Mirai)", "value": "c802c3d40966a71e6faa24c885aae018", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975944, "uuid": "92824644-26d2-4f12-a7bb-e5d4128ec66a", "comment": "Malware payload (Mirai)", "value": "1b10d95db48d5fb6fbf2dc8da002ed2efb74095211cf617310bb3b62706bd7da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975944, "uuid": "bf1b43aa-faa7-4d6e-81ec-37872122545b", "comment": "Malware payload (Mirai)", "value": "2ef99cd8f959c69bcfb172aca074288cfbfac013", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975944, "uuid": "716ef080-d63a-45e5-9308-913c4ff25b84", "comment": "Malware payload (Mirai)", "value": "40ed05b00d23e8641b00efd520c8b541ee86b2b5164f021814f43dca50a87b0b5ac405434291da3e8431e9b0ede70fa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975944, "uuid": "4ecb6924-2644-4d44-9d64-66d884c4730b", "value": "T1F1936C89F4018E7DF88B96BA44174D0AFA30A3D116831B3B27A7FD937D331699D02E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975944, "uuid": "1bc6080d-bb0a-47be-9814-69e59c699af5", "value": "1536:vuSv4kZmnxWAaK1UUiOyFgpwcLyKgc8F58o8Z5eJomrjuIAFyopMT:vuSvQaCi4hLrgC5gogfop6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975944, "uuid": "ad8c4492-3ec0-4766-b446-280da7f4faba", "value": 89516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975944, "uuid": "7532f824-47d9-45ec-a689-96d7db363bdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975944, "uuid": "6148cee5-8934-4e95-b145-a07389cabc44", "value": "star.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9548904-523c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750908120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908120, "uuid": "f88f01e4-8f3e-405e-9b92-16201ec307b1", "comment": "Malware payload", "value": "61f99c70b3cfa00384195115df5bfd39", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908120, "uuid": "0241fdf3-f4bc-4cb9-9a0e-f0bd28022899", "comment": "Malware payload", "value": "1b913646fab3b2471b81c5e6febb2f7ea8ce6026b0751d5a074202a367897153", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908120, "uuid": "2e509c50-c68c-4afb-bc9b-e53375f273e9", "comment": "Malware payload", "value": "9429db28d1ec4f55940f6486e6b5b4194ef2411c", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908120, "uuid": "e1457f4f-489a-4e31-b615-2beca6c019b6", "comment": "Malware payload", "value": "d4fa2a822c853db9ead0ae715faaf71bdae2658e0a287a5c2f885fed761c822f0481ac047aa1d59cba185682fd54976c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908120, "uuid": "81f56ab3-6e58-44dc-b893-4226aeab7092", "value": "T192F533297E189C7B91C44F4AE3025D8B218FC9C9AAD8DDB9F1D57B3C062D1E83CC2566", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908120, "uuid": "177e5f28-6c68-4420-9cda-1e76a4a4ee45", "value": "98304:bp1fJGVV1wXXd4RcnhpKQwbkNkzjVuu8fwDN:bp+L1bshIbkGz0XYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750908120, "uuid": "c3744b4f-03be-42f5-80fe-897dc4cc819f", "value": 3554301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750908120, "uuid": "506fe728-3471-442c-ada9-27c8d5b4b05c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908120, "uuid": "3b0f79d8-af14-465f-a6ef-93da1eeb9837", "value": "mng.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33cd272-5265-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750925746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925746, "uuid": "9b84895b-6d81-463a-9d04-a1f0e92fab1e", "comment": "Malware payload (RemcosRAT)", "value": "f67d489628c41ed2be06e17df9f0e6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925746, "uuid": "42d9e157-f939-4968-9afa-27ae9fc6cf6a", "comment": "Malware payload (RemcosRAT)", "value": "1c27fe41bd75981b092376cbb88a63baaae8cfe8c4ef18ab5201e6ff272ae2db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925746, "uuid": "1428e958-c453-46e9-9e8d-88accc33077b", "comment": "Malware payload (RemcosRAT)", "value": "7d8dc9b6ba5f7aaf313af1c2259974c17f07b69f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925746, "uuid": "5beacf0e-4ebc-4c0c-92bf-bc3137346279", "comment": "Malware payload (RemcosRAT)", "value": "4f68a89ec21a437dee72260ec3a1d62de2837d0124c323499f515728027422969f67fbca79f017584ef9c8d132b66da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925746, "uuid": "f21df0db-8b77-4800-8261-f4e7dfb75ebb", "value": "T18BF41290A675EE66F43C0BF92422BE5994546CFCB8B4561D6330388BFCF36422C36597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925746, "uuid": "29022d71-1094-424a-9140-fd700555628a", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925746, "uuid": "835637ed-af4d-45c7-a57f-b3d3b3294dfa", "value": "12288:ORcIur/Ki0vGKNK6EYLJNl5QEo/pFet6fOgYUnYso3Wc3TfmzW9du2zAZ1:OR+rCjvTNK6E0l5ups4flMWcjmzWbFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750925746, "uuid": "2dbd3f88-1656-46cd-a083-3d75c843614e", "value": 748452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750925746, "uuid": "682ef02a-8b2a-4dc5-84e4-540537d24151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925746, "uuid": "586314ec-fcba-4f5d-a711-389868e18c11", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5baa0529-52e3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750979689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979689, "uuid": "bfbd11a9-f014-4905-8c96-9ec95817e3dc", "comment": "Malware payload", "value": "c75e7f1bd187349da3ba377602e1e060", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979689, "uuid": "9e08b499-d935-4617-9047-0c1dbb3a52ab", "comment": "Malware payload", "value": "1c73214732ba3c0c68af2cc246e070954a5c0efbc5879f171597b5a24bf09400", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979689, "uuid": "03817a11-4c16-4c18-ba3b-e41dbf169b3b", "comment": "Malware payload", "value": "17e0f9b0cb13f60b5d48732fe6f12499785871d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979689, "uuid": "c76c4f15-1234-4b9d-97bb-3be4fc071a75", "comment": "Malware payload", "value": "163ea14bb3c156f42c34c1c5a7b4fa92d5e7d24911e404971a75e56b5cafefd71def00b92bad3ed4a043e460ed84dc71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750979689, "uuid": "f081b8df-e32b-44c0-b825-98cb78d10304", "value": "T1A1A41294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750979689, "uuid": "cc595423-b75a-4571-80bc-59bdc8dd2c52", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750979689, "uuid": "fd02b71c-0245-45c7-9425-a68ccb6410e4", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750979689, "uuid": "813e4edf-0ea3-4ca9-aa91-cb1103104be3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750979689, "uuid": "b577e5f0-b658-4cb5-a44e-6dc4ddedefcb", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa94894-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978058, "uuid": "eb012b0b-538d-469b-b94d-ba8bb507763f", "comment": "Malware payload (Mirai)", "value": "7dfd9f3d2037c8f5b9cc1b9107638ed1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978058, "uuid": "a08a5e5d-54ca-4e13-99d0-771d65de2112", "comment": "Malware payload (Mirai)", "value": "1d68e6419d376500c6952acd2ba3e9621a849626777dce3352c36b621d7d53fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978058, "uuid": "2ce76420-42bc-47d5-9f71-d5242cdb703b", "comment": "Malware payload (Mirai)", "value": "bd206d9ddcd6533f32bfed2ce34fb4d4b05a0200", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978058, "uuid": "8100386b-d744-45f7-99ef-97a3f4d1e4a1", "comment": "Malware payload (Mirai)", "value": "579cb0d5587fa94e685367ac7a97c2f163a40653981c5818d34120cf9724c006694635b629522685de54c133f5224eb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978058, "uuid": "423467ce-2c1c-497c-9b25-554bb8ef0730", "value": "T1C5B3E84E6F219F7CFBA8C23447B38B25965923D237E1D685D1ACD6001E7024E642FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978058, "uuid": "05a9df32-bcc2-4152-a531-62e7a58e0327", "value": "1536:YMcexRXRB8huBmaElgZ1oszQOxNsI0vrL0usKUjn3Nr3zr/q49FkreH97vl/mu:6eThVgaEisI0vX0usKQt3zr/q0FkKl/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978058, "uuid": "567a4c80-6016-4fe6-83a6-23ba4e31c449", "value": 109764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978058, "uuid": "90b73575-788f-4876-87ef-f756af31883c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978058, "uuid": "1db439cc-4850-4527-abbc-67ec8809081d", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a53e98-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913884, "uuid": "60a99501-fd3d-4fc4-a26b-1c7a85fa41e0", "comment": "Malware payload (Mirai)", "value": "b1927543da5c103a045c498842fc75b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913884, "uuid": "6ccba0d3-3a89-4290-9bfc-b507f979397d", "comment": "Malware payload (Mirai)", "value": "1d908ba4fbc4c7ac68fff944b4723fada55ab89569e248036e40b18ef829e4db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913884, "uuid": "6393657e-9c83-473e-a506-9c8dbbe44d18", "comment": "Malware payload (Mirai)", "value": "ad72471b7eaa87648ce848e065b3eb1d0a52859c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913884, "uuid": "ee10ccd9-f09d-495f-b503-b15f9e2ce62d", "comment": "Malware payload (Mirai)", "value": "98d992d3e007cc90c09b25bb0e5b865d1f37f564aa3c80c6999a0dd2fda9204257ab83734716dbbedff34741dbbd4e4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913884, "uuid": "bd07c824-1f43-480e-bd23-084cf2b267d5", "value": "T1C3A2E1217F1DE88FCD37B278C6E5E9C653D07D60D2DC89865781C11FABA36846834E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913884, "uuid": "cba0e84b-fc16-4877-8cd4-3b7eea8fa086", "value": "384:Mg/Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaQNAr8vcoBAvP+qNV+KLebRt2nSyt:598o08kxofBE+ZkXaT47C2Epit2tt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913884, "uuid": "75016dd4-cb6c-436b-b09f-378576a4b916", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913884, "uuid": "a0524d1f-b486-42c2-ab7e-332a6574555c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913884, "uuid": "0a283a52-8106-4c97-9630-eeefdb2517e2", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb7e223-5277-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933575, "uuid": "8e96f7f6-1520-40b2-b60c-2f9e5ae17eca", "comment": "Malware payload", "value": "eda71592dbecb8d707fa3f81adb2a212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933575, "uuid": "115368bf-8126-4930-b60e-9f4f519bba79", "comment": "Malware payload", "value": "1ddeb107aec93b89c0ceaa92574ca6a2e6c7dc2303dae3532b6e673acca6efe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933575, "uuid": "93761283-027b-4b0e-9481-7d18d2e8d46c", "comment": "Malware payload", "value": "c74bd51d7498f6c19c15046946e04ae2e9e94e92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933575, "uuid": "74919af3-7dce-47c3-af48-77353391b069", "comment": "Malware payload", "value": "6b9923bd20aa25e0e7c802d39400df2e6b70a18de60d86546121f96ae2b4366aae19a69627dee65ff9cd89ae18a0f5af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933575, "uuid": "a9c8e4e3-c2d3-4180-b0e6-2bdfa3cf1dfa", "value": "T19245A3432A5081C8C8BDE21E6193221BE5F138E49FF9744B6212EF5F35C2EB2679D59C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933575, "uuid": "f29c705d-65c9-4abc-ab0d-32773b62bf09", "value": "c5dc0a3ab3f22aeaf807779d165c2e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933575, "uuid": "869f3ca1-ec8f-406f-b8ca-47e6fa5b09c2", "value": "12288:xZoVjqGah2rEw5rbOnpYtJRpXCl8c7vS6KSZmS/2S5m4qgHPm8njMfYYiC+B74eh:xZogh2YmsYtJXb4vS+tm4tH+BfC5L5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933575, "uuid": "4358c8ec-134a-4581-ba48-bf65cc97c62b", "value": 1214104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933575, "uuid": "326e1a1a-737e-4a4e-a06b-50208e502520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933575, "uuid": "9686adac-8881-4630-ba1f-c3fc07d3db96", "value": "111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3182fb5c-5242-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910470, "uuid": "95544620-a7f5-4bc8-ba81-cef7808dd86b", "comment": "Malware payload (Mirai)", "value": "35f851d7297f23eb3c6b158748817c4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910470, "uuid": "e484fdd9-128b-47fa-9c37-7bd4091e821e", "comment": "Malware payload (Mirai)", "value": "1e2a95c2ab140f6fca91dea7f6f214a0752fff209463bb9a126693caba6ae115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910470, "uuid": "8fc540b2-2e11-401a-90a0-6882158817a2", "comment": "Malware payload (Mirai)", "value": "30810e5d136e9e84e8d735615417300e1ccd6388", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910470, "uuid": "67a3f938-8f39-4c55-a6bf-adbe8ec35f40", "comment": "Malware payload (Mirai)", "value": "80d2de84259029352b33de16ff8c35f38da2bbd9c477f2940b649df4282d29825d298074ba8c2e89bb4c086a9eed93b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910470, "uuid": "47731b4c-f6f2-479d-969a-36a13c948edc", "value": "T1A903E043B1934F2CD12FD2FA80EE7C8E2D19A404EA605668912D6737857EFACB1143CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910470, "uuid": "de4efabb-e26e-4562-8025-d9a898efe9ae", "value": "768:j3b3SQi0CnbBmFME90twRAAEpcnluPOeH6NfFYGDMofDAjnbcuyD7UHQRjx:jJV8UFME90twi3WnlMOrNY+rfwnouy8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910470, "uuid": "e46e393d-155c-4548-941e-a964586bc13c", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910470, "uuid": "209d73ca-213c-459a-b8f7-e12bcf412ec0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910470, "uuid": "dc1adaeb-673c-4b89-a6eb-af6573a90d87", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00952ccf-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975671, "uuid": "caa9e60e-d5d1-4192-9d70-5132a4bcde11", "comment": "Malware payload", "value": "e460167d19ecd72dfca7aeb44abfa617", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975671, "uuid": "b196564d-547b-4a5e-92dd-c34b93069c5b", "comment": "Malware payload", "value": "1e8fc3f996ff4dc824caf96d0d640dd58df6e2b3d18da5066fb258a14ec8b73c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975671, "uuid": "17c1776e-930b-4b55-8e8c-a18a9a95dbba", "comment": "Malware payload", "value": "2b8dbbd358dd10681901698c5f837f89e86d913b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975671, "uuid": "1e9ab6a4-c518-4fee-9cbb-9310bb9f3373", "comment": "Malware payload", "value": "13c9bac5069d35682461aec90e0e7bf62d8d9fe4480e6a69ae7a875fbe7b1fcb6820b72ebe4435cc3630a023f1c6be9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975671, "uuid": "9e64b4f2-d6e3-4a94-ba7d-9dc6858cb909", "value": "T112C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975671, "uuid": "c2226ebb-5a35-476c-b23a-52642f361917", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975671, "uuid": "81460aa7-9777-4418-adc0-d64e147063d1", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975671, "uuid": "29061f84-cd75-40a9-a873-84ad254e0ca1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975671, "uuid": "a844ef68-37f4-4e2f-ae13-6e49d74ca0b0", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54c0a11-525a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1750921079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921079, "uuid": "1b947fc2-6169-423a-91c3-452c66405999", "comment": "Malware payload (AgentTesla)", "value": "4edc81557c7f13bd02e9050b6930b89c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921079, "uuid": "9c8f397f-cdcc-4cd7-945b-4e852683d18f", "comment": "Malware payload (AgentTesla)", "value": "1f251a23334370025ca8411848cb390fa96d4f11bec05b1c69dc7d05092b7e28", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921079, "uuid": "bf994c9a-ecf0-4223-8970-c72fd22a01d2", "comment": "Malware payload (AgentTesla)", "value": "d3d3d944fdca4c50754174a832a0ff891e8381d3", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921079, "uuid": "27c9f9d7-566a-4baf-896a-cd7b8f9168d6", "comment": "Malware payload (AgentTesla)", "value": "62007ad15ad400bcdec773e05a470d7af25b0f95cb82c5423b994eed1082988b1943796e68622f46bc76897d6411c55f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921079, "uuid": "586b188a-92c7-41be-b122-d701ac8ae5ae", "value": "T1C2530294FDBA0974E55EB30810339E521E34C9C90FCE870C316650FF94CAA776BABA64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921079, "uuid": "d97b771d-e8b4-4ed9-9655-ca678205aa38", "value": "1536:ICTI3z8d9LM1zeIcgHl4tiNXlXrZNbp5B4hxTt0ibkm9qYa:IwIqMQgHl4tMltNbp+4ixZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750921079, "uuid": "7dbb683f-b49a-4eda-89e1-afbd0a4bd53a", "value": 61086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750921079, "uuid": "4fd8acab-87df-4a92-b832-ef5818603c69", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921079, "uuid": "485cf933-7aea-49c1-a593-11b9a2e2b59f", "value": "ATT_0585B4.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ab5ebe-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905584, "uuid": "ac02bb59-88aa-4d31-9753-1f0cb56bc3a7", "comment": "Malware payload (Mirai)", "value": "c9c359df79a8d99a997ff49fa5400a0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905584, "uuid": "e4ca29ee-95e8-47e3-8f13-8a15ec988cef", "comment": "Malware payload (Mirai)", "value": "1f569b28dada893275a85db8246f0a4aeec9e9824e87ab91e5138b88d7511c49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905584, "uuid": "2417b4c9-791a-4471-ac47-343a3787d8ff", "comment": "Malware payload (Mirai)", "value": "7ae246a41b497fafb9c3a8c7cbaffb73a46ee3b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905584, "uuid": "9df19180-4f44-42c9-9168-b18fe8d3a1cc", "comment": "Malware payload (Mirai)", "value": "2b7867122d0450b39e165d8c919545c2bac559aefa021e87810af921db36e5fd3423c127989a4e751be19cca07b02012", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905584, "uuid": "736bfabf-7d96-434b-9bf9-8030e9dae872", "value": "T1F7B33903F6A288EAC083CA3157DFC1718933FD76072166675384FFA52E29AD1AF5D285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905584, "uuid": "17d97b7f-9620-4450-802b-a5a5df8f8826", "value": "1536:MAI9om8RDFXEpv3D//lGkd4DjRLeetmMKi1tZHkTWmklyzIJAyoEQ1It3R+yd5+m:MAFmZbEdCeUMZStIzSUzEeTBxiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905584, "uuid": "d1878f31-2307-4385-bad4-fb5f9f445d73", "value": 113522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905584, "uuid": "60eca196-029a-4479-91a9-c3f44d30621c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905584, "uuid": "d7484cca-f5a3-4e1a-8e38-844525acc353", "value": "SecuriteInfo.com.Linux.Siggen.9999.32603.29998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49803eaa-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975793, "uuid": "520c227f-4477-45ab-ab75-7a01b9590392", "comment": "Malware payload", "value": "c3e2017ee06118547754d294bc8145c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975793, "uuid": "0d74bc56-740e-4656-89ae-192a273a3e50", "comment": "Malware payload", "value": "2006e8e3687738ace572b6f9aa69d319fff3158c5e9a59adb3a9726c80c05267", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975793, "uuid": "dd13c511-55b3-4fbf-86aa-ba5c1748d160", "comment": "Malware payload", "value": "32b90c41cda892441cbf181f2f336c136b34ff72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975793, "uuid": "49133904-f4bb-419a-8643-2cd7a9eacb94", "comment": "Malware payload", "value": "4985a371b92c41ddefc909e6249d666537ad3e177241354506571b77c7d7be058bb8bc36d65a26d68bf2782cfc709bd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975793, "uuid": "d9f9bf2a-5fe9-4a15-9b17-bf1565407801", "value": "T191C22974BEB74DABC4817131B1EB8318B2F6534E28F45E2E3C621ECCEF449546212A79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975793, "uuid": "4afacd00-ddbc-4024-81cd-88683080396a", "value": "384:fhR9kfJ8GjJGM4S+kJtzjpvnkFU+f/7YUlgGaJ:fdk8M4S+6z9MO+37YxGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975793, "uuid": "6145b425-f5ae-401d-b860-aafe1fea521e", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975793, "uuid": "bb17d464-d47d-4bed-961b-7ab301d4d057", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975793, "uuid": "044b1454-dac0-4dad-98c7-0c43efe8b73d", "value": "violetspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb826037-52de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750977810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977810, "uuid": "87b1fff9-fd2f-423c-8ec9-269c3eea6d0f", "comment": "Malware payload", "value": "7f83fad3da0dc943a8c63c2924d6d04d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977810, "uuid": "c614e205-a6a6-437e-87c9-5ea24c6ecff2", "comment": "Malware payload", "value": "201ea1721dd6fdd2c8b81478102862e60a2a62140d92a7e2bcb2d5fde9fbfca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977810, "uuid": "cd20ed51-a532-4e3d-b157-6a2b82343857", "comment": "Malware payload", "value": "93f8fa201031edd4a147f55b62a114665eca12ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977810, "uuid": "c816ee72-6dee-4f4c-b8c9-67e12aaa0a66", "comment": "Malware payload", "value": "b8ecafcfac4d9dd09de03c5b184a360d0a0fd97c99bb524a9d797850ec4012a22da6d2d1f8002e3254c9875d249aa701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977810, "uuid": "a8e792b6-0073-4492-9128-47dba1aa57ae", "value": "T193B5334B1429983AD98792B1BFA9A37F3B27CEC5593C8283CBCEFB298035D85D175015", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977810, "uuid": "d23fec19-5dac-4a88-bc55-262fbc572c4d", "value": "c5319e076a4e8512805ca6dc9210f0f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977810, "uuid": "fe4cdd06-2cc1-44db-a605-0c820729480e", "value": "49152:qS6XoyPpIYFRakVqoeYBiziwqRdzoU09rrz+fNjOyn7:qN2Yr3VH5B6iwq329r/A7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977810, "uuid": "00b5d94c-f5c4-42d6-a4dc-c647b668d2f5", "value": 2477864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977810, "uuid": "93adb977-3842-4c10-8fe2-8da0eca4862c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977810, "uuid": "19b4fe93-83c8-4519-bca2-9619653e77e7", "value": "Setup (password=spytech).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f834118-527f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750936665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936665, "uuid": "beeb81bc-325c-40bc-b6fd-b661e0fb954a", "comment": "Malware payload", "value": "9c5ed7b4c92692ec78535a67003bca45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936665, "uuid": "c1ed14f7-242a-4152-b292-d72ccc12de7b", "comment": "Malware payload", "value": "204ee05091c93011810545667b4120edc3f0936cff443540d858cab8562a0f4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936665, "uuid": "be4f0908-84cd-4b05-b49a-2e130d0c3555", "comment": "Malware payload", "value": "0f4341c603a17f2b7a6d91b5843dc33057c02e97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936665, "uuid": "590da25e-8652-4837-81e7-8e00fc5eb6cc", "comment": "Malware payload", "value": "e75db02e594f7458ee003144b4e7127225bd169cba6b719f703d29649598e43b2a7e5d6b7d5488f863bf389f35d7da99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936665, "uuid": "8293f511-cf9d-45a2-9720-748641e553f3", "value": "T1D2B33A99FC409B16C5E02ABBFE6D51CD33230FB8E2DA7106DC156F2067DA91A0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936665, "uuid": "9a7b569b-16d7-4cd7-93be-3607bab955f1", "value": "3072:zcrxy7KbYS3FvAbRPiwd3qz8WERras3ZTAxHhx:zIYBbtiwd3qoBIsJT8Hhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750936665, "uuid": "fe797b68-1ab9-4ae1-a82c-22d4b4cc3e9a", "value": 115476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750936665, "uuid": "d946799d-745b-42dd-b984-7417a46f818a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936665, "uuid": "ebe8b2d4-1555-4ba5-8399-dc48f36c263a", "value": "narmv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a98e05-5278-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933773, "uuid": "6d27fecf-be69-406a-b4b4-cce129326e78", "comment": "Malware payload", "value": "0f9d82a11b4cec77a7b3913487da8bd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933773, "uuid": "ba07df7e-40a7-4229-854d-810f75c5ae91", "comment": "Malware payload", "value": "20c5b8787dedf123d31bb36962882e058e1534fcb7f4d4c0976649e95ca89911", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933773, "uuid": "a8f76c2d-5c01-41df-827b-8a7521d30173", "comment": "Malware payload", "value": "38a912e713903bee8a55a9ccdde3a997ddd0486b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933773, "uuid": "508a8b13-3ddb-40d1-8ca1-88912c48f884", "comment": "Malware payload", "value": "fd454b870277cd58dae3f9440357ad6778ba1dd9353123b0c19aa1702008e578231ccc2e4e3ed607df601661df45f360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933773, "uuid": "fd6e2b2f-b502-4858-8234-27b20edf7544", "value": "T1F9B402018F881F87C5AFCD750A2E167311AEDD9F46CA653E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933773, "uuid": "cff5a90e-584c-40f6-8cae-90defb38174d", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZ4:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933773, "uuid": "87a9fc61-d48e-4010-bf5d-7ca12904a850", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933773, "uuid": "6f37e907-848d-42ee-afbe-c75966dfdbe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933773, "uuid": "1b771a59-f72e-4260-92ea-5d869496df83", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d961672-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975934, "uuid": "c323dd4e-b06d-42d8-919d-414d4da45196", "comment": "Malware payload (Mirai)", "value": "2440476a8561c07f3590756ded3cced3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975934, "uuid": "764670cf-6d65-4362-9ff4-ebd9a115219d", "comment": "Malware payload (Mirai)", "value": "20f126926a5d4e7f2e3a7add85ce072be2e759981e55aea8e13289fe9fc0289c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975934, "uuid": "657249b5-65e9-4625-9ef2-d3d4d3ca9a12", "comment": "Malware payload (Mirai)", "value": "1a9164209e61271a0a94185d3b09a8c0cc4b6a8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975934, "uuid": "08be7706-a4cb-4ef3-817d-25b2f1e0c6ef", "comment": "Malware payload (Mirai)", "value": "9dbaf3076a19081f2b64b7a15113ed7a15475c7a6849508a68aef6971310877e5182738c9ed95a341a8b5f6ca019592c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975934, "uuid": "c81c4639-51ee-48b3-b892-f99c4a6e91da", "value": "T1B0835C22BA751E2BC4D0A87A21F70725F2F6478A25ECCA1A7DB10D4EBF6164036437F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975934, "uuid": "b0371035-2b82-4ec7-a202-95557416a582", "value": "1536:Km6SQ18P1ZbZCYtKrrVRg66+CQ9tya5NM5MVHyFwUyItSQV9:BT1aC6Rg66UgmN8MVHycY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975934, "uuid": "4f7347ad-f281-472c-90b0-2fce3ab0edf3", "value": 81120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975934, "uuid": "b0bd91c1-2cb2-465b-9355-96ff493703c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975934, "uuid": "a4af3f60-6c70-411c-b32e-85445ef0f499", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8636f71c-52c7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (njrat)", "timestamp": 1750967735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750967735, "uuid": "9e856be6-68da-4ece-9a0c-92d77fec3718", "comment": "Malware payload (njrat)", "value": "608c3702a7e8e99055c783566bd33191", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750967735, "uuid": "2e7170c7-6512-4a87-919e-2c7c9167f5c6", "comment": "Malware payload (njrat)", "value": "2204548563caa92eefcd36786cecab2277722318571f3578dfbbb85ee51a9eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750967735, "uuid": "31690a48-62c6-4e9e-8ae6-29d6a618090f", "comment": "Malware payload (njrat)", "value": "2894218a8362dbaae050d593c34edb1237bcb8c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750967735, "uuid": "81a9cac6-855f-44d7-8f6f-4ee5f855999b", "comment": "Malware payload (njrat)", "value": "493bd7cadba85acd1844c8987456c2bc8a3d12076d5195024d8ea35f1e1a3ac4f5c2a0e79fdedd69f18ef962e4f29137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750967735, "uuid": "bc31694d-7201-46b9-ab5c-ff57ebe59522", "value": "T1BE2733A4FBC51EF9EC569239C04198189371B9B3A7B6C7330B90665B1B1B2843F2F758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750967735, "uuid": "b67d1f91-55bc-4950-81aa-100e804a4d83", "value": "064967a99ade726316dc79a4a929fe96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750967735, "uuid": "d41d5f60-a6de-44f1-8102-fb26cf439661", "value": "393216:RFXGMm6st5qvZ9DfLc8ogfOmbFDw2XefsY8NVlyYdQdF3MnG38BLrhJ:RFX/m9TyfDfDv/bNXDY8lyYdQ73MGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750967735, "uuid": "468e15e8-5acc-459d-a6e4-30f64742758b", "value": 21228872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750967735, "uuid": "7efec32b-8e2d-4a37-9869-bda0ac22a190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750967735, "uuid": "58a16143-a2f4-4aa1-b4cf-72648f0423f8", "value": "Wrotocol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a41b74-52ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955844, "uuid": "490b51da-8773-4096-a67d-533f3d838a7b", "comment": "Malware payload (Mirai)", "value": "8a6c01e659777712d51b32c08aeef16c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955844, "uuid": "bd916b93-1d26-4540-93e6-8a7909c0a7eb", "comment": "Malware payload (Mirai)", "value": "234a1425135522ec470dfb52d1c3fde445da9d25dca43167fa63a1431da1e9b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955844, "uuid": "0d375c9b-9b2a-4fe0-882f-6a031c817cb5", "comment": "Malware payload (Mirai)", "value": "6f4519fdcb5ac38a56ca53af1007c1c14f392b85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955844, "uuid": "8cc9c9bf-d21e-4c1b-98b4-90cf03083442", "comment": "Malware payload (Mirai)", "value": "ec8832432c3fbc68d3083d331644a799f729fe1bce2886345a05d9564025a6cf47cfac6bbc85517c4a948ce724ff5d0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955844, "uuid": "b8eb99ac-22cf-4131-8351-54aa6c3d65a4", "value": "T1EF431891B8819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955844, "uuid": "0570d60d-c85e-4ba7-8f12-4872ca0dfbfe", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955844, "uuid": "bf652e66-997b-4954-854d-33438b9858f4", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955844, "uuid": "d0493d02-039c-4fae-a060-87ecb43b8511", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955844, "uuid": "b4b98f4e-8c44-43fe-9459-122cb534d3be", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c0fa24-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975950, "uuid": "449795b2-5afb-46f8-892a-f2a712e8bd2c", "comment": "Malware payload (Mirai)", "value": "54135d3b9b2fd54a2b61531091e94da5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975950, "uuid": "43ca75de-3913-480d-961d-fb76564b3c6f", "comment": "Malware payload (Mirai)", "value": "2383a0b1fe9c699ee1e5b718e06d3b81c6111682ac12e39fb310525c95c85b65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975950, "uuid": "45b819a4-bdf9-4fa3-9c8e-615eb17a66eb", "comment": "Malware payload (Mirai)", "value": "5f203ed96bafe725b75effe4749965af9f7d06a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975950, "uuid": "82f8a6a1-e562-4657-8c3d-a805c36414f0", "comment": "Malware payload (Mirai)", "value": "81ff69395a69585188216a99c1c2def870983a6fa7fb5f2c3426c76cb6e20646d8092a0ae5ad358e76a3186f2685144c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975950, "uuid": "1e80f22f-7fb6-460d-86a0-627c8ce8a7f7", "value": "T159B39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975950, "uuid": "92636af3-6276-4521-a9d9-257221e126b1", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1W/LWy:c9sSyzz36YaWWgg1Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975950, "uuid": "96ffe985-6877-459f-8d8b-9bc0670926f0", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975950, "uuid": "226639be-0709-4a1f-bc6a-6180858cf54d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975950, "uuid": "6077cb7c-639e-4168-80a2-7a0087d82ef3", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5968cd-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975801, "uuid": "46fa721b-94a4-4a98-8696-40cb525eef4b", "comment": "Malware payload", "value": "beb4d17e481ba1bd041cf532e31d6928", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975801, "uuid": "53c8cb23-2811-42ea-8a1e-d79c6c6da3e0", "comment": "Malware payload", "value": "238cfd15aafc209500bfb5e40090c9a618190d8bf37632958b1861faa84ef97c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975801, "uuid": "c14da1bd-dfff-4085-8a6e-d9b8723f8055", "comment": "Malware payload", "value": "d1128aa6443b307c01848bab0959e60169073c97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975801, "uuid": "c738968d-5e7c-4635-96df-f8634f67e99f", "comment": "Malware payload", "value": "3d2bdf9bc16b3ead4bf0b90cdc10ceace8b9db11e150a39e30a997f5e86993c17d98419dd3d33731cbf6ec19099ebfa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975801, "uuid": "afc25c30-6a5d-4020-bc05-7c32b928f103", "value": "T1C6A2E840B9828D17C0C55272BB4F51EDBB16532CE7FB3303DA265FD92A9FAA24779840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975801, "uuid": "6ea6ab92-84d4-4004-be65-a2f79f096a6a", "value": "384:vE7SHfH/nwAXn1Ah21bVPNqDXnC1fYtfHtxoFKB6cjypZoFx4eF:vE7wHfwG1c21bVPoC1ooqLjy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975801, "uuid": "895e8661-570a-41aa-b7e7-a134e9998bb0", "value": 23376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975801, "uuid": "dcbb9578-f161-45d9-aad4-017870890d8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975801, "uuid": "adbb362e-3835-40fd-a956-d257dc9bb45a", "value": "violetarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f5c7cd-527e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750936482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936482, "uuid": "969149ff-e9e7-4249-92c6-08c22540b7de", "comment": "Malware payload", "value": "38218168e95578bb7a9365214e626b1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936482, "uuid": "eea08032-128e-4885-af78-b251264ae2d9", "comment": "Malware payload", "value": "23ee0704d2d5002ca22f77ff5b4022e4765bac62f63ac2f4b7470765b113f584", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936482, "uuid": "8f7b9c53-9d3f-4241-95a8-147516ff9916", "comment": "Malware payload", "value": "64331a3b2a448369c76be60718ddb7766daa914b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936482, "uuid": "35e839be-9997-4a9d-b1a0-b918509c0c51", "comment": "Malware payload", "value": "a706ca0290e76480b9efe3008c133b218e6fed64d59712304e9a95a7d9efd8171f2765d543497cc5c891e4ecbae72f25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936482, "uuid": "7ece4061-14ca-4439-b524-c39279ac5d78", "value": "T1F0A41212E290D8FEC4CAC070429FD27BFD767C544234BC6B6298F7322B3AE601B56A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936482, "uuid": "e3c8aebd-5ff3-4de6-892f-5e0b5b20ccdb", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750936482, "uuid": "7973012a-ceed-47c7-bfa2-abca394b1012", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750936482, "uuid": "ea688ddb-788c-4b14-835c-3820d53dc324", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936482, "uuid": "d1c8631f-d7b5-4948-8cd3-d7746964b6b4", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99423de1-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975927, "uuid": "523247f9-6cfb-4041-9aea-e8b1e27bd004", "comment": "Malware payload (Mirai)", "value": "de3cd4e589c8bc85ff18ffecd405d97b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975927, "uuid": "ff88ef90-3ca3-422b-8dff-5c57fa52f2d8", "comment": "Malware payload (Mirai)", "value": "243e157b76a032b3ff85185400154d30cb53695d06d24bedb105300ae214a27c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975927, "uuid": "b46c858c-b07c-457b-aaee-731378b684c0", "comment": "Malware payload (Mirai)", "value": "ae3bfe80fda51ceed549b511d8971dcf8863b76f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975927, "uuid": "04e1b0af-4614-42a9-a59d-aeae0a3f5581", "comment": "Malware payload (Mirai)", "value": "a445c2952aba1fd1d622c294e0c7e03679da3af7236c39124a8f2bb242334bf540355e39bb98973aff0c59f198cb2899", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975927, "uuid": "fd056ce6-24a3-4140-89ce-a3fcc8aeb70f", "value": "T17EC2D0E0B726F931C4206C3DE53B4D8A3A510A7C91FF353664258D399FC165A63E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975927, "uuid": "6df950f8-0ab0-4bcf-bc11-ea026f922826", "value": "768:4MKyhegCCMqfizjoNpd2vJdX6vwrLu9q3UELuq:PKy4qfqoeJdXWgLTLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975927, "uuid": "fa585f0e-72bc-4e7d-a7d9-4ea18e6c1ebc", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975927, "uuid": "044b4d48-c7a9-4765-9005-65557ba06f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975927, "uuid": "2aa295e1-9305-4f51-9935-76eeed6f1ceb", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326b4004-5242-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910471, "uuid": "feb0cd93-f6a4-4b31-99c7-911e8ca6f0ee", "comment": "Malware payload (Mirai)", "value": "37964cea753e17bd85fa31a63313deec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910471, "uuid": "0899df1c-af43-4f45-9b0b-be3a97706d1f", "comment": "Malware payload (Mirai)", "value": "2600972ae1150875bb2099b4d871a7f44ec388057e9bf75027d6e5fe2a369a41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910471, "uuid": "36a212f0-d1b9-4c02-862b-3b40a15a9f69", "comment": "Malware payload (Mirai)", "value": "4c74bf409c170d01a82f5a6e6ab8da452de0368a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910471, "uuid": "fa2bb41c-1f23-4fa7-971a-7883464b2974", "comment": "Malware payload (Mirai)", "value": "356f2de18e7a8f1b56c08b746465d361507f7babbdb17f4fbd6c253b5e413369442f79d5a5e57dbf94f4ec2d0f3dce98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910471, "uuid": "4e899072-f607-461a-84a1-a621e40ee339", "value": "T126B3AEDBF74721E1C86287F007C74B9E3E5322119E6BE8E76C0E2A7A16790DF1916391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910471, "uuid": "e0d13287-6e24-4015-9da3-d43e633193f5", "value": "1536:liHpZlMvIYUjBQb/mQlaYWqoyfkJBFL/fFLIivxZJAewgY/LWp:EHpZlTPj2/mQlxtdcNdciyNgYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910471, "uuid": "e21367a1-f6c0-4f5e-a1de-ab95944c2647", "value": 116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910471, "uuid": "ffed6c11-90a7-4846-9a59-cc9539fa9f78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910471, "uuid": "21094e76-2822-482c-866c-5535eb2cb289", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4dc4920-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905590, "uuid": "db9bdb46-cd82-43cc-a518-d45e84371054", "comment": "Malware payload (Mirai)", "value": "0245a73815e7523a21f2f22fcea9c5ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905590, "uuid": "53e68721-cb17-4a42-88ef-15f713f79cb4", "comment": "Malware payload (Mirai)", "value": "260af88185a1df4834d048b3e1741114918b1911d5fc4986387db8c798901d35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905590, "uuid": "9a96ab9a-1659-420d-b6ed-9265464e46d8", "comment": "Malware payload (Mirai)", "value": "aecb47d754685c5d4c0f71e1188b2636f19874ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905590, "uuid": "b01097dd-6890-47c8-9a47-3698e8450d50", "comment": "Malware payload (Mirai)", "value": "3ac1db7f92ade02e8a1ec0840ed4f9029eff879cfa5733a236628820758db0ca617bb442bb40caab53d5eebcf86132e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905590, "uuid": "b7062bad-6a38-409c-a4e4-16fef4a8c1eb", "value": "T16E3481C6AF913FBFC81ECE3302D6CA1502AC990A1395AF776A24D514B78B14A5DD3D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905590, "uuid": "1695d04d-6ddb-4717-9529-e7d6d514cb97", "value": "3072:aLYgSl+Vaq92ZFrM/HSPwA++iSN9Fl2k5oi7az9ENNZp:d+wBFiw9FQHi+zKNNZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905590, "uuid": "c81d1480-f59c-4594-ad1e-5e8546674ce9", "value": 240710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905590, "uuid": "42cb1b1f-215a-4145-84d6-770d6429167c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905590, "uuid": "b2a782dc-41d5-4eb3-a05c-1d39ce1f4549", "value": "SecuriteInfo.com.Linux.Siggen.9999.22286.24856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7973ef8a-5242-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750910590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910590, "uuid": "3c35393e-d426-4642-a0e9-8b696f30d2e1", "comment": "Malware payload", "value": "21f5a0e3ce362dcb88126249d74c5f99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910590, "uuid": "a7b5493b-4535-4247-b3b6-ceffbf11f86e", "comment": "Malware payload", "value": "275d2d1a906f916fcde27d66d2b2e23566bf62c3a2128936aabc896babdcc871", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910590, "uuid": "ae3c865f-1c82-47f2-adfb-0985d9ef504c", "comment": "Malware payload", "value": "c5afdcf29a4b0637d327928f9f16d41a0977a40f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910590, "uuid": "5238c506-0c58-46cd-befd-804c63382a36", "comment": "Malware payload", "value": "fe2f6db8885cf4cf61282f01e3965c7c6194c119905d5e8993c89fde6c252560c53107492889c742989b824d4a39f26d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910590, "uuid": "971906af-f9d8-42a4-a467-76303cbb31ea", "value": "T1E9A41294E9819B62C2C401BFFF0F45BC77A31F65E2EA71068D16EB1662D745A4F7E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910590, "uuid": "dfb6de5e-2815-46b5-97a7-f700c55e9bfe", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910590, "uuid": "12987333-ae3e-4858-9dc7-641f6015a92f", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910590, "uuid": "51cbc42a-b77b-49eb-bd31-750b2ffde4d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910590, "uuid": "d4cdd3fa-0afd-42d6-9f8f-7690a745ba04", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65e4f48-5295-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1750946421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946421, "uuid": "b6e6dbc2-3172-41b4-b80b-36f712d96c66", "comment": "Malware payload (ValleyRAT)", "value": "47007169f5f3131900f0bf2625064cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946421, "uuid": "31e6ca66-f1e9-4e61-a59f-5f64d4570ead", "comment": "Malware payload (ValleyRAT)", "value": "286f89f38e1016bd97942c5331340bebd3e3c89da838c1045062399ee7759419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946421, "uuid": "81db8ec3-bd48-4eff-a268-e824df4d2a6a", "comment": "Malware payload (ValleyRAT)", "value": "30f4a3b66e01ed3a8c775cf8493483384d0c66fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946421, "uuid": "9c5fc672-10f5-48d7-a0d6-1058b140fc0c", "comment": "Malware payload (ValleyRAT)", "value": "02b0e3732c252f8210c1f268ed7e0ca3ed8b8d1d9333fed5c6a9c8c11b54f669ee813c4a70932c27a146da6dea71175b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946421, "uuid": "08e13f35-d834-4fc8-bdab-2a2c142f9c8a", "value": "T1CCB73316738BE03DE05E8B331572922894F73E526622BD76D6E0F16CCF550A52E3E782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946421, "uuid": "c4dcef90-0bd2-40fc-98cb-176f100673ba", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946421, "uuid": "7d3287ae-a104-4ca2-8b2a-d7569812afe9", "value": "786432:gvgUi8u2328IB2IJ3aq2B/+Vp4FWedGnAjJ4TOUDQMly:gbCB2Wp20VGNGnCJ4TOUD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750946421, "uuid": "aca19e59-486f-445b-a7ae-29ea06788854", "value": 48846470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750946421, "uuid": "77c1332d-8175-4be2-8bdf-70212393429f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946421, "uuid": "68523955-817d-4f31-ae2b-b681564e9ef6", "value": "47007169F5F3131900F0BF2625064CB4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cb3a6e-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750977990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977990, "uuid": "a1e17967-0e56-402e-8bd3-3ef4102d8b96", "comment": "Malware payload (Mirai)", "value": "a11ea4cf494190924a509e1b5c95bea8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977990, "uuid": "5b963def-ef1a-4a42-9827-235671c60dc4", "comment": "Malware payload (Mirai)", "value": "28f5b3b5540a9a10d524aaf7056a9d439d9d7f4ab75aa218d11d2cbe296270c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977990, "uuid": "bee0fa24-1201-4847-b171-b6e108bf9fa7", "comment": "Malware payload (Mirai)", "value": "7c50edea5425f9ee7743ac6300899fc625c7674f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977990, "uuid": "7f3f5355-e8f1-4fd6-bd82-7e7577a20e5f", "comment": "Malware payload (Mirai)", "value": "e0263a8eba7d2c205bd9f5e0d5316588fb849d824764d846834e395de25475922bd2f950897c024e49bb551a028e5b0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977990, "uuid": "d645cc2d-102a-423e-8925-67e7a3cabd34", "value": "T15F13F10DEA20FF8B8D7E58B741DA13C81C8C72C677A70B0E44538D4CD566657F88A8B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977990, "uuid": "666ea095-de12-484a-bd41-59eea877a104", "value": "768:68RCx6RT6QA7C1rsxbCxgnO818xaFwPpzBsOH73FkBY2NOh9sj5WG:68cx6MQMOxaqPpz6xBY2NOgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977990, "uuid": "4cb41add-0bfe-4509-83c5-b163a30d8ce6", "value": 42348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977990, "uuid": "c0157261-f773-40cf-9507-1681c9979438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977990, "uuid": "be24442e-7ce3-42e6-a47e-1a4fb048b2fd", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0b171b-5276-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933147, "uuid": "b78be117-d3e7-49c0-a2ec-e604114c99ab", "comment": "Malware payload", "value": "d32f1de217ee44a429bf95b20c0bc59e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933147, "uuid": "fb2ab07b-8d24-4c2e-abb2-ce9c9b9cff8b", "comment": "Malware payload", "value": "2910c9fb11c4c95e22b5e4215f8d572a313a57fa2d83e69ff5a2db4334800ad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933147, "uuid": "f4132c42-5c73-40e5-aa4c-6eba72e78855", "comment": "Malware payload", "value": "bbb294177836bbdc53989be4178f792c1dc11102", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933147, "uuid": "30e62f0c-c4b7-450c-af00-fe06c55699e5", "comment": "Malware payload", "value": "97e6d7ae9036da92ad2ac36f5155394c39a61a5d5fd80bfc165626bd4ef88fee2746a86b0c82c557cd14bf4bf905cc0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933147, "uuid": "abe2ea6a-7abb-497d-8e27-d29865bc4e06", "value": "T18BA32A03F8C068FDC08AD2314F5F6136E675F5AD1335B29FA789EA312C5AE20DA5D684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933147, "uuid": "6aad05d4-b90b-4aa7-9f01-e4b3a71ac203", "value": "1536:XlpjlUQlPRWkKaTrR+hnzEkgVvFUb/MzbSZRyUl5Z86mOlXJM3EFHne37HjC1wf:X/WGRhPwpXgh3bSRlD86mOQEYa2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933147, "uuid": "4c790794-e079-42cb-bb50-9a9074b117ec", "value": 98440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933147, "uuid": "19041b3c-e2fa-43ff-9f15-5ddac22ff4fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933147, "uuid": "e8d5726c-5ec4-4054-a7bb-b3b99e02e2f1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245da629-529f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1750950391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950391, "uuid": "e9e890a8-c963-45e0-8d0d-e5d56ad23daa", "comment": "Malware payload (MassLogger)", "value": "bac64dd34eeb2b11a7d33abf8d9adf19", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950391, "uuid": "a3ca5fcd-3550-4622-a289-fed89abb75f3", "comment": "Malware payload (MassLogger)", "value": "29206d1811cec92ec29716b56093f535710fa9c1fa0f4911a09c6d1fba342e7b", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950391, "uuid": "b03aec71-5455-4058-a7bc-4811ad1309d2", "comment": "Malware payload (MassLogger)", "value": "614322aa32dfd91e74a9949f414cddfa8809e413", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950391, "uuid": "f8c0ba50-5f04-4c78-8719-99602f859260", "comment": "Malware payload (MassLogger)", "value": "7c0c3af845ba88b1815b6df68eb257b29c61018038acc91097a21f746e2887f3f7ad57e583dd762bbdfa3d7b34546a2a", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950391, "uuid": "d2bfe2c2-eda6-4f7f-8834-b700e28cf628", "value": "T17D05655DA0719D92A014FE70E944FBA78CDA079517274B220FD6A4A62317C03FFAB7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950391, "uuid": "ffacfd16-6bec-4ccb-b122-849bf158e1ce", "value": "6144:kvP1d8cFGhA/yOZ1V2cM0VCcv0MV2qXMpzRlRlSGMcich03wBxeKnEhuveiwB2h6:kvP1d8cFGhA91kcnVCcv6FAbOTNEYE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750950391, "uuid": "8e07925c-abc8-4b53-b9a5-708d3c40ad72", "value": 846680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750950391, "uuid": "b13c97bc-6ae9-420e-995b-8b2c2efdc914", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950391, "uuid": "f184d0b9-4b70-4d95-b9a9-dac177e6786b", "value": "Dekont - 2025-06-26F1216355.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94af98fd-5290-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750944137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750944137, "uuid": "6df5ca70-766e-434a-a197-ae14831b6f4a", "comment": "Malware payload (Mirai)", "value": "5297cb517069ffdc1645244ffd2a9a91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750944137, "uuid": "b618e476-b09e-4e1d-a927-7b1af3e47e82", "comment": "Malware payload (Mirai)", "value": "299304af200ceea7f8596235d594c52d10e1cdd334b7ddcaab64855f08e9f58c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750944137, "uuid": "a994c6e7-d307-42bc-9653-395ed906a55f", "comment": "Malware payload (Mirai)", "value": "e5559eb217859845db177f0ab641c1a130e952fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750944137, "uuid": "bff19313-0da7-48ee-9679-8eed7ea254a0", "comment": "Malware payload (Mirai)", "value": "99fef220533b058ddc2ad4e4afd18fd30947dcae00238453a5c7c6683819fd70c0d279ff470a355c4612f6f0f3bfb524", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750944137, "uuid": "3e906d0f-34ac-40e4-9265-8a2e978ad806", "value": "T134042946FB418A13C1D61775AE6B838933339B60D3EB33029C28BFB46F877890E66555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750944137, "uuid": "734d2751-70a5-48bd-96ee-9ec645764b32", "value": "3072:OYPEUSFcymdWWkxWqeVGZoV7holPFuUkhBxl13eis01uCiIVAV:OY8USFcymdWWkxnG0GholtuUu1uinjiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750944137, "uuid": "ec5a18ca-ea39-427a-93a4-3382376f1e07", "value": 181677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750944137, "uuid": "c5476679-1899-475a-97f9-b7296ca55a39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750944137, "uuid": "ee41d7f5-071a-4800-a2c6-74bd02031850", "value": "SecuriteInfo.com.Linux.Siggen.9999.14813.20668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d793bfdb-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905594, "uuid": "d2ec4d34-7e6b-4128-8c8a-d71bf140953c", "comment": "Malware payload (Mirai)", "value": "495047d3b5a48f814ef4a80b98f976b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905594, "uuid": "8a97d78c-606a-43e1-8f3d-63cdc2fce6f6", "comment": "Malware payload (Mirai)", "value": "29b66b13e73c71ba9c326d3cee78c4815b7d23f0e6ea3a574e61fd71b7428d3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905594, "uuid": "e635f980-58b6-4838-a895-ca6249f8329a", "comment": "Malware payload (Mirai)", "value": "0ff2eb15a8a5e6636018c412b4ff53a3dd357e9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905594, "uuid": "72badfb8-eb79-4890-a001-344b1f1029a7", "comment": "Malware payload (Mirai)", "value": "25dce6b0593271589e6f97f78aa883ee4d04bd820e575f7920b12c86bcadc3a01721eeb747ebf725b854383612f66d11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905594, "uuid": "5bb327ea-5fcc-4bff-a3c5-a709878863e7", "value": "T16A041946FB408A13C1D21775AE6F838933339B64D3EB33029C28BBB46F877990E66555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905594, "uuid": "5c663e34-6f33-4704-885a-6ed1c17395fb", "value": "3072:6R+ABIPx59u1qn6DUaX5ZPouijrOPFuMYhtxl1cfiDJxVKmysqRIwV:6RXBIPx5E1qn6DTpJUjrOtuM21qiV6J3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905594, "uuid": "503fc0ab-8eeb-49d7-a131-d88a820f1c34", "value": 181677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905594, "uuid": "d37db9ef-6e49-4610-bc9a-66deace993a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905594, "uuid": "d2fe839c-8732-4fb8-9f4a-44fa4ef50a76", "value": "SecuriteInfo.com.Linux.Siggen.9999.19502.22029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbedca3c-52a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750954108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954108, "uuid": "d9290588-95de-4d6c-8e09-ba776c52bafe", "comment": "Malware payload", "value": "b9ec7dc6c3017a25fe9ef2480a7dfac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954108, "uuid": "eda87726-397d-486d-b6af-e4bf0ea51c9e", "comment": "Malware payload", "value": "2a059a7ae2a74f687c6f4d47cf69dfa872116ce6c0fe3ecfe93784d512c5acb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954108, "uuid": "ec62ef12-de91-4c17-999e-b5799ef6e269", "comment": "Malware payload", "value": "4e4773aab0f8ffc82859d808cfd2692be6c81bae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954108, "uuid": "494974ed-44c1-4872-9cd6-7b659bdfc263", "comment": "Malware payload", "value": "c2ddee64d21c1400abddb488932276c7519d759ebed5bb23c9d57affc33b734081a2d031c3931f90fd3eb73927d0901c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954108, "uuid": "deffe3f8-5860-44c3-abc9-317dcbc154ab", "value": "T156B41228EE4E38D1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954108, "uuid": "995eb29b-9a92-491f-8f1d-762fd2dc53bd", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954108, "uuid": "eb328f39-1f7b-458e-b535-24c828f42adc", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954108, "uuid": "8e819a21-cf85-45be-aed4-dc2d8fb1fba6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954108, "uuid": "c741a927-fc33-4630-9b12-895df057f95b", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4fef9a-52a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750954939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954939, "uuid": "99550836-39c8-44b6-bd0a-bec86ee7c5c7", "comment": "Malware payload (Mirai)", "value": "0f1d0ce1fef55acf92e2a96fb3a15e2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954939, "uuid": "11dd77cd-3614-48ed-aeab-c4295bf1a817", "comment": "Malware payload (Mirai)", "value": "2a09f99f8bdeb093b0553f1d9b946894e7603c0a2237630cd0c5594e034a69dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954939, "uuid": "0df4fcd2-b66e-439b-9012-926ac83afac5", "comment": "Malware payload (Mirai)", "value": "89a1bf661b9d746758961a7e8f4c548d541fbc92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954939, "uuid": "424f67a9-7c9e-4502-b112-d99a047d8992", "comment": "Malware payload (Mirai)", "value": "2f77d76b2a0422f17635b25e479a0fe491a9e98cb92d7b0cbb7836a5c0c7364755b5eb62fc4d53657cca803a5e1e50c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954939, "uuid": "05f8224d-8d54-45ed-a0b5-58db90101c77", "value": "T17424756BAE10DB19F65C973106F76D38834A23A726E5EA4AD19FC2006E3131D1C0FEB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954939, "uuid": "e403b290-7fb9-4660-bf9e-cbcb2c032ff9", "value": "6144:wSHvWL38IBGgrUiFCgzSxC1hFb1lxWaim2:VvWL38GCASAim2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954939, "uuid": "90734c1c-b9af-487e-b682-968bbe151c76", "value": 215800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954939, "uuid": "126991b2-0440-4887-939a-4491c759cd0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954939, "uuid": "f8411581-cdea-4aef-b086-f0f79446938e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f6e48f-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913883, "uuid": "d94f7799-34dd-4430-9ac7-d20af85136d5", "comment": "Malware payload (Mirai)", "value": "bcd797bb7566eb1aea408f008913b180", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913883, "uuid": "e9b10356-6ae1-487b-abea-3af90d7556f2", "comment": "Malware payload (Mirai)", "value": "2afb4f74ae7281dac0044ba91c5ae398e5c10afaac657d93532867d90d0ce7e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913883, "uuid": "e198b783-3eec-4088-a1a7-b6f11fb6d307", "comment": "Malware payload (Mirai)", "value": "d96fd91f8b79a48cdb3abe0c1260210a0bce0498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913883, "uuid": "95728ca7-783c-4c1d-a8b6-82dfcf727424", "comment": "Malware payload (Mirai)", "value": "dae45b859266705b5eb29c9bd81b39d3c7a83579f86b9553262d558cde2e991c4a7e1dab74c2143d019df314d6554ea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913883, "uuid": "70ab8784-ed74-4fb1-9877-971add86265d", "value": "T1ABB3415BBE109F28F75C873506FBAD24834A23A72AE5D54AD18FDA001E7131D6C0FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913883, "uuid": "f811448f-767f-4181-a746-4d3c7bb202d4", "value": "3072:HxTPDvU3e6xhWogsUngrU8wCNL+1djPQoadFb1lNWZ:HxTPDvU3e6xksUngrUfDMFb1lNWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913883, "uuid": "cae62e72-83c6-4c05-91f7-7693c7e4f0cf", "value": 116304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913883, "uuid": "3d67a51c-2034-44f8-90b7-32544400297c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913883, "uuid": "42e7b85f-c770-4f46-a9b7-1045603a048e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91943e8f-5265-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1750925663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925663, "uuid": "25b08467-a0ce-4965-9cfe-346a3fdbe155", "comment": "Malware payload (AgentTesla)", "value": "e9c9e4a1983c6a614a500aadf075a6b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925663, "uuid": "1c73a805-adc3-46db-b189-a198abcd1ebe", "comment": "Malware payload (AgentTesla)", "value": "2b2b96a317df7ae46e19b719b198e916adf1fd7f9b408e801502a6fadbc9ee1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925663, "uuid": "12a07ccc-fa4d-4da1-b3d2-d0f96a00acad", "comment": "Malware payload (AgentTesla)", "value": "dedc90a20b92c7259f5520786866d3440a007886", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925663, "uuid": "2de61a0e-904b-4cdc-b1dc-d82c660d5c3f", "comment": "Malware payload (AgentTesla)", "value": "bf5e019e541f40faac2e5cf26ebe244d2d9f8082b9a2134ef7aad849b9169b7ade19478f53b0b179e184a2cf443a402b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925663, "uuid": "14357092-d240-46e9-8a1d-dab1470a1fe9", "value": "T13BD4013DB740D853DA650B755CABC77B4375ED64268F9F072288B72E3CB23826E09219", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925663, "uuid": "d152465c-1fa7-4310-9756-b280f2e4aad7", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925663, "uuid": "7e7d2f21-abd2-4265-8135-c6a58ccf7ff9", "value": "12288:ti2DI0wcKppLRddAmQwhjbxbbd1W86H7cz2e3fZo9g8fSKB1ip:ti2c0nsFddAmrtxbbXiePZr8frBYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750925663, "uuid": "5ff6b236-b131-47df-8d76-7fe16e830311", "value": 625344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750925663, "uuid": "6d573849-0502-4917-879c-46b688426fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925663, "uuid": "89d8938c-1815-4ed7-9df7-cb965a44f239", "value": "COMPROBANTE DE TRANSFERENCIA BANCARIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a4eec3-5242-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910713, "uuid": "fad6bbf5-a84c-42f2-abce-9d85c30c63a7", "comment": "Malware payload (Mirai)", "value": "b936a68f314740b843c7cecf2569e101", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910713, "uuid": "e9d137e7-7517-464f-8ec2-cc32a64c6bcc", "comment": "Malware payload (Mirai)", "value": "2b479fa0b3bd1d72d2a258243a192aaab4707b951687e5dc1b50baf907d1ae1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910713, "uuid": "8675107b-2bb7-4c36-87df-e888415c78a2", "comment": "Malware payload (Mirai)", "value": "170cdaf8b5e1c21067d8e0d1b94edb4640a0babf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910713, "uuid": "724f0e5f-1e92-419b-ba09-ed9e9ad9b46a", "comment": "Malware payload (Mirai)", "value": "97bf9185f37939d7cfe9f866aa1c8afff24083dcf2b56ba66fce131940b232346558deaa806f8c5ac5ec590583084987", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910713, "uuid": "90edbd07-f50e-42b4-a68a-5a2727e8e045", "value": "T1C4C2C795ACC24E5BC1D4037ABB2F4299331267E4D1CF7703D9042B69EA4AB5F4E32E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910713, "uuid": "f4b86179-75df-458b-9d37-94e0cfe0c96c", "value": "768:AmEyjuEtFAl5GoUbE9Gpb1cPDx80WKFt4v2j41:AmEyjuEtNB1crx8dKF41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910713, "uuid": "22de0b55-a3cc-4618-b6c4-21a3f9dfc879", "value": 26000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910713, "uuid": "aa52482e-8f57-460b-8366-922ce5382d05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910713, "uuid": "4f14e556-957f-40ef-8ecc-2d49432ece9b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a30a360-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975794, "uuid": "06e210f9-f8d4-47bb-96b9-7903d7725d95", "comment": "Malware payload", "value": "81c223418273155ebc138b08a388ff13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975794, "uuid": "42900229-ffb2-4d47-aff9-13ae929f3e19", "comment": "Malware payload", "value": "2b50373bb9b4f29983110b14a925231fb2dc0226f341ee604add246dc0f327ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975794, "uuid": "087d98be-1487-4846-a88b-a75b9ef9a959", "comment": "Malware payload", "value": "c03ff39c16cbe851ddb13b2d3fbe62514ba23eca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975794, "uuid": "e98f644b-a194-474d-8761-c3baf7222536", "comment": "Malware payload", "value": "49b2df3828abd7a3d20dba64449a5bab7429d592d5782584ec127f7098d4a6a8c7dbae6f7a07ea5ff9a0e6d9f0427730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975794, "uuid": "b210496b-1922-48e8-b18e-b618db20ca3c", "value": "T19FF2E646BA828E16C4C55575FE0E218D7713473CE3EE6322DE246FA9278F5B70B3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975794, "uuid": "2782b8ad-dddd-4853-bb5d-0f5cba4797b5", "value": "768:SRnZgZUsNW3XQjh1tnVVfSsoD7mboFIEVFGidNbiDKqEPSrVf2/t:SRnqZUlXQjhPnVQso2KIFidNODKqEn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975794, "uuid": "24c224e1-2d73-4345-8111-f40900ac76d0", "value": 36404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975794, "uuid": "778f98a2-5876-4837-94d7-2b3910b74bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975794, "uuid": "240ddf41-8301-4651-90e1-3d7471f147a3", "value": "violetarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd680fb-525f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750923266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923266, "uuid": "35eed024-629c-40a9-bae6-4cdb863fc2b0", "comment": "Malware payload", "value": "f8099461ca9098bc6a1e7a9de9f989ec", "object_relation": "md5", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923266, "uuid": "443000f5-ad72-409d-864c-bf47e3779069", "comment": "Malware payload", "value": "2bd60685299c62abe500fe80e9f03a627a1567059ce213d7c0cc762fa32552d7", "object_relation": "sha256", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923266, "uuid": "dbc6b97f-2ac1-4e6b-ad07-c8210574dd6b", "comment": "Malware payload", "value": "63c31a09b3c45e116cb371df62079ac5427a2626", "object_relation": "sha1", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923266, "uuid": "0742edab-6b9f-485c-a706-150d0019c5f4", "comment": "Malware payload", "value": "a4898986b80dcaef2d28bab7278bd1d2fa2c5b6674cdef6c37d999a6695cd5b75d5d43849ab5c3a1f921031ee42196f3", "object_relation": "sha3-384", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923266, "uuid": "6723dea9-c6b5-45e7-8af9-4cf401440905", "value": "T1E1348E017881D432E4BF1638457A96620ABCB5631B70CEEFA7E84D3E4F765C06A316B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923266, "uuid": "f2639aaa-9b5b-44cd-81ee-2e3b1668be2f", "value": "f2d2d3f15b6c3efb2e99250b6e9d28b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923266, "uuid": "dc667b56-c04b-41bc-9837-6783a4fbacff", "value": "3072:rqhE5af2vtBp0MqnfPiiYWRH8V3tYtGw+P3psc8ebIUGDmAg0Fuj3OuVCyO/aLcD:r3tl6aE8VdYtGFsfFUbAOjGSL4ZrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750923266, "uuid": "53277e1c-2971-4cc0-8490-a4bcda215df5", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750923266, "uuid": "8d795f3d-54a6-426e-afcb-1c3879a86167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923266, "uuid": "0da8d598-d096-48cc-9e46-2ff570281c04", "value": "adobe_licensing_wf_helper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53be0f00-525b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1750921264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921264, "uuid": "789efbc0-4f6f-46e0-9aed-46cc7e3a9ebe", "comment": "Malware payload (AgentTesla)", "value": "8a3eafda0a592f2bf4b69a07b312f03f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921264, "uuid": "1bf9131d-3fbf-4ad9-934b-b6b8e5912900", "comment": "Malware payload (AgentTesla)", "value": "2c21a5cafddeb0d3b99eeafd7e0753e7fe1e2eaa0404dc6f882e6a5b85751fd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921264, "uuid": "e4a6e390-c928-421c-b27b-84bf70c931bf", "comment": "Malware payload (AgentTesla)", "value": "efd537e3aea2c07cf94002b6a5a4659fb01a5bb2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921264, "uuid": "100cf630-6e37-4bc7-9478-1ccacf5c8da9", "comment": "Malware payload (AgentTesla)", "value": "b7b2cf8dfc82646df5f7fddad829aadeb9170bc7617d0364d6cbc50b65c92dfcf8b972a5ee9af46549e95f21a81caa2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921264, "uuid": "e585cdc7-8db7-477b-89e4-c33a2b42ac53", "value": "T12135BF0273D1C062FFAB92334B5AF6115BBC79260123A62F13981D79BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921264, "uuid": "71201e29-8a79-483e-9c1e-f134922e36c8", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921264, "uuid": "51a2ca52-a1ae-475a-a715-a9245a787432", "value": "24576:j5EmXFtKaL4/oFe5T9yyXYfP1ijXdarFiBPJatiAGx:jPVt/LZeJbInQRarwBhoiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750921264, "uuid": "e2d64b6b-98db-4c44-b6f6-a18daaacb8fa", "value": 1162240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750921264, "uuid": "51d43974-a0c3-480b-a229-150d8a946311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921264, "uuid": "1de4be29-e3a4-46aa-b122-b7d80657084b", "value": "CHQUE SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd72b1d-527d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750936044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936044, "uuid": "b53f3020-715b-4307-b657-d75519c11472", "comment": "Malware payload (Mirai)", "value": "448b3f0dba298486945e19c73a35becd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936044, "uuid": "60b81c9c-a82d-420a-8e04-5df516a06a69", "comment": "Malware payload (Mirai)", "value": "2c83d11cabcfea54062ba724708c5794957203c4001826cacb637d2021cb4af8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936044, "uuid": "b7d793e8-d460-4dbe-915a-bcaaae6c7cb0", "comment": "Malware payload (Mirai)", "value": "506c844cb4b3d3f803a0433597fa3dcc6f5da461", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936044, "uuid": "5adfea47-288f-4879-a562-06517c7ae5ab", "comment": "Malware payload (Mirai)", "value": "1d44884b17e3cf4bce12d9a968ac7ba129b2410ca2e227e38cc85b62533773e988550e9eeb574ec6c5a356f2e8d5e3ac", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936044, "uuid": "6a5d3c16-6f18-4ce0-a90b-21e638201e75", "value": "T1CC01F4DEA47297610508CE08F16F4E7C740ACAC022A08FF9ADD8193AA8DCF003035F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936044, "uuid": "b0113b47-47fd-48b3-b3ea-5ca638589b90", "value": "12:kuxTbL4KXTxNIl5TTif0LKIXTSgObTVpXToaITkSTTFtNTUNTHOT1Djv:NpLLNI7ZKImgIpsah8t+xojv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750936044, "uuid": "b7bd0acd-8536-4029-bff4-71796c73646c", "value": 706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750936044, "uuid": "2a3c4e65-bec6-4ca9-8eb3-ded6587ba7e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936044, "uuid": "7aa3bc22-e2f5-4e88-887e-6d7825cec7ee", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cd47cc-5255-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1750918904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918904, "uuid": "79822a3e-5e67-4736-8cec-71c8b693fc17", "comment": "Malware payload (AgentTesla)", "value": "f8626a9174b23ebe53074c2e8759eeb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918904, "uuid": "0a2346b9-3ba2-406b-a7b3-e84280e15e15", "comment": "Malware payload (AgentTesla)", "value": "2cc4dcd4fb0e4d7da992318c1f7d683e0c05ae12196d9066add0ef1bbd188753", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918904, "uuid": "8307bc94-c8ca-4d75-a699-b42cfdb7a8e1", "comment": "Malware payload (AgentTesla)", "value": "fc456620175fcb9be0b129e5aac854df1f0b1cd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918904, "uuid": "0b0db2fa-dacd-4e1e-b492-2fe18faef6ae", "comment": "Malware payload (AgentTesla)", "value": "8e27d8de94755ba3ea5dd60d734c5b666b3d868bc94ab75d9a3d1455d8ec28624b4d242e7ecc1a73ea3f7c970c9a00cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918904, "uuid": "a6201573-d001-472c-8deb-eb7e5f5daea1", "value": "T1D7530183CD2897632C339D72633C8646B69D8F6D867E73C84A2A5863470CD6D4F9D187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918904, "uuid": "6b6cbaa8-d54c-447a-9d79-8ecb79c5941c", "value": "768:nZ03McOu4BbZM5HMt6ciu1pGpEajlRcvj7VAW+4ki0HVqklcW7g0omg4V4:nSrtxyGpJhRSki0HVt9g3bA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750918904, "uuid": "b009e4e1-a2c2-43c8-850d-a7da2fc60c82", "value": 62225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750918904, "uuid": "fed484d4-76d3-474d-8466-6110223e1c21", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918904, "uuid": "011bfe23-30f4-4598-a291-ff5a587b007f", "value": "RFQ 3162189 PRHO64 SB200 OEM Specifications.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3435d83-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900862, "uuid": "7d58cb12-eed3-45d3-91b4-9d10731fa54e", "comment": "Malware payload (Mirai)", "value": "0f82fc36cdf416837467ced78814c4b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900862, "uuid": "3e892949-004d-4ee2-9a08-c2ddec8b7664", "comment": "Malware payload (Mirai)", "value": "2d7bd14f8e34afdcfd8a9fe1586ca33ac3c422c1402b898b592ab826bc7818f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900862, "uuid": "3be13a3a-866d-499e-872f-7caa5771fe3e", "comment": "Malware payload (Mirai)", "value": "1e41495241c374512d6c263226f9859b2122b3a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900862, "uuid": "3903f150-535c-489e-a065-db2dc9a46164", "comment": "Malware payload (Mirai)", "value": "796d83b36d9303c8a0901f3715beffec830925c29d0360735d913b798fa7a0fc2bdea657a0a4f534ce9bff11e48a4cd2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900862, "uuid": "bc5acf04-2f21-4b6a-a014-097ea71f4733", "value": "T191C34B53EA555C83C8532BB591FB86B00323EDA10B970D31A92DEBF80793ACDB98D355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900862, "uuid": "ac67b7d2-1981-4231-a348-2cdc570d0278", "value": "1536:sH8srOHdVHMySvcoPwizN/oHg4dqzrq/PqQMM1LihLbrti+lmgy7l8EADm:sc4nvQixagqqCq0Lih7Q3qli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900862, "uuid": "5a0c76e4-243d-4c3d-88e5-bffbebebd949", "value": 120596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900862, "uuid": "eb75c022-8487-484e-a226-ce810316cf52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900862, "uuid": "32b570e3-eccd-4317-b2f2-cc6cd1b4d35f", "value": "SecuriteInfo.com.Linux.Siggen.9999.4691.27973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2e44a1-5242-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910593, "uuid": "3c9d6726-b574-422f-af33-588e61e8480f", "comment": "Malware payload (Mirai)", "value": "1f94207266c98f8ddba7d6147364a461", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910593, "uuid": "7c849f02-21c5-4d37-aa15-5f3594d2575b", "comment": "Malware payload (Mirai)", "value": "2df3c73bcfad28ad2c5eaa7a7c2aa6b5450f67b6bdbc4149c6501fa58be20b2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910593, "uuid": "2f0f43d7-1ad0-469d-855e-1cdc6ed29cee", "comment": "Malware payload (Mirai)", "value": "9a5565dcfcdb295e37d96d56185036d9ee5297ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910593, "uuid": "b8cdbced-4b0b-45a5-9233-cf67bfde8aa9", "comment": "Malware payload (Mirai)", "value": "54d1437d4d78636d5610117b4e20bc53bda741b17fd352c1dd00cdb50fa2481e697f7a5cba92c857d85dfa3cb106059f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910593, "uuid": "15bb0738-3eda-4e4c-8590-2f28ab5a026a", "value": "T1E304975E6A228FADF26C873047B74B24976D23D617E1D684D1ACC6105F3039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910593, "uuid": "c3347ada-2922-43a1-87aa-5f63c5465bf4", "value": "1536:ISp0OnS37wmPluYFYTDIoatXQmBGGvFQeRIx6YziDsqlFhdLgmffJ9LcDiRWlQjV:IxOn2RDFZ9pNDssRlJ9LQlCFr92g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910593, "uuid": "f8337d25-e69e-45ac-aa03-496bb2f72a5a", "value": 185172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910593, "uuid": "1fe571bb-9818-478e-96c7-c93ac8b07167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910593, "uuid": "02ce3297-cdad-499b-ae2e-a67cdc810830", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e20708a-5298-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750947588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947588, "uuid": "953cfe34-6f0b-4ee5-98cb-d95097e3314b", "comment": "Malware payload", "value": "df4f34834cb9444a50a15b834a0c77bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947588, "uuid": "6e1a55e1-b4b8-4ef3-839f-15bf0fd8fb45", "comment": "Malware payload", "value": "2fa1d7c2ba36ef9dee6e75eb0a98035dd43c5e930910889eea91bc4c2eebe3a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947588, "uuid": "19fe1608-514e-4c63-a62a-056654e35172", "comment": "Malware payload", "value": "658726d4120e3a1ff649e3878331b75f4f4b7320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947588, "uuid": "e12c6926-b493-4c6a-befb-470cfa434fa9", "comment": "Malware payload", "value": "a57f5ecc350047f6675e1a8fe621f9c071ba79d59f8dfff3b28e4c55d3d5aa16383d40dfd0650009234a6147ba291472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947588, "uuid": "d4731caf-4ff3-4bb5-bfb2-e1094f75a1f5", "value": "T1CF267C1071E6642BC3B2037024DB625372AD78B10F218ACB72ADB55D5BF28C76635B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947588, "uuid": "ed3b5d29-8338-40d7-a118-d5989f81bac9", "value": "98304:yk/O98MrUxIIwPnhziXoYqXESyfTfKQRbCU:48BIIA2oYqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750947588, "uuid": "3ca3c530-b198-47ea-906b-fe4afa0b1016", "value": 4583424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750947588, "uuid": "c2f2c0da-512e-4a91-ba96-b479355ee91c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947588, "uuid": "bf0c8852-409a-4146-b4b7-300e483b70c3", "value": "SecuriteInfo.com.Malware-Cryptor.Hlux.2.8364.12466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd653e82-524b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750914570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914570, "uuid": "bf804a7d-b66d-46da-bbfa-a5d174f0dac7", "comment": "Malware payload", "value": "2878bf1822cc4ab3d46920ca6b242aeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914570, "uuid": "0b1e0f9b-f948-49e6-b256-472f6c8aa54d", "comment": "Malware payload", "value": "2ffcddad366c2aeb7737940abb698ba351d8c07f744d039e6bd54c05d6292280", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914570, "uuid": "1f60a4b9-b4b3-46b1-8cd7-cf93c636a024", "comment": "Malware payload", "value": "8513dd2ca12d63c6b6db3a5def3071e76f77c349", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914570, "uuid": "02bc0d64-1bfd-490f-bf09-edf93b4ba9be", "comment": "Malware payload", "value": "3301b0b57cf7f49bb30af0821bf7ce1c61bde6bf1a91df21b5687026d1b9f840a312a7e57476777a90a3564767028aa7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914570, "uuid": "0b58567a-389c-49b6-8bc6-2ae6412c6bbd", "value": "T140C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914570, "uuid": "7d071b33-319d-4491-b0f6-8fde8ba4f501", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zs:W7v+mrY2xzf03yvZ/YIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914570, "uuid": "f350b2a2-b28c-485e-aa2e-cba53c77d7ec", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914570, "uuid": "6feec62a-657d-444c-b950-6e4a8ac66c84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914570, "uuid": "3a4485a2-b07d-4ee2-b2da-924ff7dab06d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce2200e-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975933, "uuid": "9d9abd5c-6c1f-4aeb-b346-1acd5c3522ff", "comment": "Malware payload (Mirai)", "value": "ee95350a5f08ff64ce2da5f0a574cb57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975933, "uuid": "af28bffd-1599-4a88-a400-070e4663b829", "comment": "Malware payload (Mirai)", "value": "3090fc949f8bd1f57d371b55dc4b13f0759f132a1945aa91299ae239c91edcf6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975933, "uuid": "470f665a-7085-40a2-9274-fd86dc4c2178", "comment": "Malware payload (Mirai)", "value": "d547f2d8ed7e297f005c21ad209206962b719942", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975933, "uuid": "24afb751-1d48-4b2f-aa88-1eb823089f7d", "comment": "Malware payload (Mirai)", "value": "9cd9009d7ac4df3f24cae5796734c6ccd330d59615c1536d6bafeacab56f0ec4f71b0e906200a0ebc98f17078bd90830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975933, "uuid": "5d070005-225f-44da-aefa-8a0ef5391165", "value": "T134330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975933, "uuid": "dab7a9c8-e515-4ffc-a682-94282192610b", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGj:r/hqaJMDg9eqK806MHdkfQX6HuCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975933, "uuid": "efceeb1b-2d84-4f2e-b136-a911cbc4d990", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975933, "uuid": "5b2c5759-842c-470c-ae9e-4f9ba94f1450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975933, "uuid": "daf37cf6-5eef-4fb6-b02b-190a4757d508", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fab954a-5274-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750931995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931995, "uuid": "74740c18-0629-4b60-845e-c60313b3d1a2", "comment": "Malware payload (RemcosRAT)", "value": "31f77b1bc5a8b868fa8073ddb6cad532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931995, "uuid": "5deb816e-5835-412b-aa9a-568a82fd2e3d", "comment": "Malware payload (RemcosRAT)", "value": "30df94c4a321c1459296fbbb1efb2bd42e178a64fc0cfce897ec1e1bc27b7e47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931995, "uuid": "b05dd45d-3701-4fcd-a0a0-604f9cb9d081", "comment": "Malware payload (RemcosRAT)", "value": "09ca03fe0b1866c4624e5b029bc8f33ba1a064bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931995, "uuid": "077b1851-5228-449a-b584-d509d10ca2d6", "comment": "Malware payload (RemcosRAT)", "value": "873237e5c3bdd777956589e74a7d0f14ab6aad5e973627c5bb049e4912d2eec6563b8a4634d0a8143fbf58590a20f1e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931995, "uuid": "6574f175-1b55-47ba-b606-8b83fe42d35f", "value": "T13EE5CFCED61386BDDEB129B24C8E2470811E15CB9AB6C1F25BDD1A30D6DDFC18C5926C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931995, "uuid": "37aa1b11-a808-40b4-b486-2da4b876e90a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931995, "uuid": "67af07cb-6c13-4503-8933-9e45ba18726c", "value": "98304:ZOr04KYJiDNkscfhaGNalvBoECau4IzYDFos:ZE04KLqsccp2d0p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931995, "uuid": "4da6ef86-09a5-4ec0-a936-76226f8786f1", "value": 3224064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931995, "uuid": "f97268b7-6c9d-4883-a19b-7ec88a3c0924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931995, "uuid": "ae624ef4-2de6-45dd-8259-d9e45c5139ce", "value": "filerinoyes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6a814c-52a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1750952072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952072, "uuid": "24e5f456-fa30-4e78-8db5-4582415dd214", "comment": "Malware payload (LummaStealer)", "value": "c3cd8706ab7654daba87db39100b83db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952072, "uuid": "003cf7c0-e6ab-4fcb-8b4b-e716a61dd0c6", "comment": "Malware payload (LummaStealer)", "value": "3127d703cdaea1052c5403009e31f91c472a5a3e278c59b04a2ce5ceef257f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952072, "uuid": "abc051e3-7600-4ae5-b0c0-91819fb89f1b", "comment": "Malware payload (LummaStealer)", "value": "fe4027352391fb19f564e651f8a7d144996124dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952072, "uuid": "e52774e7-2f67-4ad6-b200-9cb44a27f4ef", "comment": "Malware payload (LummaStealer)", "value": "ecd7554b6e286e4dc0c808fd4a3183aeb26c2fab4b1e07c0a099f0e184c9adf28e3699eb1275dcbbb54e0c59f71c8236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952072, "uuid": "09872888-3775-4da9-b9a8-aa230dd62a2f", "value": "T13155E029D291A1EAFC7A00758551A1A5B466B527C6383FFF8390EB734F0BAC48F2D354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952072, "uuid": "d4ec2640-5eef-4c9a-aff2-71fb2c6ccb99", "value": "f1f4088bde79fbcfaa711f90bc2bbed4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952072, "uuid": "ff31047a-5e28-4701-adec-ed8ded4a725e", "value": "24576:LavuxytTiH9b2zpYfN38jalKVn9JtbwIAUZfN38jalKVn9JtbwIAU:LavuxaiHCpYf9+IKntbDf9+IKntb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750952072, "uuid": "f31a9b65-ee50-4263-ad78-d9490e4a7647", "value": 1291264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750952072, "uuid": "60228798-05cb-48fa-b3d6-4e26f0d4c7b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952072, "uuid": "a859e86c-5699-4b97-895c-9f2930afe380", "value": "AppLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31391163-529e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1750949983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949983, "uuid": "b14c3f53-e62e-49cd-9ff1-f4e4147dcb4c", "comment": "Malware payload (Rhadamanthys)", "value": "1d9103f8ea1964800b3c43ddd724a5b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949983, "uuid": "5d05198b-f01a-460f-9840-5f93e23603e5", "comment": "Malware payload (Rhadamanthys)", "value": "3133e4c0a40beded10a00349ba435b458c6841a3344810bccf3828311d2e3359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949983, "uuid": "f7d52300-d52a-4d1d-8ca4-d210c76f796b", "comment": "Malware payload (Rhadamanthys)", "value": "b8e296e715141fcc1ca467e7ed3e73cc9be2828e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949983, "uuid": "ababbca8-fa43-4c45-ab84-0a4ee485b986", "comment": "Malware payload (Rhadamanthys)", "value": "62dd95cb45f6a6e4d9feb97ae4556aa818e697d96d098aca110fb86ce228eb73cc6bc649a519ca1b704da79524deafed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949983, "uuid": "a8e49f79-20e0-4b03-89c1-c8f85ff2c5c7", "value": "T10D67330CF29C78A5F2739DB8F7D6D286D374B9B126B6CF9D4BE4AE130A015C09825274", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949983, "uuid": "8470f255-8f5b-47b0-8050-a66289f0a6a6", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949983, "uuid": "e881e928-aa11-4c6c-8e63-04e26fcc9a75", "value": "786432:rVeqEHdGtrYuZHhKQ5AKiP1pkzqXk4oSwL15tWL:JRkd6ZHhuKgpBkNR7WL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750949983, "uuid": "5b90c2d1-0810-4aea-a37f-5cd511ff3974", "value": 31611767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750949983, "uuid": "3cf88d2c-aef5-4691-bd42-265489630297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949983, "uuid": "38c5cdea-039c-45af-abff-a95bbe1e6d08", "value": "1d9103f8ea1964800b3c43ddd724a5b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1931af60-52e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750978289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978289, "uuid": "e19f0733-3bd4-4e7b-af10-fba545485aef", "comment": "Malware payload", "value": "2da584424de76e547c6e10f71c1991af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978289, "uuid": "4181f213-1152-4277-80fe-c90fc191f06a", "comment": "Malware payload", "value": "31748a19aea6c7f3da58306f1a7dbc0afd69c466f7b8c3561731c01ad8186157", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978289, "uuid": "ea1ede93-b66e-42de-a224-038fc964269f", "comment": "Malware payload", "value": "f95810ef1c1a370c1355e379fa570e6dc35d10ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978289, "uuid": "2ce5a096-f2a8-47f7-ac9d-7a8f4423c5a4", "comment": "Malware payload", "value": "84e3b08e719b04719439213650bae2d536150a404980249d3487e1355517fa43ecb828fcbe325f945b4b0d18e8edcc06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978289, "uuid": "95325529-a5ee-4e6a-b135-379de38f6313", "value": "T18EC4F1A377204F90C35195B209F389335AF6199706F39982537DEE107F20A69386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978289, "uuid": "5e302da7-4a6f-4748-a312-760817eecd09", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zC:W7v+mrY2xzf03yvZ/YIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978289, "uuid": "39187eb6-c48e-45d9-a558-0a519c446128", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978289, "uuid": "9fefafa4-8ee5-49eb-bfdf-cd99a76d5af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978289, "uuid": "437fb9ce-e4ed-4911-86d6-4429998f1737", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dda3e0c-527c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750935428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935428, "uuid": "1d7fed04-ef93-428a-99cc-a5ec68cbe304", "comment": "Malware payload", "value": "eb0b12a65795973d7ad774cc7f1bf0a0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935428, "uuid": "c1b39a00-2994-41f1-8949-8d39dbbcf4df", "comment": "Malware payload", "value": "31f7d4b5eb7d9b393564f8c2e99e585ebbf59e626b809c9d0ba672d388e72fa4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935428, "uuid": "5af797ad-cc88-4550-b570-570b6211fd39", "comment": "Malware payload", "value": "455f56e3b9fd58fd12221479d83a6b59d1d2b9b3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935428, "uuid": "1aba10bf-3b55-456b-b787-4e794b34e0c2", "comment": "Malware payload", "value": "cde70fcbe202a0655ba17ccf214a9406657a6ffb23bbed7e3d1639a19c75bbd336200256f44272a9f50f13770f8e1285", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935428, "uuid": "83fefd06-bb87-40dd-8631-4b4fa33a1268", "value": "T1510170CE61A1CC719C520CEA7596491DF8CED5D926CF8EC8E1CD0076E49DD047192F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935428, "uuid": "63d2c89f-6330-492d-a556-5abf96fea8b1", "value": "12:NLGEULnWKDbnPZw5ZMoOF7+MB05L73Nvx73NMDNkG73WyTx73WygDNks:sEUSIbK5zOt+MB0hZpZmkG1iks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935428, "uuid": "32fd00c4-3ee7-4b2b-816d-1265c9650330", "value": 713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935428, "uuid": "97cc7a4c-954e-44e0-b855-f05a6c66ec0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935428, "uuid": "6e1ff0ea-0c2c-4faa-819a-d3a41a1fbadf", "value": "lilin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ac01df-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975976, "uuid": "80f2cfb0-ff29-4da9-bb54-3e0c3d410ec3", "comment": "Malware payload (Mirai)", "value": "a2daccb147d2ead8cd6a8749b0a08fb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975976, "uuid": "41ce8b84-e9b1-4e65-b240-1e7c8889b32b", "comment": "Malware payload (Mirai)", "value": "3263bf4c413bcadd44cadd0bac2bf64f74528223ec7be70fa6a281681abaee22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975976, "uuid": "31873966-8961-4d7e-8a83-96de59980a73", "comment": "Malware payload (Mirai)", "value": "1960de9f51fd2dfb42a631006eefc16cb08818dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975976, "uuid": "b8b3687a-a12b-4a0f-8b67-af368611abbb", "comment": "Malware payload (Mirai)", "value": "ac8c277ac60be6c0939fd99b90417da75b0c2e7c352f718fa1b0bdc97633bf69479a14916293aefc8ad8072bebfd4111", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975976, "uuid": "5d0b72a4-1614-403d-a1c9-21d3a156ff91", "value": "T177630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975976, "uuid": "96d101c8-d80f-4980-a543-28952af10a8d", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975976, "uuid": "32dff228-caa8-44f2-af07-b9d5b36a1925", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975976, "uuid": "c6a446f2-91ea-462d-bd0f-4bfa0d36d798", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975976, "uuid": "8a996dbb-1141-468f-bdb1-292d896a356b", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63a1b98-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905592, "uuid": "a6439c3b-7cd2-4671-8072-d2d375ed8cc9", "comment": "Malware payload (Mirai)", "value": "2ae502249d7555c05fa4112491722082", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905592, "uuid": "904d166c-7286-4e2d-92f0-cff87853d449", "comment": "Malware payload (Mirai)", "value": "339ea98f90b0ee769fbb02e969615390c3f24e096463164c94e165182f51b3b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905592, "uuid": "d7f64ed5-4b98-4bb1-aade-df772b477df3", "comment": "Malware payload (Mirai)", "value": "41c03eda3f05bbd83072376c538603284029ca89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905592, "uuid": "1581f3a3-b62e-45ba-8586-53c0681f53e3", "comment": "Malware payload (Mirai)", "value": "31300e869b2ffc0f3f91495e8154658c061d902ba360a984584f17880175212e83d96d2c2ecc2d0e63e4c26745a90fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905592, "uuid": "126fec9e-50a0-44a4-b2f7-93a6bd84c068", "value": "T1EFD37C01B72A0647E2672DB02FFB67F093D9EDD115B15209A51EFF805232BF12886ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905592, "uuid": "ffe2e1d0-bda5-4be8-af86-cf1b89327dcc", "value": "1536:V747oddfnU7pnG3mvacKjCennL4sQoQfB2mbzGoyKHUFzEGhW4HeiRJrKRwpOwpa:VwoddfUdvabMEG2zELZiRtKaOJa81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905592, "uuid": "5434e0fb-fd96-4d3e-b965-6a6033e905d2", "value": 133082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905592, "uuid": "106949e0-8f60-4898-bc26-1c7bea542a52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905592, "uuid": "6ae422c1-1ce8-45aa-b5e9-f5e73f5e9c3b", "value": "SecuriteInfo.com.Linux.Siggen.9999.11200.21802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56417e5-52e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750979518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979518, "uuid": "8e2213df-1232-43ce-9e7c-6471cad0e375", "comment": "Malware payload", "value": "e4e90ae6276460c995c7ff6a96c60384", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979518, "uuid": "dd00628d-344c-43ca-a23d-79d62210e688", "comment": "Malware payload", "value": "341da34fe31f8b40749daf338a512cac9dfa18d66683d8ed887e070dc26d1bbf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979518, "uuid": "a47c2b46-3358-4149-9924-cc9ed061d944", "comment": "Malware payload", "value": "de08fbfd9c0fd11485dcf007a5a022a9ed1bb968", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979518, "uuid": "a1e29401-406f-4e85-8463-c071f0d5508e", "comment": "Malware payload", "value": "d07b8f2ede761b8ca4c6776cdcd7dc9e23cb7e9d9025ad8f3cf8015708d09dc4892900b24c0759686214072b0ce01994", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750979518, "uuid": "3709eb4b-462e-42ed-a93d-62c63913e5d2", "value": "T1E8A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750979518, "uuid": "76063212-5226-4918-bbdc-0d7c3e494b2e", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750979518, "uuid": "d2750797-9eea-4946-8c54-b1adab7a0ceb", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750979518, "uuid": "39f73c4c-6996-4fea-b59b-a241dc0ed6a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750979518, "uuid": "bb58fa43-c292-4fa0-8e32-bbb2d78045f3", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a5027d-52db-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750976109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976109, "uuid": "7a2e8de3-a22c-4a99-add2-a97bb2bc7bc1", "comment": "Malware payload", "value": "46ccd702ca91bbc1b4aa3191b8267151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976109, "uuid": "a15eab15-a87e-4e78-a208-cc35b1ad32fa", "comment": "Malware payload", "value": "3461bf9bde1d5e709dc405bcd322e746af00dc2f126ba4b3c1fe48bfe7b3ca79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976109, "uuid": "8d96b44a-ae9d-4cc7-84e9-54429bc35965", "comment": "Malware payload", "value": "0981d98a7319502304442ae8d381cd05e356348d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976109, "uuid": "9616db5f-414f-40eb-9d7f-7a97d50c8d6f", "comment": "Malware payload", "value": "48a0494d79dff8c7c230c4b462f448625a56fc0e0c4b7342bb7adc45b34a32d388208728d576f64d7331b798c81f1d29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976109, "uuid": "d43e0be8-a2b3-4798-bce8-2ee694e668e3", "value": "T110E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976109, "uuid": "0da615e5-3fb4-42d8-b533-760bb6f26b1c", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976109, "uuid": "26b56dce-920d-4d3e-b7c5-b2a7d9d0596e", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976109, "uuid": "16f4fc58-3634-4445-8f2a-b8b899218949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976109, "uuid": "72827133-cb1e-437f-a4fc-fda34b3f0800", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ea7b64-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905593, "uuid": "86503e49-42e6-4b7a-84ab-48459b80e79c", "comment": "Malware payload (Mirai)", "value": "7923a14a60248f0d93cd2a6e91687744", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905593, "uuid": "9238706a-5e1f-4425-bbcd-f01074d079f1", "comment": "Malware payload (Mirai)", "value": "34a6180f069652c902e4c02df7b86ad848efc19ccc1325c61850d46c1f1192b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905593, "uuid": "e442b67a-cb43-4807-9376-1f10453fef4d", "comment": "Malware payload (Mirai)", "value": "ad410006079d2123aeda9d84a110ab9c4aca872d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905593, "uuid": "e5292d80-3f17-47bc-88b5-5ec725a692d5", "comment": "Malware payload (Mirai)", "value": "f4b081a9f5210032703af69648217ac3344d4ebb9f4839f2f63c3ef524b81b1a40570051797f7b0353e55f1a36385112", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905593, "uuid": "c086f19b-a758-46db-8fa9-5a00aee290de", "value": "T1E6149E79A42D42EFD07B437B1E4752342F36DEAC1B2347686B2D6A348C623384F5999C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905593, "uuid": "d083246d-2e2d-4d24-b08c-2d2ea7dfd44b", "value": "3072:zaA8WoNQtkK1GzJ4kI3Lysqz55J/YdqhtgqvcjirQEy8XEKoWW:lzoNLKk4kILysqz55J/8qAqkjikEqMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905593, "uuid": "28e5fc45-08a4-4a46-9cad-489607d907c0", "value": 197240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905593, "uuid": "9cc3c567-0a0e-470c-918d-894fa69d4cfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905593, "uuid": "299589f1-126b-4444-956c-d4131c1f591f", "value": "SecuriteInfo.com.Linux.Siggen.9999.17422.1072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d46847-526e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1750929366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929366, "uuid": "b50fd90b-ba75-474c-90b4-9da4b7d2ec6e", "comment": "Malware payload (SnakeKeylogger)", "value": "05ba0ada6656a633bdf6c0c89120fbc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929366, "uuid": "4ba8ac38-4a1d-45f0-9eb3-2e077c1ce36d", "comment": "Malware payload (SnakeKeylogger)", "value": "34b19072c45c71ce1bbff06393ef5af4e753492eb21ffdc93350f68b54df9ae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929366, "uuid": "ba8e1e77-bd9d-4f4e-b9db-75f17badd3a8", "comment": "Malware payload (SnakeKeylogger)", "value": "3ed5a9ecc563a98d86910b5de0de32df5f779a7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929366, "uuid": "22bdd33b-84a3-4cbe-876d-9f40fad30399", "comment": "Malware payload (SnakeKeylogger)", "value": "ef1a1a7bfa0411d64aa05315aa3477c882999abe75ebc63c78847e6e229215c0a0d1c402263f29adac0acfee60b1ba5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929366, "uuid": "fdfaf576-bcd9-4b3c-a077-b2cebab2c9ae", "value": "T10335AE0273D1C062FFAB95334F5AF6115ABC79260123A62F13981DBABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929366, "uuid": "24b92883-41cb-4294-9d65-018cec67c28f", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929366, "uuid": "0b3484b8-ec52-4bd0-b07d-f6e8265080a1", "value": "24576:A5EmXFtKaL4/oFe5T9yyXYfP1ijXda8HB6Mub+Ts:APVt/LZeJbInQRa8hdub+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750929366, "uuid": "5f27dd4f-405d-42cb-8060-b399dabab74d", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750929366, "uuid": "4a6f0f4b-5a40-49a1-89dd-062d8a59562e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929366, "uuid": "9ef6fa97-9d54-4455-b6ca-2318c45fc297", "value": "PO#80967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55aa6532-5274-11f0-8bd0-42010a9c0005", "comment": "Malware payload (STRRAT)", "timestamp": 1750932005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932005, "uuid": "435bd946-245f-490f-8fde-541e4f67063d", "comment": "Malware payload (STRRAT)", "value": "4fa124910b45b89e0a0528559ecca82e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932005, "uuid": "29c1ea71-ab1f-4a31-a16d-a6f42404382a", "comment": "Malware payload (STRRAT)", "value": "34d3d36adc7dff79016c3be61db141b056a4c78caca70a4b62d34a5b67c616bb", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932005, "uuid": "25281368-9b94-46b1-8469-80aab4e08f52", "comment": "Malware payload (STRRAT)", "value": "1760fc800a81d382c9815c6e3472758ab25b7e68", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932005, "uuid": "f08f8dd5-53d4-42e5-9c1c-041f59669e75", "comment": "Malware payload (STRRAT)", "value": "623e7312d606255f9965e4a70a1743706824ae59bc180bde52b0e3ffd9ba7d868ef31c782c64c589fd8671b2e0e828b1", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932005, "uuid": "967d8cef-6146-4a87-86e0-23228286d6ec", "value": "T138C312EF1FE67C3982A455A86AE558CC1FB1A274E25E54F021F6409D62FF8C173B12C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932005, "uuid": "c79ad755-9bf8-4db5-9c47-585e76cf6b0e", "value": "3072:H/jfhK6+x7qqTKcQkIFc+f30MIzql4JgWS+KLA:HrfhK6e7qq2qBukMf4JVhKLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932005, "uuid": "8002d5a9-a5cb-46de-a93d-c571e4cde46a", "value": 125879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932005, "uuid": "7a44d3ec-25a1-499a-a9f7-61d260818a25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932005, "uuid": "e2b3471c-2e97-4f2d-8e11-bef894e57f3d", "value": "PROOF OF PAYMENT.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51bb8d0-52b6-11f0-8bd0-42010a9c0005", "comment": "Malware payload (a310Logger)", "timestamp": 1750960485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750960485, "uuid": "b6dd50e4-fa33-49be-ac03-9ed51c6a2b18", "comment": "Malware payload (a310Logger)", "value": "d113c9f1ed2d40ed8266f0ec346f2dae", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750960485, "uuid": "a8c73838-00fe-4ac9-8a91-a14037d1fe2b", "comment": "Malware payload (a310Logger)", "value": "35bef5e9ce90087beef7cedaced82461cce0fd2571cb2d4d174a582939d9fde4", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750960485, "uuid": "861a98de-c979-43f0-8849-d8f766db8e20", "comment": "Malware payload (a310Logger)", "value": "f8a00b8501b861190c3d40fe96d2c63bfbdce438", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750960485, "uuid": "0f9ae236-0204-4daa-b824-4c82d850697b", "comment": "Malware payload (a310Logger)", "value": "295df8b996aaa908d0035197c2068c8431499f28a64130aab53e17f4608eb28d5b24f1d360bcec8433b8c8cc3c379865", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750960485, "uuid": "21cd2bea-e18c-4963-b369-b8b5545d4c5d", "value": "T164251218325BAF12C5EB67F91501D0B693B9BC9EA010E36A8FC67CEB3C757924506723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750960485, "uuid": "aae9eee6-7d57-443a-afb7-119239d8ae5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750960485, "uuid": "86ef51ea-f43f-4c45-a55b-5d09157575ff", "value": "24576:NnbMnFP8sFMj0CYtDWzZrnHCuTZabhMRR1BbNg:FYn5pyJrniBmVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750960485, "uuid": "17741e13-cd78-4834-998f-de6f89ce8cfa", "value": 1052160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750960485, "uuid": "485f3537-9434-4097-839c-0e779b5008c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750960485, "uuid": "392afd2e-ca38-4819-b973-3d8f6b225251", "value": "nuevo orden.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a832fa08-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975952, "uuid": "a00a6d02-8b61-41df-a056-3339f0116895", "comment": "Malware payload (Mirai)", "value": "96e632045e247602d530973e9cb0d285", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975952, "uuid": "67b09a06-22c6-4097-ac29-07d658dcdfa5", "comment": "Malware payload (Mirai)", "value": "3655930e13702e2ef3688e0e7e4e118555e717b58bcef568b6f8abb883da158c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975952, "uuid": "77c4794a-1c71-4917-acea-d79e96f6e5c9", "comment": "Malware payload (Mirai)", "value": "02f4771a46aa56de8e51ba1fa4a54b7ebe50f152", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975952, "uuid": "25b9084e-1031-4e53-aacb-ca0d5fa2006c", "comment": "Malware payload (Mirai)", "value": "ace8b399b426c2870d1c577fb9b4225ed59f33268a405ad777ce0f3b6111750551312391598f667bf16d71378a5b9957", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975952, "uuid": "a6a2d9bf-608d-47ce-b41c-043f0486e71a", "value": "T19C03E15D194D42DEC45B41700AA207B134180F7FA046B87F7FA6EA835A9A0FCBD15BF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975952, "uuid": "66d33c93-4ee4-457f-9989-8f07b65b0795", "value": "768:4TPQjULtfF3MyvG2NDA3yYuGeScCjwslKaQWWGJgGlzDpbuR1J0:jjULzvjOyYgiwslJQWWyVJuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975952, "uuid": "d947d3f1-cbc5-4c97-a0f8-3ad5719fc743", "value": 38220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975952, "uuid": "f4a12e24-7462-4148-b610-c0c55327c4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975952, "uuid": "e79b7e9c-6945-48ef-bfba-d9acf79e440c", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db435202-527c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750935665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935665, "uuid": "6cbbf807-811b-4841-bdd3-69bb0c3bb95c", "comment": "Malware payload", "value": "1f287107fe1cd03fb7f0b67568912985", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935665, "uuid": "2b15ece3-b32a-4c07-ba45-a130f4320d45", "comment": "Malware payload", "value": "36c4208e0d750a30a9f9cd2731c2a6a61c387c6436c6ff8583270fe6637e0257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935665, "uuid": "8ff8b6b9-66e8-465f-9405-6ddfe6440b30", "comment": "Malware payload", "value": "25c2ce94f2f212798d2b8e01a939c34814b2ba2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935665, "uuid": "5ec237ba-204c-46ed-adc2-b5136284fae0", "comment": "Malware payload", "value": "f035741818988d9b4086ba9738135151adbc5095f837003af92f4c836b2d98aac7436ed29e24cf310bfa31a9f4cf5da6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935665, "uuid": "dfa6d50b-474f-45b6-bfbf-05e954d70211", "value": "T1C5C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935665, "uuid": "b852d1a2-0d5c-47a9-b4dd-8f67b35b4995", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935665, "uuid": "4bea8626-f064-4ddd-a927-e52ba5b19541", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935665, "uuid": "e9abb24d-e382-40df-9ab1-cb67d0c2b15e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935665, "uuid": "0122fc26-0900-4454-9d6a-7ae29a0293d4", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201197fb-527b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1750934922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934922, "uuid": "f61dcb1f-4113-4a9b-b46b-6e876b56dbd5", "comment": "Malware payload (AsyncRAT)", "value": "f5c6202a4f34cd046109c157a70f49d8", "object_relation": "md5", "Tag": [ { "name": "185-156-72-25", "colour": "#8E9969", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "h1dd-page-com", "colour": "#74B445", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934922, "uuid": "b18b3163-0bf5-495e-acc1-8acd0e1793d3", "comment": "Malware payload (AsyncRAT)", "value": "372b758bce8c8e3c69e1ec205b680ec5ab1a9bcaa61ac7e353253e9b0f882b99", "object_relation": "sha256", "Tag": [ { "name": "185-156-72-25", "colour": "#8E9969", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "h1dd-page-com", "colour": "#74B445", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934922, "uuid": "5c6891df-fcba-4fae-9afc-e4ef2590e563", "comment": "Malware payload (AsyncRAT)", "value": "513d15bb8860b5189dfa38454f4963bbb22ed9cf", "object_relation": "sha1", "Tag": [ { "name": "185-156-72-25", "colour": "#8E9969", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "h1dd-page-com", "colour": "#74B445", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934922, "uuid": "dd54824e-a9f3-4c8e-aa4d-d9c1f6448b14", "comment": "Malware payload (AsyncRAT)", "value": "6f3fec7916e3620b9fe55fb2f62711646b43f9bea0486611ef8fe50f45400915765848cd25e1124960c06a2a4a1e0abf", "object_relation": "sha3-384", "Tag": [ { "name": "185-156-72-25", "colour": "#8E9969", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "h1dd-page-com", "colour": "#74B445", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934922, "uuid": "713a86d7-9615-43d4-9f85-339393bc6f52", "value": "T174C08072581D1067374CD844F4FB2845B141A5D4488DCBD5F9F45D171900592E161D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934922, "uuid": "b7ae66a4-804a-42d5-8d55-debc4bbcb804", "value": "3:VSJJFIXMzqrFGMFCHmMLLH5QwoKvIjveCRRAWU4SlEFlo363AWU4SlYMHn:s8XIXMFCLmwfILDRRAWphe363AWpLGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750934922, "uuid": "d8ae6377-0566-44e1-aedf-8c75c75ce46a", "value": 165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750934922, "uuid": "78b0da01-aede-4c74-87c0-bebb1520915a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934922, "uuid": "558fa232-1f1c-42a4-b500-aa5d7adb7d15", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f718812-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978004, "uuid": "df472265-5b57-4214-9c95-e9c5c7755120", "comment": "Malware payload (Mirai)", "value": "13441e6107a2de3c880abe93d4cbf1de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978004, "uuid": "81113465-7b48-4d7d-b5af-d48dc2ced1c1", "comment": "Malware payload (Mirai)", "value": "3753b72e32c32330706e0fe485fc7fe880fb5b2d850c296c7055b735e865ff96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978004, "uuid": "f7f7a138-ff55-4634-aaf7-bd456694bea2", "comment": "Malware payload (Mirai)", "value": "a09170b3a264861c69a2fb4dc8b04f27b24e4831", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978004, "uuid": "24efc360-fc10-4507-85c0-48390e3be888", "comment": "Malware payload (Mirai)", "value": "662a5e0c6f007145ea160bd36b7389ec548292c5018d7974c7b0cf45e475eeb00ffea5cbaebb52ecd0e88bed7c17db10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978004, "uuid": "7d14025e-3d1f-4355-94bd-407fb18ca292", "value": "T1DDB2D1B063760525D6A49C3BFD99805BF3E78BAA42D9393B2C1C05AC744390C36BDD93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978004, "uuid": "8c01fad1-287c-48ab-9d82-f41a703c4792", "value": "384:iPOPKKpYLOuarGayRGBJ7O6GUhzPqzqvrETZuQLfPYB1cfxhymdGUop5hB/r:aOPKDO1GpGbhvPqoGZuQjYBqfxs3Uozj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978004, "uuid": "ee2ee9ce-691a-4b79-8ef5-402c817bf384", "value": 23436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978004, "uuid": "9ccc7454-f8f8-433a-934b-5becd97d48cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978004, "uuid": "bd1ed6c0-6f20-447b-8627-dd796021a5a5", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9facd854-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975938, "uuid": "87d741e9-f1a3-4afd-b4e5-485e17d9dc93", "comment": "Malware payload (Mirai)", "value": "8265a2983e76195419b1a63bfa2d7c19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975938, "uuid": "ba603803-37f2-4fc8-a05e-b7d32b346cdc", "comment": "Malware payload (Mirai)", "value": "37717053eab04d8bffd9992e80e4744b136d474a267930c5fb058d5f9e438c14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975938, "uuid": "b75db49b-f17a-4a29-ae3e-293450dbd4d8", "comment": "Malware payload (Mirai)", "value": "2c1934f4bc3f8d47bba25b779add4bc16b53ae2b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975938, "uuid": "812c0a7a-767e-4ba3-91e2-42093f086f29", "comment": "Malware payload (Mirai)", "value": "85e77c5665a582eae9276a2cf131a7cff048c2a1559bdc6ab37569efd8e72d396608331180fd1465cd71a602d5df2827", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975938, "uuid": "84925d11-0905-465f-a3ce-593076c83d28", "value": "T15A92C0301189DAA1DF31993BAE6DCD8736FB13F5C3AC32B5516C02AC719054E3AA87D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975938, "uuid": "918e741d-7544-448a-8a9d-8962ff5634d8", "value": "384:qR05orOXNlu0gE7hY/i8Q1kBLAmK7IR55nVDhyZhymdGUop5hbJ:qR0+OXNAFESq8Q10L/K7IR55Vgs3Uozv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975938, "uuid": "d6bc2fd6-32e0-4e8f-aeda-635f45c7f4e7", "value": 19684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975938, "uuid": "2053aa3a-5190-4512-a02b-b772e7f973ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975938, "uuid": "a6f51b8a-cff5-458e-b18b-28e60add8774", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a597cce-5242-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910592, "uuid": "f43db389-3b42-4f5c-8772-9e3079cd330e", "comment": "Malware payload (Mirai)", "value": "57a26c18c3a002dca867ebfe0235d5ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910592, "uuid": "a5a48f11-175a-440c-ac53-6c1771791516", "comment": "Malware payload (Mirai)", "value": "3775cfb53c096df5cb83f67cf417b873ca464b736c0aa2386caf0eb6d859d699", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910592, "uuid": "b762faf4-982e-4dfa-8325-3ae8f869e9e5", "comment": "Malware payload (Mirai)", "value": "f0f6999cc0c11cbcb8e91470652f98f6558f0288", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910592, "uuid": "983de1e5-bdcc-4bc1-9988-1b6bc84c1567", "comment": "Malware payload (Mirai)", "value": "c757d26ac3dbd145226fa3678d8ec40a253e7955479c4abc20bb2daf6850bba3d7521cf3483148eb150e218c4fb45cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910592, "uuid": "ad67f880-c706-434e-9ddd-b6b75fe3f0c8", "value": "T125739D63DD695D98C66882B975A4CA3A1333E940A2D71FF606E6CA37C007F9CF5093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910592, "uuid": "3cf0c1c6-c1cf-4b63-adae-2d6803e476dd", "value": "1536:5/hsv9ozAPrTFxHIp8K1jh/7TRtd56C+w9AX+I:55svezAzfHMj1V5td56yGOI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910592, "uuid": "7b16902d-511d-4123-adde-308cd13c528f", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910592, "uuid": "f484e6f7-2e4d-4698-84b5-3bccadfdfb08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910592, "uuid": "f6673069-2d4f-4188-9fbf-2de3f5063c95", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c82f205-5243-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910837, "uuid": "014e7656-8573-4f06-9064-4e1dd921e36a", "comment": "Malware payload (Mirai)", "value": "7d32179a557df37222d349f04a1ec019", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910837, "uuid": "ce7eedac-5e89-4e7f-bd25-3eacf720f627", "comment": "Malware payload (Mirai)", "value": "3787d0648bb4e0e2d82af1f5266b705455fb98e365ad422fb26eb27f6a44235d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910837, "uuid": "e72e8a5c-1c85-4e13-a4fa-c34ad5ce4a75", "comment": "Malware payload (Mirai)", "value": "4af342fbf1e927be6c4fcaab651a5aeaa8588bb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910837, "uuid": "f658cb79-6b15-444f-900b-9c4d46b97433", "comment": "Malware payload (Mirai)", "value": "1f4017b2a49d4fc5c3c2bcb2bd39d11435ea6de88979dfa758695bb012c5b116ac0b609bc3d9b7d68b4e96665a5d5689", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910837, "uuid": "e8a0fd6b-55a8-437e-9aff-5e211578a352", "value": "T105B2D018240E0A30C7B01930DE7C865766533D63C6B93191579622795FC55EBAAFC2CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910837, "uuid": "6aec7026-316a-416b-95ef-0bedfa28313e", "value": "384:BJe5rLhm9EOZHn5D1gq+MBJt8hfJeP5Fa2JtixLML0OiQhymdGUop5hXDs:/wlm9rHn5D1N+1PWR0LMLhs3UozJDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910837, "uuid": "ed01dd64-9503-46e9-bab7-6587328d0a96", "value": 23448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910837, "uuid": "d1c9ce7d-7ab8-4b9a-aa5a-04a00b154f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910837, "uuid": "ace65f7e-7ff6-4cf2-93c0-0cb5b777f49c", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d591ea65-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905591, "uuid": "ce519ce5-aeaf-4c18-adb3-b8ccd56b4e9d", "comment": "Malware payload (Mirai)", "value": "13c60bef44e799b2cb6a4e2c8fe9d2b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905591, "uuid": "c9e485b2-079d-4ea7-8bca-76b4ca4f978a", "comment": "Malware payload (Mirai)", "value": "37b8fbe3e8dfddb70c0e7b41bf83450d423f5a7fbe569dd5288d21a463bcf398", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905591, "uuid": "23d2df8c-f821-4b36-9fd4-2aadff575f39", "comment": "Malware payload (Mirai)", "value": "4b5dfed0f6dd7f168892ed61196251ca602a5016", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905591, "uuid": "6066e82e-079e-48c2-8696-9147500a7ab0", "comment": "Malware payload (Mirai)", "value": "a9f25cf98c9e7beb3580e2d4d61222ab6d508bbf9275619113021ff9c978024d4f044fc71f808a9c9ec8da6e74b9d920", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905591, "uuid": "704249c7-e22a-450f-8a04-ad94cce7d234", "value": "T11B041846BB408A13C1D21775AE6B83893333DB64D3EB33029C28BFB46F877990E66555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905591, "uuid": "47283db2-30b5-4104-8eac-c623e6fbe3ac", "value": "3072:6R+ABIPx59u1qn6DUaX5ZPouijrOPFuMYhtxl1c6iDJUwVKiIRIwV:6RXBIPx5E1qn6DTpJUjrOtuM21PiVLKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905591, "uuid": "76286e2e-533c-4d53-926f-8c7b8108edf2", "value": 181677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905591, "uuid": "bbcd0b19-82a6-44cc-9b25-a632eb4acbd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905591, "uuid": "5c545416-f11e-4ac5-9892-232e0feba742", "value": "SecuriteInfo.com.Linux.Siggen.9999.802.16632", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1602bf-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913927, "uuid": "fc53a837-18c5-4d15-8336-6bc5db3fde73", "comment": "Malware payload (Mirai)", "value": "57fdf5be2db6676ca8c226e2cfd294e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913927, "uuid": "6bc1d58a-5103-491b-be64-8c72edb3efd2", "comment": "Malware payload (Mirai)", "value": "383a8c66b19a3f0204330a5642e1e1175fb24fa6618c7fea556ea06b2b8283a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913927, "uuid": "651b2949-926e-40ae-a8ca-61215bd56237", "comment": "Malware payload (Mirai)", "value": "8d1b93323bfc9c9caf80abcde5a50b689b8f3a5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913927, "uuid": "ab34479e-04ac-45ac-b5a9-120212d31732", "comment": "Malware payload (Mirai)", "value": "08c8f0ed9bea687d06bc84bc58177342fd5cca885fe20b9e9ef8315ec6d9abbc48f0e50d2ae88ec22a5e793081ff9a82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913927, "uuid": "3fba5e2a-442e-40b2-a6d5-4ab2c5d6678f", "value": "T10663951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913927, "uuid": "e8bb1201-c4cd-4ac7-a36f-4af8924657a7", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAF:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXz2L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913927, "uuid": "02df926e-003e-4f17-a2b0-8e41cd6fa386", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913927, "uuid": "00b0712e-d10b-4c73-bbdc-38ff7e927a8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913927, "uuid": "682966b4-7717-4a3f-8645-6ddb363f7391", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6aa1dc-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978055, "uuid": "e408cd24-6349-4f84-8678-2a82f573c814", "comment": "Malware payload (Mirai)", "value": "9143997f372e96c3cbd91ebb7a778b85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978055, "uuid": "14e1f60d-6f51-4db9-9245-1bc43aec9c3c", "comment": "Malware payload (Mirai)", "value": "38d61898b22f5d5440b9e780c0ccf89272a145d706ead964452d8f9420efc7dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978055, "uuid": "50eddb0d-c7a4-433c-8fdd-1d35a241a97a", "comment": "Malware payload (Mirai)", "value": "be08112be68a45f8ed6594fe55f9c06394cb45c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978055, "uuid": "bdb92a79-0790-4404-a162-c41339b69f22", "comment": "Malware payload (Mirai)", "value": "3f49abf10b49516f6c2dafaec8555ddf09137011b3d3c49d526cb5d4ded93e4d28671de09f3c0fda79dff6c774531fac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978055, "uuid": "2482b003-b1c3-492c-8aff-c61dcec30f5f", "value": "T1AEF32A46EB818A13C0D6277AB69F424633239B54D3DB3306992CAFF43F8679E0E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978055, "uuid": "feccc108-9e72-4d5f-8284-447fb9fe9698", "value": "3072:aIMlEeychgaBCirxFNMj6grHHCbHn0xtyJT0M/9ho4:aIM0igaBCirxFSWg7CTnqtyJAM/9i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978055, "uuid": "3d24f70c-4725-4b8b-8a36-893b73aea9a2", "value": 170812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978055, "uuid": "968593ed-23f2-44f8-8fb0-c4aa3ebb4675", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978055, "uuid": "14bd28f3-ed49-457d-842c-9c93ab41dbca", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e09bc84-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978002, "uuid": "43c42ac2-a997-4b1d-815c-cc4222f7bc90", "comment": "Malware payload (Mirai)", "value": "ca558f35c1280a99b82b64fb9ea256ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978002, "uuid": "ffdbc1bd-9847-41d7-990f-5cdc12b2528c", "comment": "Malware payload (Mirai)", "value": "3902ad04763322d8f1bf0f1b5bfe72bdd41312f3722d9df6bbeaa40c976e324d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978002, "uuid": "4c9bc22d-8e52-48bd-9116-ceb0b919e551", "comment": "Malware payload (Mirai)", "value": "9372fcaef27a4e1314260c3574c88c6ec10cc918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978002, "uuid": "7ffc7a21-892c-4bdd-8d3c-a553a744c8f6", "comment": "Malware payload (Mirai)", "value": "c8f6de79f41dbb4737d775c4d4fae111f703c7a771dea617b6907df9e50f54f3123573be28aa9e5e8c8e9532050f785c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978002, "uuid": "86e43e40-427b-41b9-bb0c-32822856309b", "value": "T1A0836C21B8781D2BC4E4A57722F34332F1F6474A24A8CB2E7DB10E8DBF2559036576B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978002, "uuid": "6bcccd5b-d9f4-41aa-a6d3-6a9c448cf032", "value": "1536:3uBFkLbnhyN7om+ga0TqstlHYm5B0ocVatKM:8E0/nHYOyVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978002, "uuid": "f2457386-4636-4c33-ad78-bc240ad6cfb7", "value": 87344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978002, "uuid": "82f0725e-9961-47cf-9a89-928e3a4fa209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978002, "uuid": "bc7cbc37-b5e2-43f9-af02-2335ba16fa81", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf444ac-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975799, "uuid": "feba2cf4-34f7-4f52-ad5c-7067e0918de9", "comment": "Malware payload", "value": "ced423ce0a0e54d296c452cb293b7bfd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975799, "uuid": "81ad9bd6-1c2e-4684-968f-f471c95f882b", "comment": "Malware payload", "value": "3a6b4a3617cdd6c2331e947b63978509f40da3fcb3072e8bff43e1a6e4e49694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975799, "uuid": "56988f3c-72db-4607-9544-ee1c65339954", "comment": "Malware payload", "value": "d4216f3386b831741f8c852941e500567874975f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975799, "uuid": "602ba11a-4fd1-4c2c-99c1-f14dca65d860", "comment": "Malware payload", "value": "e100127453a4dd2695919b8f9b932f2a776af312db341e9723031def13963e9c9c60d4b92af9cb2740886ff0d3ded39a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975799, "uuid": "a75e8933-5f8d-48da-bce8-f7489584e677", "value": "T105D2B70AEFB44EA7EC7FDC7309DA0B02359D520A15A87F2A6574DC28F26E18746D3C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975799, "uuid": "db1b6583-f5b3-4f3a-a695-187019b6a930", "value": "768:ArUwgrsrsi/eHyeltkH5NZz0SQeXiMxeuzSedMw:Ar7grasi/eH7ltUTZzWGPzSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975799, "uuid": "3933a6b4-9ffd-4250-9755-0b898a921653", "value": 28856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975799, "uuid": "70ab33d9-d2b9-4fb5-b47e-dc36c4c50a8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975799, "uuid": "d1c1e864-8824-48f8-9090-606f4937299a", "value": "violetmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afabeac4-526e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750929579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929579, "uuid": "ce852259-5709-4495-b12d-d9c16c646970", "comment": "Malware payload", "value": "bc26d85696e9dc92e06b87b0039122d3", "object_relation": "md5", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Evaluator", "colour": "#DE7CEA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jscript", "colour": "#58428C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929579, "uuid": "3d405531-712a-47b3-bb91-6afb0a112395", "comment": "Malware payload", "value": "3b233cb44825c895e384cc07f5a10cf39f13188aa51bebc8516fd1faeebf4e1e", "object_relation": "sha256", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Evaluator", "colour": "#DE7CEA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jscript", "colour": "#58428C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929579, "uuid": "07f3939e-a0e7-4638-8101-fd8c540ae934", "comment": "Malware payload", "value": "b6ebecdb6f0691a723d4d74c338e9c2838a73659", "object_relation": "sha1", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Evaluator", "colour": "#DE7CEA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jscript", "colour": "#58428C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929579, "uuid": "431fa2ee-03ce-40d4-b4a1-7f87369c73e7", "comment": "Malware payload", "value": "371f8d4f8fcf46d338991683b99b2713bd54e73c92f694785731f4ac5806bd7e8bf7c45aadf62ef1a407cc7cc5bb9355", "object_relation": "sha3-384", "Tag": [ { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Evaluator", "colour": "#DE7CEA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jscript", "colour": "#58428C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929579, "uuid": "09ee2ade-de58-40f8-aceb-ecfc2e545f76", "value": "T19D222254DE98DA8516F233BED3694106EFB251D76A06D2893C8CE7002F3A53483E1EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929579, "uuid": "7d5e53f4-edcf-49db-ab65-c3552bc54571", "value": "192:D+m7nHe6APKvZb4ruVhBZcUx6JtE5aAWWAoq0VCXyM+c1QcdRr:jxhUQOUD5aAWWAoqU71cucdRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750929579, "uuid": "06cd9f20-9288-42d6-b7d6-458f723fe7f7", "value": 10297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750929579, "uuid": "58aaf18a-4c92-468f-9f03-9b8365ffd46f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929579, "uuid": "03ab11f9-adb3-41e9-89e6-691fb6c60279", "value": "deobfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3631db9-5242-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910714, "uuid": "ade98fc5-c5d3-447e-9b97-fd9f1af1a479", "comment": "Malware payload (Mirai)", "value": "0057f739321ecf658f87afc94a80efcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910714, "uuid": "266852e6-2c48-45d6-bf86-0ab8d25bb2fb", "comment": "Malware payload (Mirai)", "value": "3b7e829c7fee6108a1149dd1842985292ee5fb401e6d400771293c0fad5567be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910714, "uuid": "d30c9fd0-e388-4940-a879-73b452dd2413", "comment": "Malware payload (Mirai)", "value": "880eae52aa2adf97ef8c0b0f05324bda1b803e27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910714, "uuid": "5ce62cb3-7c5b-46d4-8f33-ac4e42065b7c", "comment": "Malware payload (Mirai)", "value": "c44d57c17cf8d23355d7876f2a11d6e8f7881533fc45548a635842d5482de93a91a7adc4ed517d61b41842c258981552", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910714, "uuid": "a8b1c2cf-76af-4b96-949e-ca1e56078b08", "value": "T1F6935CC5F683D4F6EA5705B15137A7329733E43A602AEF42C329AD36DC62910DA1B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910714, "uuid": "8e934aab-df47-490b-9cd7-ad9096c5d7a5", "value": "1536:WWmseUZNsbUI+ge96KUXUouggIyB2PRf1SwRXXl:VOUZcUIVM5qUHgSBu8wP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910714, "uuid": "184e7806-2874-48ce-963b-c460a64ecfd8", "value": 92108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910714, "uuid": "1054c1d7-d458-4aa4-a16f-d9b3806e4717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910714, "uuid": "a1ee3664-3cd4-49cb-95f8-33bb4ea89876", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01325575-5276-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750932722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932722, "uuid": "2024d853-8d77-4d4c-8998-f08cc4f90850", "comment": "Malware payload", "value": "ddc2a2754a977905a4c5fa122ce2cad7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932722, "uuid": "8c55f3d5-6834-44e4-b5f9-acac66acfdbe", "comment": "Malware payload", "value": "3cbf7e8b7969d1dad586fb5b81ede546876ebcf5cf140e8ac73c71853520ab41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932722, "uuid": "7437f31a-25c0-4082-966f-44498c71c42a", "comment": "Malware payload", "value": "048856eafc30b903df879d697941fff82862dfd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932722, "uuid": "0a82aebf-5ac2-4dbe-ab55-f2e0bf63865c", "comment": "Malware payload", "value": "cd597dabd7e796111e2bbfd5176318e6c75804bb6bd66e7dce6b78684134f32b332aca7639252a0ca3055f4bab8d55df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932722, "uuid": "a83d05c2-6d7d-42c9-a108-c65ea73c7e3f", "value": "T16DD3B30E7E619FACF3A883304BF74E349699279216E2C645D26CD5101E3074EA86FF79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932722, "uuid": "ac94f1f4-6f4b-4836-9922-25bd6305a31c", "value": "1536:tJX3ZzfPaQGoqRuhkB6oAH67NsJahxGxLMk5xg9x+r+oOXmxfBxycyCftMVa7Wjp:LQ5soL3wamxfBd6aIkYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932722, "uuid": "8dc3bf9b-076e-4ac7-9abd-ba9977d5a2eb", "value": 138524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932722, "uuid": "4add359b-f976-4430-a792-16793e51b1a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932722, "uuid": "1f96ec3b-1883-4d5e-a6bf-f8b199ceaec9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32262e85-529d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750949555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949555, "uuid": "a45adaf4-d669-4de4-96c6-dab138e530d6", "comment": "Malware payload", "value": "9f13eefcf7be406c63b327f2f434a360", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949555, "uuid": "352f7f23-32a0-464c-b1d1-58d3396f9ef6", "comment": "Malware payload", "value": "3d12d02493e902376b1f6664d901bd4030add2575539ad540c51bc00b3ed3346", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949555, "uuid": "7d16b95b-dc49-4794-bb10-04ccb005cebe", "comment": "Malware payload", "value": "c5ccfd95964df5ab0a1d9281d9f15b00b41b1752", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949555, "uuid": "d8d6b963-8fdf-4329-8cbf-f800cc4eecd4", "comment": "Malware payload", "value": "dc18ff289d7d91043ab6f62edf05c5ad9c4e5a5c58893c5a353ba6befcb285d234134359687332ad73ec68eff9be5853", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949555, "uuid": "177d598d-f64c-4754-af19-d10714210804", "value": "T10D36E11275CA8732EA7E863465AAD73625FA3FE10BB154DF63D4593A0EB05C20271F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949555, "uuid": "58889581-316d-4e4c-92ca-d8bcc2ad6cb0", "value": "98304:zxMgAtKknz5vqujsRe4frUMXjcYRgpJWCAioKcvPZUsnlFaPKwIr:zWYujsRVjBELEZUkECw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750949555, "uuid": "762ce747-fec6-4d87-b1d7-bd5af563d8c7", "value": 4965024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750949555, "uuid": "0c5e19de-0947-4d5c-8515-1a9ea2cc912e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949555, "uuid": "d7c475ca-32cf-45bd-a756-be3193898242", "value": "23NTA69-2RR-8sr99rc3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708c1c0a-52d1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750971993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750971993, "uuid": "f35d7b2c-db21-4c9b-b732-2c2221335570", "comment": "Malware payload (Formbook)", "value": "c0f1bf0ad84f82ab8a2fe9f008be49a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750971993, "uuid": "be3b1430-3c39-48e2-878a-958b9321024f", "comment": "Malware payload (Formbook)", "value": "3d4b7da0e29cdd7948064dd1a63fe86401240716d54ab1ef4d6e234e0b66807e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750971993, "uuid": "933235e5-4808-487e-9055-de21ff4d72c1", "comment": "Malware payload (Formbook)", "value": "ac09058bec98f03ae08a8c52145895f51457ff54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750971993, "uuid": "b2c2bdf2-4246-413f-8804-c049e3262b2d", "comment": "Malware payload (Formbook)", "value": "7b0cef1533ac738f9d04738250a321a7c6bd9c6abc5cf9855f7c3820ba3c365cb6f49b5be133f2f2abe56f64b4e05a07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750971993, "uuid": "c1a63cd4-cceb-45b1-ab4b-20009c0f3d29", "value": "T11755CF027381D062FFAB91734B5AF6115BBC79260123AA2F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750971993, "uuid": "a6328061-e41c-43dc-b2d5-297b2af2df4c", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750971993, "uuid": "3056f79e-b85a-4da9-afb5-256625550207", "value": "24576:M5EmXFtKaL4/oFe5T9yyXYfP1ijXdaMU5dzJgBBid/L4PXr54g5:MPVt/LZeJbInQRaMU5OEd/Lg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750971993, "uuid": "f56373de-7e01-4f2f-91e9-c57078376ffb", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750971993, "uuid": "bb818731-44a7-4e35-b503-d2f44c2fa0c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750971993, "uuid": "744a3b2a-c39b-4d6c-8203-87f0812ed404", "value": "PURCHASE ORDER_8732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97971a2f-52ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750957026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957026, "uuid": "c0c56cb3-20c9-4884-8469-a0cffcbe331f", "comment": "Malware payload (Mirai)", "value": "546d65d780ae0569ccd2610d3faf8bb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957026, "uuid": "825eeaa6-b6f7-4873-8bc1-634ccd5383f5", "comment": "Malware payload (Mirai)", "value": "3e47a2b97201434bc4607a33db6b88a0cde0f3ded5b8fe01781476c69ffee02e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957026, "uuid": "b14cb1e4-18c8-42f5-a871-d4902af252e1", "comment": "Malware payload (Mirai)", "value": "d79794cce5bb0b5a8b16cd3930e9e54e57ac1717", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957026, "uuid": "17ab8963-626c-46c7-8515-4c90cc9caf7b", "comment": "Malware payload (Mirai)", "value": "2f3c2e397a9ce8fe49c6c357927dab954f14fd5f8c957fb75fc19a526009c51aa28fce3c9324f83667e34b5838ffcf39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957026, "uuid": "ffdde25b-001f-4677-860d-a0f954cb1a80", "value": "T180E30745FC418B16C6C256BBFF4D828D77271BA8D3EE71029D246F61378B96A0E3B406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957026, "uuid": "696de9a2-6c32-45f6-8344-65a5d038957d", "value": "3072:eU0OrkRDBRbB8F3q51ANO+JNyFlaLikvXbim7jFQpOqvvkNB1NljKcWLmisy:eU0OrkLpB8FsANOWyFlav2/jvvkzXQcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957026, "uuid": "093419f8-5e34-4f85-b5a2-7db437b72826", "value": 150188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957026, "uuid": "6438627a-2c8a-4850-b3ba-d814715b1b2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957026, "uuid": "0f910f06-bca3-4cd5-97ea-be356d8f8652", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81cef77-525f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750923204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923204, "uuid": "de4fe885-8370-416a-9d70-e5f540827267", "comment": "Malware payload", "value": "d2520edf1e9fce069e202b3b13b320fd", "object_relation": "md5", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923204, "uuid": "0404b0f8-fab1-4833-8ffc-c8d7c790660b", "comment": "Malware payload", "value": "3e7384c5e7c5764258947721c7729f221fb47ef53d447a7af5db5426f1e7c13d", "object_relation": "sha256", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923204, "uuid": "bc988fbd-f0e1-453e-a463-3b34f087e3ab", "comment": "Malware payload", "value": "2d91a7d1ea04c0e8dd899a486123b853e19bd1d2", "object_relation": "sha1", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923204, "uuid": "c71b5c37-0bec-4ce0-9841-86d052dbc328", "comment": "Malware payload", "value": "307548a4e7e1db5a64dd1d058a4be2154a0fed8dba97df2eb77d67bbdc26b0785099f93cab7553f3f3f34967e585cfd9", "object_relation": "sha3-384", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923204, "uuid": "7eb8263d-b8d3-4784-9b81-b8bf31c55304", "value": "T10A348E017841C432E4BF163845BA96624ABC75630B74CEEFA7E84D3E0F765D06A326B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923204, "uuid": "31913e66-711e-4d68-bfef-028530064fe9", "value": "481b9f28907ab2c13f12afa2767df9a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923204, "uuid": "01a688fa-c6ad-48f2-89f8-ee637e2b3ba3", "value": "3072:d2LEi1j3gIcHfAPfp4V2n2E/Vz9scV7IUGDmAg0Fuj3/JXkAVunxJoOijN:dqT1pQ4KVY2EvsJUbAOjxUpOOSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750923204, "uuid": "781dc0d2-3cdd-4493-93d2-d8ccc137ee8a", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750923204, "uuid": "de0dc677-a8f7-43a9-95a8-77f37287b575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923204, "uuid": "cccf75f9-afe5-46ab-8fd8-eaee2f9f33bc", "value": "helper_process.Game Center_.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c48e120-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975798, "uuid": "998a9abe-d215-40cb-aa5e-7e1118382377", "comment": "Malware payload", "value": "62b23013828a1663c4efe2bd2c2d06e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975798, "uuid": "2c875d5e-fb3a-452f-bc5f-c6d535808333", "comment": "Malware payload", "value": "3ea8e84332a5e3f0fef9a2ee67d2a5a23b711553e1b2329d4289ba9f4005ce8d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975798, "uuid": "5f4bdbea-df26-43e0-bbe5-efc9c4b97e9d", "comment": "Malware payload", "value": "95380b87db550b21b8f327a24ff3f9fc0cd82e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975798, "uuid": "0ace427f-7615-4838-afe7-8c9c300d6c3c", "comment": "Malware payload", "value": "7394d7971b7163c1d0454071dd7e6e79775bc20ebbb926cf10be59a28216bef18938bd94b780560b0b03f04b82131c7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975798, "uuid": "4fdf0bec-60bd-41d2-a726-7d261dc11ba1", "value": "T168A2E756A20E0997C8671E702E3EB3DC970FAED522D4D189300E9A4A82BAD32514DDDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975798, "uuid": "b527b6e0-d49c-464b-a076-c39082ca1166", "value": "384:jlDNhLEb4WcaQdRShVRg/1ZaUP8SOrCmg6ATqGdlN7S0gatyJd:zWRQdRS7KOBrCm7AeGPJS3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975798, "uuid": "39126248-451d-4f3c-88ed-c11640aaf843", "value": 22500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975798, "uuid": "7007028b-9e54-42a0-8beb-2d73e4383a3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975798, "uuid": "dfee3636-ed51-46d0-8959-98de3b540a14", "value": "violetppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca02550e-5248-11f0-8bd0-42010a9c0005", "comment": "Malware payload (CoinMiner)", "timestamp": 1750913302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913302, "uuid": "a72a26de-b5ac-4983-a319-93a8f3f97c07", "comment": "Malware payload (CoinMiner)", "value": "32280d771cd50033a385ba226a65b08c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913302, "uuid": "01f8df50-fb1e-4864-905e-80aaf452bd7b", "comment": "Malware payload (CoinMiner)", "value": "3f041e65b3a2db02708a605c9bd6c83b9ed08d5049b33ee06f04479b438dd360", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913302, "uuid": "ef87a64f-6c6e-4785-b916-e46f4096656a", "comment": "Malware payload (CoinMiner)", "value": "abef81cf3f92df96f9088ef350df0a9724fb109f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913302, "uuid": "c4ac395d-dd18-4c86-91f7-2e8ebda758c6", "comment": "Malware payload (CoinMiner)", "value": "1e85bf7e72b6e35e1a821ad505f4ce2d94db4459bccba14e272a00078a94e3651098b9ddfa53a14392db785a9402a4d5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913302, "uuid": "1ec1330f-34fc-4563-b6f5-a98e6e1ea9c3", "value": "T101B5337E19246787E272D67C34DB91A3F2923850CA05019EE38AD4374EEF194692EF4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913302, "uuid": "a3f3a8b8-539a-4b2e-a1b3-ce9fd9d5488e", "value": "100e4eb60cce83d374602259a4e291d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913302, "uuid": "e21dfeab-bf7f-43ff-832c-6ec01e6d959a", "value": "49152:4G15FecpsbeehENhbck8I2G4PHEJM61TdmU2luTKcA9EWj:T5FTeb/ENqo2G4H61ToUUuecA9EWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913302, "uuid": "3b6dfd9f-a6e4-4f4f-8194-2bdbf634b247", "value": 2279936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913302, "uuid": "d69bae66-d0ad-4a71-9c5e-2213f1cdf552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913302, "uuid": "3e7547e1-fd04-4a99-a1a4-f53cca113bfb", "value": "SecuriteInfo.com.Win64.MalwareX-gen.12790.11432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a605b3d3-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975949, "uuid": "620711b5-9a36-444e-893a-870b4ea49a5e", "comment": "Malware payload (Mirai)", "value": "463051fed13183571e960a068788da15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975949, "uuid": "95a6b0f1-b40b-4f87-9f25-b72493bd24d1", "comment": "Malware payload (Mirai)", "value": "3f1ee0c8d15032ed584c78f9d47eb407cba2a47f98ec3e2330a0569173d46169", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975949, "uuid": "3dcc7878-c0d0-425d-952f-1f67862ee52f", "comment": "Malware payload (Mirai)", "value": "304d7eb2edd60ebcff40f620bc4050c38bf97cb9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975949, "uuid": "6ed8536d-8f6a-42b9-843a-acdbbf65a4ab", "comment": "Malware payload (Mirai)", "value": "af71b8b0d4cbcfc59cb712621660f105440467aa8a8c125da9c13380afda0f8975c6267c92b9268eda34a1ec3ded5383", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975949, "uuid": "dd1d78da-35fa-432e-8ecd-7737ff20dafc", "value": "T128639E77C8296E94C24556B4B9308F781B63F14482872FFB0A99C1F69097DACFA493F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975949, "uuid": "4022528c-300a-4733-9078-1b56ded86d37", "value": "1536:YuaUwtZUk+toIZlirKW3Mj3AcZCJ4hihxIwDv:7PNk+toQiOWCAcZX8/Iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975949, "uuid": "b4b41c43-93c2-4b69-8f48-be84c1babb3e", "value": 67044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975949, "uuid": "0d186427-8f08-475c-86ba-77aabd04a707", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975949, "uuid": "1480eead-477d-45e1-9c7b-78c7bfd998c4", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661029af-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750977989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977989, "uuid": "d9c67104-6ce6-4e74-b899-313615ffe82a", "comment": "Malware payload (Mirai)", "value": "e990887ad641fd7788cebc8d509429d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977989, "uuid": "3eaa9355-0060-4d43-9472-1b718038f0df", "comment": "Malware payload (Mirai)", "value": "3f444728995421d17a134dde56e0e4fef701173af450b250c38d00869779cda6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977989, "uuid": "aa9be43e-1286-4624-abfb-6a6ec74c2bc4", "comment": "Malware payload (Mirai)", "value": "0661c380ad7b37e7c39391dd27ec6838a8016b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977989, "uuid": "a7d121ef-5f0f-4e46-9052-0b6aca6be046", "comment": "Malware payload (Mirai)", "value": "28dd0d6ac40ae9559be4efc10181d84d22c71a2c5f8b7baaee4e94e3ab763efa2d3cbe61b03c9cdda358f51c57cc2d47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977989, "uuid": "1d385107-06d0-4f57-a55d-b2cdc32b7ef9", "value": "T150530131E7C9A0B6C3905E3A78921B47E7B021F0A15F60741BA483DDADE36D662FD705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977989, "uuid": "33f951db-ad11-4d30-812c-3cc9390ed431", "value": "1536:tiRWGWZAIc6djIX05wiDCcLLhLLzLjaIIDs6a/COiOeh9:jvc2I81LzGIYsnbiNT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977989, "uuid": "52cd3593-af83-4514-a140-c39641adb6a8", "value": 65412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977989, "uuid": "05f95d75-9bcd-40f9-81ab-7177dc829f39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977989, "uuid": "3057a329-fc17-4cab-8bcd-2a26e46ce7e8", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae688aa-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975796, "uuid": "556d5194-b23b-4168-901d-82951c0ba6ea", "comment": "Malware payload", "value": "0df79bf8c2198329639502aa2f6c2b3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975796, "uuid": "d83dd8f7-16ec-469d-bc4d-c06cf04927fe", "comment": "Malware payload", "value": "41240a76faf6cc5df59a9855ea2813920db84175703631ae7c6a9111d49059cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975796, "uuid": "35979912-742e-4d5b-b241-db7589d7a523", "comment": "Malware payload", "value": "0682cbab17bfafa49c746f616e8a9966a915669b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975796, "uuid": "1afb0fc5-fb18-4480-aaa1-87cfade611a5", "comment": "Malware payload", "value": "a90913294718ab9d6ef2a3add6b212e6d41a2227e360e50d02200c2cbebe5dd4d28a195b9fc1c3edaee497f1feb1b079", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975796, "uuid": "50f3996d-7bb0-4c81-b1d1-f265e381b806", "value": "T157232844F9829F16D4D925BAFF4F21897353472CE3FE7201DD244BA9278EA6B0B76801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975796, "uuid": "e25d558d-1aba-4559-b730-c1bf209e008e", "value": "768:gSnMTZPPSmy0h15nVDzYCazEQZIId6KmKluJiIdRYZv6v0RtTHgGAMe+W:gSnUZimy0hbnVSzEGIIpmKlMi6OEWAME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975796, "uuid": "1855de3a-5a86-4e75-95bc-b8b098954707", "value": 49016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975796, "uuid": "bace934c-a56e-4710-b5a2-1b6205238839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975796, "uuid": "3c9ad406-2644-4025-ab7e-8965465f7a8c", "value": "violetarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3349d38a-5251-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750916915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750916915, "uuid": "89847c85-7038-462c-be11-31f8d07f6677", "comment": "Malware payload (Mirai)", "value": "6784acc922750994065bac59a978e9bd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750916915, "uuid": "bb1f1ff0-983d-49e3-a610-c860b400a8fa", "comment": "Malware payload (Mirai)", "value": "426ac46e2e709cee13d92136890f5ddc0f32a935f222c2daa0d18465c51f3421", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750916915, "uuid": "d6eb0fdd-3dc5-473d-932a-e983b47be5b4", "comment": "Malware payload (Mirai)", "value": "3cbf87919b05d53f6127ec97110739b51fdb96e5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750916915, "uuid": "342a8f40-3eaa-478a-837b-fa139f13678a", "comment": "Malware payload (Mirai)", "value": "2dc186cb04267a3cdf3f69b9ddc25402216aa3203a9bc0dbb8f3ae5b5c95df75d6cf6fb9da79de5ee58d14008a087ddc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750916915, "uuid": "a94fc1b9-06c4-4b12-aeb2-0be9cf715f5b", "value": "T1BF01CBCE6162CC308C925DEA79534519F48DD7C536CF8EC8B1CE4132E99CD083092F5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750916915, "uuid": "417e0911-5983-442c-9138-80665b2afe07", "value": "12:NLGEULnWKDbnPZw5ZMoOF7+MB05L7pZDx7gDNk8Rj7XCx7XRDNk8R9:sEUSIbK5zOt+MB0h1Z1WkMU7ky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750916915, "uuid": "0edfec6d-59dd-474e-8992-a450838d4b7c", "value": 709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750916915, "uuid": "592736a7-6f34-410a-b592-3d88612bb0d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750916915, "uuid": "b593f76e-5631-4cff-a95a-8b1b90ff05d6", "value": "faith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da04ef31-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905598, "uuid": "76f7eeed-762b-4769-bed2-d81a28423a27", "comment": "Malware payload (Mirai)", "value": "e4db7f04bcd0cc25cedf091b3dc5d881", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905598, "uuid": "fb54af85-b272-4af1-a5e1-15a8d40cf87a", "comment": "Malware payload (Mirai)", "value": "42a5a6556f9711d120a27d0976eca3647a7ebb41b0ea2005bb49882a6ffc3ca5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905598, "uuid": "95bda0e6-09d9-4ce7-aea6-b9ec6a9e42e4", "comment": "Malware payload (Mirai)", "value": "b2fdfb4c3c15ce817f28c3894eedd0fe3578c57d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905598, "uuid": "5cbfd341-1658-4266-ad58-8a171cc82262", "comment": "Malware payload (Mirai)", "value": "f641512e783e821a4b6b5edaca802a0898128caef4743960a07bdf2945061ec4db94ef65310635683bc27e324ffeba04", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905598, "uuid": "8709bc8b-eaa7-4204-9c9e-e6b35e09ec9e", "value": "T14AC34A53EA645C83C8532BB591FB86700323EDA107970D32A92DEFF81693ACDB98D355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905598, "uuid": "26a382b8-3c1e-41f8-a9b4-6ec683c2ba7b", "value": "1536:5Hl6cZH0mMAphsIolATucBH2KL1Ar+BdiMu9GiWLbr4++D4sujDm:5Fm2+2Tb12KxhgGiW7FyDai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905598, "uuid": "4e66bbc7-e602-4020-befa-964705ffcf0c", "value": 120632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905598, "uuid": "2d58c836-c671-4aa2-862d-3bff238eccda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905598, "uuid": "447e73f8-d7c3-4962-9ebc-15fb9b91b36e", "value": "SecuriteInfo.com.Linux.Siggen.9999.9223.2277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743e1f9d-52d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975436, "uuid": "38f842b3-2c42-4511-bea7-767f39f9f80a", "comment": "Malware payload (Mirai)", "value": "f6499e828cd0b7d928afa87900b44c10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975436, "uuid": "be4a4920-bfc6-463d-acdb-3750c7846fef", "comment": "Malware payload (Mirai)", "value": "42c19e1dd32835921ef72fc470168a4c13d7fc00d1e7d36fba96c0fcf060cabb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975436, "uuid": "d44e1e87-9411-4eba-9344-87ec5591a3ff", "comment": "Malware payload (Mirai)", "value": "e94bdced1a6db14f53fa75048b617de98444caa4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975436, "uuid": "ae9e8666-3ec7-4f58-a4ae-c379d9f124a2", "comment": "Malware payload (Mirai)", "value": "a09871a2ea36ad7a5f22df734848161c61037030449f5741b4ca2e6c35a31424286532ac18ad175c4d275f4905dd6208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975436, "uuid": "a996e471-02d5-40d4-b592-5938a010393e", "value": "T100C34B46EA818F13C4D51776BAAF424533339754D3DB330699286FB43F86BAE4E23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975436, "uuid": "8846be4f-068e-4f74-a69e-ef0174171115", "value": "3072:J0Ct27Rf5lxwYavBvvYcSOE7lDYz/QLM/9LCU7:J0CqfTCYavBvQDO8Wz/AM/9LCU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975436, "uuid": "44f88484-0bf7-48b4-96cf-07b9c0152722", "value": 126735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975436, "uuid": "70e0fb79-ea37-47ef-81ac-0679c8b0c439", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975436, "uuid": "d9b3b309-d9ad-4aa7-9f6c-ba80fb47dad4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937b6a66-5249-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913640, "uuid": "a72458f9-db8c-4c11-89da-353898e9d2cb", "comment": "Malware payload (Mirai)", "value": "c5b5037cd6d52c744498fced2df87ec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913640, "uuid": "fdcfd0c7-7c34-47c5-bc0f-5879350d9747", "comment": "Malware payload (Mirai)", "value": "435309ef94da6a04fe8cbf485f672728890fde16635a89912702afb262113365", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913640, "uuid": "b8d04666-08ec-4d58-88ad-335720bb5bdf", "comment": "Malware payload (Mirai)", "value": "b93f07b0107f008d3dce6e45a017f3a7fd6dc71c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913640, "uuid": "8ab0f667-d205-48a4-bcbe-ee4a4471b7f1", "comment": "Malware payload (Mirai)", "value": "b9ffb87e1221bbc45323a16a787f594203d5df994174f280f4ce38e5b00cec3ebafa2e8ad55a44872d076eba3d2e349e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913640, "uuid": "3272aa0c-5899-4ecc-b62c-72d5456fc69f", "value": "T13FC36AB3CC296FA8D124D9B0B4B48FBD17A3B90441571FB954ABC2B48087E8DF6447B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913640, "uuid": "fc361688-743e-4a14-8995-baecff116007", "value": "1536:kgJ9xzcx9w0W8UV5eipQoAxXHCcf0TRuAiDe7meSgySrX+Daki5rF9:kg/dcxhUStT399zDe75/rX+aki5rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913640, "uuid": "4f20c7c3-0b95-4052-bd6f-49d077c52a22", "value": 120728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913640, "uuid": "b83becb7-b9ba-4df9-816c-65914345359e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913640, "uuid": "239dd551-a9cd-4047-9c24-0322d5784710", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b519c3-5272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750931259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931259, "uuid": "10875b7f-0f41-41c5-a2c6-7b2fd167eccd", "comment": "Malware payload (Mirai)", "value": "6d4eafe6623437407db0029e215043da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931259, "uuid": "20a5a4d1-bf5a-4834-98c9-214beebfa8cc", "comment": "Malware payload (Mirai)", "value": "436d06d00c43ddab0a707171a2329e3d6e2907707d5bea3b4bccc77ef53c7b04", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931259, "uuid": "ebb1b7c4-1c08-4c31-953c-9313e598dbbe", "comment": "Malware payload (Mirai)", "value": "56faf1e8e192b1915e2fa02f1fd7e816417ff2e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931259, "uuid": "1979e98c-8d84-4d6e-bac3-c0c12d0a91e2", "comment": "Malware payload (Mirai)", "value": "a50c449c05489a426ea8f9da4867e7070e32b5db5cf9a0f09384a99c62e6dcee4761209bf141672c769c63412d445b45", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931259, "uuid": "68809d64-7552-4904-a8aa-72785db1512e", "value": "T143A37D89E183DCF2E81604B1513793779B72D43B603AEE86C32D9D75E896900963B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931259, "uuid": "62acc68a-7dee-4af6-87a3-daafa5fc09f0", "value": "1536:zlp3ZUevQgEHBpmP+p8BjW9SKZ5jFX9TYIt50Sgfnve1i8X:zlp3ZUYQgETmP+p8F9KZRFtTXhRM8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931259, "uuid": "42c04d57-a46f-43e1-a89b-955396fba7f5", "value": 104396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931259, "uuid": "c1ffbb12-6269-4ad3-b098-acf17b215444", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931259, "uuid": "e7f923aa-c5e5-4566-b631-5a1de071e25d", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b437e89a-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975972, "uuid": "5eeeae3d-94d7-4a82-b8c9-e096312848c8", "comment": "Malware payload (Mirai)", "value": "5ef58e96c6473d35367fac011ba4e163", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975972, "uuid": "a1b0c534-c478-4b1d-bafc-0a8d795ad48b", "comment": "Malware payload (Mirai)", "value": "43b2ca7d1018f7bd30085078a4b7c655cdc97e1c2ab741a37c25342cdc0a6aa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975972, "uuid": "1b962f22-1801-4490-965c-2746a1e9d37f", "comment": "Malware payload (Mirai)", "value": "e9cd405b7c2c246767e6cad4d98fc8ca509a5247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975972, "uuid": "652fb846-ec9a-48c4-8142-4fcc6c1f6c11", "comment": "Malware payload (Mirai)", "value": "63d233605cb4c7f5de57f1b716afd314ac1adea3bafa42623f3de5589236c428264deaeaef89430011f18c96d023ce7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975972, "uuid": "dcfac5e8-1007-40e1-b192-3b5c7b3e39ef", "value": "T111431891BC819A23C5D4137AF56E56CD372433E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975972, "uuid": "d8c1de03-9024-407c-8188-4cf1e60b0c0f", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975972, "uuid": "60e81334-37ae-4601-91d3-ddad350fc1b6", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975972, "uuid": "d542da23-d6e8-4941-93a5-e9525cf51d86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975972, "uuid": "16840cfe-21e4-4e35-bbc2-270dab220d2a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dd00144-5274-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750932099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932099, "uuid": "5ef74938-87a5-45dd-a534-972315512450", "comment": "Malware payload", "value": "b050fb5fc0d1aa015fc612faa5b9db2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932099, "uuid": "8f9ade7d-e135-4fa4-944e-0ffa0b4ef956", "comment": "Malware payload", "value": "43c0b8ab79461d53f80720b96ef85f395816975cffa50fb44c2a4f886a8c336d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932099, "uuid": "c758dec7-37ef-4126-bc86-b75e30216569", "comment": "Malware payload", "value": "35a0a878fd9c9ecdb9d6cd353032e1f63671c9ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932099, "uuid": "27db1e4a-a54a-43d0-9db0-be9eba88151c", "comment": "Malware payload", "value": "1ff1880213a0ecf5a33800da37a3c2036bcaec677e0788f1fa13ffd82b950ee34ff26f35b0437965f03d907260347ab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932099, "uuid": "de252bfd-519a-4c06-87bd-695d224bc3c0", "value": "T148149485AFA03FFFD85FCD3301959A0A129C591A52A9BF7B2E34D404F68B14A49D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932099, "uuid": "a0acce33-7536-4a4c-9706-68605a7c4d30", "value": "3072:2VSap7qtRQShyc0kWpv8vnU3GYhV6WleAIwLeTBS:2VBp7MRQ/5JleAf2BS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932099, "uuid": "f62f3a5e-7db8-4b96-95f7-195a406ca2e7", "value": 203340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932099, "uuid": "130ba7ae-be13-446c-8dfb-1fd63cec7331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932099, "uuid": "c9f5101b-b16a-4ef8-ac2b-46d3fda121cd", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b236ae-52a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1750951581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951581, "uuid": "a59e008a-d531-4a13-a8f8-993cad07090e", "comment": "Malware payload (LummaStealer)", "value": "461bdc98358cc950e3e077a5a180d26b", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951581, "uuid": "835f214a-8a43-4223-ab0c-8b9525909dd5", "comment": "Malware payload (LummaStealer)", "value": "4400a566bf9dd0197e3fc8bf42932bf5084b4ce4bb21f2f0997dd26927f352b5", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951581, "uuid": "e8709768-212d-492b-a177-800fdf350d26", "comment": "Malware payload (LummaStealer)", "value": "34eee9f1ec611d662b83eaf964cd85350a2e0c40", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951581, "uuid": "aa6b0495-1177-41a4-bf04-58a98f7173b6", "comment": "Malware payload (LummaStealer)", "value": "e1e6d1cf2cfdbbcf7e86391e008514190084657236a714ac8267c623f977cdc660aef8196b2dbeeb571e6b37b69c35d5", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951581, "uuid": "b5f44a97-2825-41b5-90ca-801a0fe91061", "value": "T14535330683385867D7E89DF5A0F6F5C5EFDBA8D068FC940FA3160A4BBA84BD067C5418", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951581, "uuid": "aac20291-479c-4094-8719-0380ee86aa5e", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951581, "uuid": "2e1a1b7c-a711-4d77-a2d6-bd6ad49e7414", "value": "24576:p0akuVSwtTir7f3NvgUn2c/GWDsbSDEOzVg2ItXdk5ts:pyuVSA+X9cWDs+Dl5gPtX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750951581, "uuid": "ff44bd6c-ca5b-4e13-a99b-10c8566497b5", "value": 1087599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750951581, "uuid": "11a8dade-ba44-414c-88ea-f43bf90fb605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951581, "uuid": "e138b22b-9757-494c-9347-4f3e04e9c2cf", "value": "Bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0e093b-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975957, "uuid": "edfb1aa1-55e3-46f2-a330-aa4c61bfa80c", "comment": "Malware payload (Mirai)", "value": "ba5c4ccb59fd3f24c4dc5970a59aef66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975957, "uuid": "0fd75ffe-6741-4559-962c-fe44c923347e", "comment": "Malware payload (Mirai)", "value": "461ddfc23479f7c9b09c8381855899852f095ce0241df3bc2ca554f804ca3eca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975957, "uuid": "50daa515-b018-42d0-a349-dc1b117a51fd", "comment": "Malware payload (Mirai)", "value": "2b2d8337d74d0f7aa0b8729d464496c47c0c6872", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975957, "uuid": "319e83c1-a9cc-4b2e-a471-12fb208f2161", "comment": "Malware payload (Mirai)", "value": "77a2ed6fb4513d6a55f3753b82d7dd650b10af2bcc46966128da8da12d8dd356effcf6289b778b616e8c5141df5ac21c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975957, "uuid": "c086114f-926d-4566-b660-6c7f2adb62da", "value": "T101B2C0CCA1543084C98D7C7C178D4A664FACA0D0BADE9B26E354CD98B3BEA8F745D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975957, "uuid": "b9196ef3-94e9-4743-a881-1fe74d4f614c", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBpXZqSWv6:4QlS07FUXqIYSXQKqupqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975957, "uuid": "35fc4ed4-42ab-4adb-bcd4-5581e4422399", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975957, "uuid": "341c8765-ef5a-4690-a48c-53be67d7ec45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975957, "uuid": "ed5af286-7467-4990-9522-b45c74a2c13e", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40465e7-529a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1750948511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948511, "uuid": "eca6be63-c753-4fe1-80eb-54f0c75b0327", "comment": "Malware payload (DCRat)", "value": "52ccf12541242f51756ca8333d11dd7c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948511, "uuid": "30c0308b-41a4-46e0-ac22-f47f93596c83", "comment": "Malware payload (DCRat)", "value": "46400094ae7c5f83469fd5a7e44522a8001270e986a2dd8b35a34fafab661c76", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948511, "uuid": "eb48259b-684a-4fd7-8abf-1155011ce675", "comment": "Malware payload (DCRat)", "value": "639b8d8eea73a4f17e9cc6f312cd550c8f9dec8c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948511, "uuid": "49a91416-2aca-4871-89a7-0cf2ad792714", "comment": "Malware payload (DCRat)", "value": "12d5fcd7ef19857d986ef07a293639004b09e0abc2aad29068910ceed6e216fc409330e7f1ec5b1d22e72e7f368b3a6e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948511, "uuid": "981e0f0e-768e-4f54-aa1b-abe7349541bd", "value": "T110D5B12039EB502AF173EFB54BE4759ADA6FF6B33B07589E205003864713A81DDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948511, "uuid": "7882c463-9146-46f0-833f-a9d1447894ed", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948511, "uuid": "6a4dffba-b06e-494d-a5b1-a198c8e8864f", "value": "24576:2TbBv5rUyXVThIk2Jj7cJSjv1BuCw7sULd3yUJVdzxlkj/7WUx2VzUN+XpOPwOlI:IBJik2JuYNBI0KcWBAEWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750948511, "uuid": "e4de4894-fe66-4ce6-abe4-4d79e2d66ef5", "value": 2751821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750948511, "uuid": "767bb1f5-9413-4052-a1a7-097d0c8c1c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948511, "uuid": "3d32adf8-3765-4df5-806e-87face545e9a", "value": "52CCF12541242F51756CA8333D11DD7C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab50ea0-52a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750953810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953810, "uuid": "bb9e2a7d-e81b-469b-8c02-7d65129cde19", "comment": "Malware payload", "value": "268f63f5335c0c580e806ae2c72a46d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953810, "uuid": "1eee557d-040c-4655-81bc-1a678d43c858", "comment": "Malware payload", "value": "46b18ec1d88ac55d6e0bc19e385447faa2f90d276ef0d256836ae1f9f33765e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953810, "uuid": "cc61dda6-9ef3-420b-8083-c8a2d848910d", "comment": "Malware payload", "value": "95731d60a2290d436930bdd4756458d5f9c194e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953810, "uuid": "3634164a-9b33-4298-af80-2420473846c9", "comment": "Malware payload", "value": "1d63d03c44c04f3d80989b5b7e1c069fa3c718ee87404d6ddc1b45ba40603b072880ce0915bef0c9198655f8cbfe245b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953810, "uuid": "26102210-eb9a-4b33-b35f-7837086eeb26", "value": "T1B1E402017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953810, "uuid": "b4f639ae-d0fc-40fc-843e-3e89a0d526fe", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750953810, "uuid": "764d58bc-2010-4f6d-9e95-7e91b20463ee", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750953810, "uuid": "77244b78-afeb-4112-9c60-43fb07aee38b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953810, "uuid": "8aae01e4-3c7c-49d8-8242-41e0b4b96698", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb469706-52ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955825, "uuid": "3b255468-eda5-454c-b24a-687ca5ab6f0c", "comment": "Malware payload (Mirai)", "value": "e751b2d6896b8e7d3f84d545893f5b8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955825, "uuid": "914851be-6ba9-4d81-837a-9377fe0c7dee", "comment": "Malware payload (Mirai)", "value": "476eac1648e8ad591adc04d85d57c8c7bad3b36428e290e65988c43acac20e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955825, "uuid": "89f9a943-fa29-4891-bc62-79e10953f71b", "comment": "Malware payload (Mirai)", "value": "ba95e983a3fcd91888bc1498aa92d9fe268887b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955825, "uuid": "c1092a99-5b0c-449f-bb5d-96a6472ab8c8", "comment": "Malware payload (Mirai)", "value": "148fc5aca81fbfbc3282342ab1cc7aee94802cefaa356ee85c3daab73570686c56f150b0c8a95d4e3b4c0347d06d3c52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955825, "uuid": "de9d38fc-e485-4b83-bfd2-c0d289ad9290", "value": "T18373A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955825, "uuid": "ecfba276-b126-4adc-bd64-d20a50cfdc87", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStp:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955825, "uuid": "71e45847-828f-4ce9-bce4-98dc465965d5", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955825, "uuid": "a4b55cfb-435c-4917-a655-784b41367195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955825, "uuid": "e321bb48-53f7-4435-ad65-66a34876318e", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c7f0a2-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975921, "uuid": "d05a0587-b981-4bd9-8844-86aa8d7a861f", "comment": "Malware payload (Mirai)", "value": "a319af4b582f4e3ff8d02c9a4331c3a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975921, "uuid": "51afc75c-e627-496d-a3d0-51bfd0f448ef", "comment": "Malware payload (Mirai)", "value": "479b0c4a9d424cd36dd1cb39d0d5a1ad5cad18f14349bbbc5804397d9056aee0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975921, "uuid": "8f40e22c-875e-4879-bf52-2373577c5713", "comment": "Malware payload (Mirai)", "value": "70cb3482476471137e9dc02a0dd5272ef7f3d367", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975921, "uuid": "e7619644-4fd2-4728-950f-839387c90a83", "comment": "Malware payload (Mirai)", "value": "10d262d1364adb0bf59103fdf93c3ae6a02af00b6e1cda4fc09bbb71623cb3688f8f9f9d92138a952f0acee08bf22599", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975921, "uuid": "b708fe16-2b8d-4aad-aa3a-d40b7ee8637a", "value": "T124833C06F5C185FDC08AD07446AF7A39E822F0FD1379B2A327C8AF253D4AF611A5D949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975921, "uuid": "2143328c-825c-44c5-8eb8-ad9169c8cf3f", "value": "1536:9GVYSWv/YQSZDboZozkqflxU82ab9QhNNT/RFn0d+iNamP5Um5rT6Ery:UVYZDSZDboZMkqfl52c9Qzh/z0d+xM5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975921, "uuid": "19579a3f-a5cd-4c29-8c4f-0d7bc0196437", "value": 85376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975921, "uuid": "159428eb-dddd-43fc-8f05-68ef07204daa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975921, "uuid": "7d216722-73f3-41a5-9fed-6812c30b073a", "value": "star.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184b51ea-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750977858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977858, "uuid": "fc168c8c-70fa-43a8-9d45-b15b93a8c297", "comment": "Malware payload", "value": "692073f84353679a10d3a3b0e2af9df5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977858, "uuid": "373dcb60-df16-4dbd-80be-151f73880544", "comment": "Malware payload", "value": "47a98a6a0fb2426ea4fe414ca240302729d5a1bd5325453f286cc0066c21bc35", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977858, "uuid": "5a0a14bb-2d35-402c-8716-17aacc7a5b8d", "comment": "Malware payload", "value": "f72cec9a495b003a17d3570d0e22be4ee579ea48", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977858, "uuid": "ba18468d-00aa-4249-8282-689325b054e8", "comment": "Malware payload", "value": "984c752a1f8c9a64036292f1992860f362f03a4da11400c76411cbf6757535365f254eca946be81bafee684331508e2d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977858, "uuid": "e971346a-b48b-4aeb-8e54-711a533b85d5", "value": "T1722138CE746566F20168CD4071E326B4AF1AE5F193A01E29E744D83BDDC96C3B81DA8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977858, "uuid": "97c5be21-b30f-4a0a-b7ed-58aa3297f826", "value": "12:VCiMvwuYCCh9Mh3A7CCxNIpMbwtCCaqMLKw6CClM/bOCCfAMK/DCCKSMK4KZCC/c:3D7vNINeKbNhwNL9SX6lOHEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977858, "uuid": "6fb6fc34-4958-42b0-8340-8ceaf4785b6a", "value": 1207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977858, "uuid": "dc602e27-a07a-41bd-b11a-8581a7776785", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977858, "uuid": "7a615ab6-6c19-40dc-9308-1cb53e901f45", "value": "cams.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fcf2ef-5278-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933720, "uuid": "1d716b33-6059-470b-b3d3-0b3ddf3a7bdc", "comment": "Malware payload", "value": "a29430f7030d8523fdea15474a85d5dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933720, "uuid": "e010fe69-6c96-4642-b4e6-382191bb9f2a", "comment": "Malware payload", "value": "47fde74886c1ca4e73b12fd5cd58c3bba117a912a844b1a3e46df9912e67a267", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933720, "uuid": "ee855d51-aa64-4394-8f0b-2820f6f3928f", "comment": "Malware payload", "value": "70fd6f3d69f8dad70c6edce863ed6391cfcbe80f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933720, "uuid": "5580f739-6eb1-481a-9ff1-c543a8c247af", "comment": "Malware payload", "value": "27ac73f8033064aca4abaaad164e5f120b8d9d5ef8cb0bfd4e320716cd3c5b1c3c0cfa29c696e9685b623520fe1759e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933720, "uuid": "657e6640-d902-4127-bdc6-90f15cc52ec7", "value": "T1C3F35E43A55001C8E4AEE23E51866617E5F338E18FE1740F2612EB1F35C2EB27ADD99D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933720, "uuid": "ac3b734f-3e3e-420a-9b8d-42047bc243f3", "value": "c5dc0a3ab3f22aeaf807779d165c2e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933720, "uuid": "75936f4e-b391-4e3d-9ddd-df891a474058", "value": "3072:IBXXN1bWa13Z8cRIP+2x2xg6+WZpViWvZrYE8oHwRiIu57:gNdWa0c28cBKI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933720, "uuid": "3089ccbf-5af1-44ff-b505-c926da6d2edd", "value": 161432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933720, "uuid": "74c7d9b5-cb0c-4408-89d1-58f2524fbeaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933720, "uuid": "10fa989b-bd51-4f11-b6e4-09a6cbdd7810", "value": "twain_96.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c44029d-5276-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750932902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932902, "uuid": "706b37d4-f51a-4679-9b66-dcb176b278df", "comment": "Malware payload (Mirai)", "value": "49280b846733ed8adf48021d07e53ae1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932902, "uuid": "c6fd14ed-1503-4e20-be85-7529de718461", "comment": "Malware payload (Mirai)", "value": "49a564a545e583a07b76769e484431d6a54b830d1b5bdaa3204d3d4d9061006a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932902, "uuid": "348cbfc2-94ee-47ef-82aa-206ca831435e", "comment": "Malware payload (Mirai)", "value": "987b1704ac7cdf76c4c09b74a0ba47f2c474e53c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932902, "uuid": "9598053b-551a-4972-bcd3-b6160ac40d2e", "comment": "Malware payload (Mirai)", "value": "40b8125d357f9b78641a916a3a433fb7504c25c803a57c1edea2a9cb1c60ee0c6919d0e037d8e430a980a87a1a448c04", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932902, "uuid": "a65255fd-6f4f-4c9d-a1d2-7fbe3921373f", "value": "T1190170CE61A1CC719C520CEA7552491DF4CED5D926CF8EC8A1CD0076E49DE047192F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932902, "uuid": "d3fda160-98f3-41e6-950b-cdfc140cd221", "value": "12:NLGEULnWKDbnPZw5ZMoOF7+MB05L73Nvx73NMDNkkN73WyTx73WygDNkkv:sEUSIbK5zOt+MB0hZpZmkY1ikm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932902, "uuid": "5828dcaa-2a5e-4818-b436-d50e6a52d40b", "value": 709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932902, "uuid": "9f6b142e-0fcc-4c5a-ab71-d5bd3110b39a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932902, "uuid": "faa1988c-0f35-4be3-9563-556fab225217", "value": "xvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020694f2-52bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1750962359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962359, "uuid": "cb465056-032f-4914-94af-8e6c0dc0f92e", "comment": "Malware payload (AsyncRAT)", "value": "780797d9ab0c3bceb7d50a30fc3de50e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962359, "uuid": "23f234c9-a6d0-4998-bdf6-bf6d1dfd004c", "comment": "Malware payload (AsyncRAT)", "value": "4a5598e056a1f35b8638a606f9870ad2f05f00bd38076e5cf66fc99cb6309b19", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962359, "uuid": "ee64d951-a514-40a4-8be2-5f262a7b036a", "comment": "Malware payload (AsyncRAT)", "value": "ca6d3865d17265d94ff4af4f7851650244ae34bc", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962359, "uuid": "66b0ac8b-b2e1-4cc3-9260-543d911d734b", "comment": "Malware payload (AsyncRAT)", "value": "669dde93429dd62d215381de3f841459523ca2a9453a95b0bff6f67518ac3a1f7e861aaf4d569d4439b31ddb9926733f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962359, "uuid": "66ffb2b1-d6ef-4bfe-967f-576a4d23a593", "value": "T16585332465C83D86E8213B3544B33283953F89B66A3C6A5ED86F85862CF5487F345B3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962359, "uuid": "0b1b03ac-b26e-478f-9751-13b212d1c235", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962359, "uuid": "1dd12882-01d5-4313-ac4d-0e68307d1fe5", "value": "49152:jLomO28nxkWIAbETHa1hGVr3L/9+WORpbsBLn5FRWTe/Iel:GlnxHHbETHa123L1+/sBzRWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750962359, "uuid": "585642b8-8aed-47ed-bdb8-7f90ae6f6ec7", "value": 1768448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750962359, "uuid": "bc194489-a758-408a-a30d-8ef7bf194d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962359, "uuid": "2553bda8-9e32-4cfc-9090-86d6199adf10", "value": "ProxyLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bab926e-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750955235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955235, "uuid": "63e1c1b2-edf9-4464-853f-ebc30013a07a", "comment": "Malware payload", "value": "12e7912256212098c6dc1a0db96ebad5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955235, "uuid": "143939b9-13f0-4e01-8993-b55652664a7b", "comment": "Malware payload", "value": "4b1eef34c95644399dcbbd1366c17e47322b6560413a2c4a0c3fe844ba6e5631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955235, "uuid": "7e3181d5-dbfb-48da-817b-bb2b9b462f7c", "comment": "Malware payload", "value": "3e7bdca4a340f7f2c08207c673fde3ba28525f93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955235, "uuid": "214452f3-40c6-43fb-96d7-ed8d50c4156f", "comment": "Malware payload", "value": "3378b1964128ebb8852aa0851d2e9811f69b7695a11f0e0f6513b3ed963ba8826a972af8a9f4372b9788443ff3c63686", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955235, "uuid": "6e6a2229-ef7f-4c7e-bae6-eae39f2ea742", "value": "T13EC4F1A377204F91C35195B209F389335AF6199706F29982537DEE107F20A6C386BFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955235, "uuid": "da24c2f1-d024-4bab-b506-3128f78fbaff", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zw:W7v+mrY2xzf03yvZ/YIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955235, "uuid": "2198f2f4-de1c-4e63-b8d2-0aba42a1462f", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955235, "uuid": "bd28a79d-7d75-4b86-b417-7aa8ba05303e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955235, "uuid": "d5bfd5fc-39d3-4354-853f-383db2d688b2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3784a1a-5230-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750903064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750903064, "uuid": "46327f17-0369-49ef-ad50-a562f8a4c953", "comment": "Malware payload", "value": "fd5f2cf4b8df27f27dc2e6bddc1a7b2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750903064, "uuid": "1cc11a2b-77b9-48ef-b272-bb0f2006849e", "comment": "Malware payload", "value": "4b62fc86273cdc424125a34d6142162000ab8b97190bf6af428d3599e4f4c175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750903064, "uuid": "cda9faa5-8547-4733-9a01-88f474d2badd", "comment": "Malware payload", "value": "01ffdb013b7f6d96ca03b4270841e76bd06a86f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750903064, "uuid": "04984408-e007-4ac1-8f5c-eb503ade15ed", "comment": "Malware payload", "value": "0d1d493856b7af20c16e4267fecdc6d8d79d2c87818d4a9661220e5d4e31eb57d1446ba1a01d575430a02d8f82c64f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750903064, "uuid": "b475c4c2-432b-4090-9a8c-d63834835d9f", "value": "T1CF040747376940E8D1ABE17C9A974A02F3B37C650321A7CB1390877A1F677D4BE7A620", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750903064, "uuid": "11f35305-cab7-4c09-ba77-8a5021bf6bda", "value": "3bd7c8f3870f0298a912ec6ce11e8db9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750903064, "uuid": "cdcebe8a-c6ef-4694-ae21-ee10db0325ba", "value": "3072:O/eUfhyIrfMSELY36PGIjMDIqZ1jbS+AxsScaz6K+EavryQ:0xp9ELYKjMD9ZB+caT+Eav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750903064, "uuid": "b907a5b8-43b7-4eab-bf0f-dba1f55748ec", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750903064, "uuid": "4fbf8e5f-d2a0-4d79-bbcb-6e2c55b34e2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750903064, "uuid": "4a63bb4e-b606-455e-a559-2c637aa2378d", "value": "dollicleuwu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4defa61-5265-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1750925695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925695, "uuid": "08e176c8-5f59-45e8-9c6c-765e5686ec42", "comment": "Malware payload (GuLoader)", "value": "a88c972eed77d1e664639657fff489e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925695, "uuid": "a61fddfa-09ca-45b7-8df9-4fab8fc8f881", "comment": "Malware payload (GuLoader)", "value": "4ce647b161488e6299642ad0e17e75c88dd19e48e6f8954c80bb37fbd3902e73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925695, "uuid": "257be10e-121f-4404-a966-f364091f8a79", "comment": "Malware payload (GuLoader)", "value": "f098918f322702af012590e7696998c231539b50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925695, "uuid": "f046328d-9b03-4ca3-aaeb-1a0dee771a5d", "comment": "Malware payload (GuLoader)", "value": "c1131eb7c7f42364b7712bd61eebd4a48bbb04a4ac138cb3204e924219c6e943a4f1304d887dff19a5b78bb9afbc0059", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925695, "uuid": "83ebfe0d-e4bd-48f8-9ce6-59ec95b16cc8", "value": "T176F401121F480EF6ED6A9A73983701B74CB1BEB25E2045CB0BDAB3379471216D51F8B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925695, "uuid": "d7b9cd38-b92c-4bdc-8703-a9ee445c633d", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925695, "uuid": "347516f0-5f79-4f8d-b5cb-6ad36197659c", "value": "12288:2n2A7wOQd6ANIv2SFrGoEoQPytGEQ4JYsTr0RVH5YPTRWaX0itcl22:2n2TXd6GIOSAryt1JOP+AaXKlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750925695, "uuid": "2c6533e7-dbe6-4117-8236-8aeb059164c9", "value": 752751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750925695, "uuid": "8bd063ef-e98f-4db9-aae6-a24db380c9c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925695, "uuid": "d41efd46-fad5-4215-9b8c-818ff0cd54ab", "value": "Comanda_508863567007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e90afa8-5244-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750911324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911324, "uuid": "e8008ff5-3c62-4d1d-a807-6d87e6400c4c", "comment": "Malware payload", "value": "570fee219ae77e0aa2e52ba960552c80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911324, "uuid": "70c1815f-6a42-4bd7-9f6f-5bbda9a42c50", "comment": "Malware payload", "value": "4d255a64b8af09d93817908bbb43fa43e8fc8796007be70d311b22acb86aca39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911324, "uuid": "c4c482e3-07c2-4cae-98bb-2e9e824fe89d", "comment": "Malware payload", "value": "f0180ade48a04ce41b1099565ae19fc12358fbf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911324, "uuid": "f847a0b6-67be-4207-9aa2-b57bc5ed4525", "comment": "Malware payload", "value": "3679dbb58f06418547f979bb8c0090e3e11516ac5933f2c0b4b4bd0f3da350859a62ac83b29209c47f21805c1e120b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911324, "uuid": "35263ec6-0500-4efa-8077-8181c5474790", "value": "T12254B7355B4EE492C35229389AB5FD366A9911A21D3D1230CB04FFC53BA6E1C4FAB4F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911324, "uuid": "3e714f6b-8833-480f-86e5-c9634b0a291e", "value": "699cc9570c233cf12692f95447a4cdc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911324, "uuid": "a269c1b6-3e02-420a-b74c-eb796dbd52fe", "value": "6144:5XyTKXuSnOj6LPD3LGGiXCnTGOerz7DjfWKKSvX7/uYzSe:46LLL3nTGjX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750911324, "uuid": "7b1476d0-1788-4f2f-a592-aded6c489acb", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750911324, "uuid": "288667b1-b22e-424b-beef-75a006320910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911324, "uuid": "769833cc-bd46-49c3-ac41-ee1958e1e367", "value": "Downloader for Running in the 80s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99830fc9-5272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750931260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931260, "uuid": "5f4f439c-29ff-404e-99ef-9f7c21f678ab", "comment": "Malware payload (Mirai)", "value": "8a18960c155a2017a72edb08090fe85f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931260, "uuid": "7d9fb1fb-bd32-40d4-80b7-422383d9eecf", "comment": "Malware payload (Mirai)", "value": "4d2fd83e2d75dee44cd3bb8245f157b306706eb0aab2700de2149c99a2e327a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931260, "uuid": "6c08a8b4-c641-452d-9b95-961670842b37", "comment": "Malware payload (Mirai)", "value": "806b23d64c7b4285fa44085bf1f7b9bbdddf7e47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931260, "uuid": "14e1880d-ccca-41b4-a54f-70ed02661a4d", "comment": "Malware payload (Mirai)", "value": "6ac5e67468e70fcb31efb7975885a721fb4ede9bc432b88923ebdea4cd23c0c44eea5cafca06398ec130090ecfb83ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931260, "uuid": "2a03d887-6e71-456f-9ec3-3f9914b2c7a8", "value": "T12CD3F856F9819B11D5C111BAFE1E128E37231B7CE2DE72029D246B747B8B8BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931260, "uuid": "05b7186c-2fd5-4b04-ae5e-bdd6418b0fb5", "value": "3072:+iqnLUSmy0oXegBOr6aa8pvUgT0WunflCtxVFsNp:+i2dyoX/BchaHTWutYxV6Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931260, "uuid": "3814cc60-d17c-42aa-aec8-33a11ee7a691", "value": 141776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931260, "uuid": "de48cb46-00d7-4dbe-b65a-9d9116f851a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931260, "uuid": "fd0d54ee-b939-4871-acf1-a9f002d62cf7", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b951662-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975797, "uuid": "83d41679-30b1-415a-89a2-9c698beda66a", "comment": "Malware payload", "value": "07b45e8bee6c4377710bdeec7d7e8a3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975797, "uuid": "89c76cf8-9b88-4a62-b872-b2a31326a385", "comment": "Malware payload", "value": "4d49237c5cd3845dd0aa899f076a8cdc9266675223ed800b683a197625718954", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975797, "uuid": "f2cb17a9-a453-4075-9ab9-82955fb52b41", "comment": "Malware payload", "value": "faff6850b40742c2c0c51af852fac4972c61d99e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975797, "uuid": "9b76f077-e811-402a-8794-f89ebbfc54f1", "comment": "Malware payload", "value": "4d9f1cc3838ceaf3d00ceeceb88c5fa905864d788f54bb77cf927b1f0647a6711edd87e35ee420ec32a283f9cf5ddc1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975797, "uuid": "0cd06203-c431-471d-b921-a2ed2941588b", "value": "T1A2923B82E983D8F4E86249F1183AEF66D632E13D5448F646E3795672B5C3800C6B77AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975797, "uuid": "a9e6fb68-41e2-48f6-a92a-ef57748914db", "value": "384:fU9gq6EzApfwHiMwrc1h9Lm7u79/LXpVl:i6QefdXrcFm709/LpVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975797, "uuid": "b1ad8f96-f401-4e18-a656-fdbc7d7958df", "value": 19856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975797, "uuid": "0f3d218b-6fd5-4d15-804d-56f07bb6fb27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975797, "uuid": "2e7395c3-3b1d-40b9-93ee-e7b3eb804ce5", "value": "violetx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b91df28-5249-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Xorbot)", "timestamp": 1750913520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913520, "uuid": "f1647c0e-e481-4662-8b78-d9117e3c6c8b", "comment": "Malware payload (Xorbot)", "value": "cbacaf4cf3e17a70419add8853f48015", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913520, "uuid": "52d61d72-86ea-4487-80e8-28cb90f51708", "comment": "Malware payload (Xorbot)", "value": "4d9642e3ff4d31fd56fc2a22c1eb4694c5fa4445c3548bc363bfec61b18f2f0f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913520, "uuid": "cb09d2da-266e-4653-92ae-da1c80dab1d3", "comment": "Malware payload (Xorbot)", "value": "1917995451be66f8c2ce9e699049f0ec51794821", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913520, "uuid": "38f7d622-afea-4d84-8420-905d2ee28e04", "comment": "Malware payload (Xorbot)", "value": "08dd81f579060b0ef8822c6c9bb8baf1d967996f1bdf9b8cf1b2e37524ed5f063b28f86dd74d3671e1052215a05cffe6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913520, "uuid": "df3f5325-881a-4642-9020-967b845dcda5", "value": "T12A22CFCB01EC77309A966E4139A5C041E285C7C274DA66DAE6CC6C9CC09EF87B4C6BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913520, "uuid": "ee3993ee-311e-4a21-be14-62b7be89d77a", "value": "192:wV1w5NJQWOGDP4TLz9ZuKZ+Gz+duKZ+GqDP4TLzSV1w5N1:wV1w5NJQWOGDP4TLz9ZuKZ+Gz+duKZ+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913520, "uuid": "a0468231-bb0e-4a96-8d9a-632fdcdf21da", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913520, "uuid": "e72fb8a1-1c54-4642-856f-2df05c997908", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913520, "uuid": "76cb88b8-fe9d-4617-8b71-0bad998805de", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "809e161b-5296-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1750946680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946680, "uuid": "899d8cb4-d5c1-4368-b9b1-158219ee917f", "comment": "Malware payload (VIPKeylogger)", "value": "ca9db8553401924fa8b6293a03d8ae73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946680, "uuid": "69e945f0-d169-4be0-ba79-482d6621c97f", "comment": "Malware payload (VIPKeylogger)", "value": "4dcf884f07438b325d6e9500a7cb04036fbd07702777bf87421fadd264465693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946680, "uuid": "b78b379a-5a86-4cae-a966-b8ce4312fba4", "comment": "Malware payload (VIPKeylogger)", "value": "deb0ec4e3f9b6a32e65b8dcdb9bc9f7844a2b76a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946680, "uuid": "2695eed3-f478-4ebe-b05d-ae76ffcfb736", "comment": "Malware payload (VIPKeylogger)", "value": "2c228bbedf161058e0c75eaf2787fd56580fc32df1dbf8ac1c61f54a3134818a449fe1dd119acd2a40b3b0436488f45e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946680, "uuid": "9d1e07f2-d76f-4349-a93f-4f635f35c45c", "value": "T1751406BA6BB95A2AE36E1270F0A15514CBB0E49E7381DB9F174468DA1C53F40AF017F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946680, "uuid": "ecf46f6d-9075-442a-a88d-85e7e3e13574", "value": "3072:evpfU/GAG/EY5aqhWRmOmhmC5jFcbCp9758WsQXljZl5RRO876pDoAkLOojapitm:evZU+AG/boqkRmOEEbC775xBf2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750946680, "uuid": "43cfe4fa-6aa8-47ab-83de-2628f8d8ebcf", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750946680, "uuid": "61981db9-b568-4c0b-bcb0-52d89d866924", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946680, "uuid": "aeec72b2-2bff-49e4-9f93-72c7eb8bb81c", "value": "DOCUMENTS MCZ.969.20250626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615834ff-5277-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933313, "uuid": "b3cb827e-edff-4ba2-979a-74d9a6729055", "comment": "Malware payload", "value": "9f690ce273971a4e55170c73b93c6c75", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933313, "uuid": "7a7d20ae-b792-4752-a6b8-add4936187a0", "comment": "Malware payload", "value": "4f1c6d1f7166186dc96c88956222826d35289e9447acaaa94a17df99b40b8a6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933313, "uuid": "9328bb8c-5424-4c21-8461-e75269b060d2", "comment": "Malware payload", "value": "8a7c6bcf077de908a501ef3e915f78b05f1a096e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933313, "uuid": "1f59a6c8-4bad-41ea-a69d-78a94d2fd6eb", "comment": "Malware payload", "value": "a988f0922ed69b61802ac5681072ba0b9042abeef4d5bfb270812c771a6ec8e5af12d4140ede962e3de62dbb6b84fb03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933313, "uuid": "46ccb75c-35c3-497f-a5e3-51d0356b0990", "value": "T1AAE4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933313, "uuid": "38d6ce40-52c3-4dc2-9fe3-a7f6db7a44b5", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933313, "uuid": "a6084a21-fc06-480d-9da6-b61e826ab63a", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933313, "uuid": "a281efb0-d466-437d-8566-d0b7e8c754ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933313, "uuid": "5dca6723-e907-428c-9584-6fcaf582c8f5", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6e027f-5278-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Xorbot)", "timestamp": 1750934003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934003, "uuid": "7088aef7-c226-4842-904a-673c305fe90e", "comment": "Malware payload (Xorbot)", "value": "6011d99f73f4a5f44f21875644058ddc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934003, "uuid": "1065a718-c368-4edd-9792-cd5a6eeb0e71", "comment": "Malware payload (Xorbot)", "value": "4f59352c9c82fc5bf24e41e8c810016b73a026533a58886edae835236603ed2a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934003, "uuid": "bba8f52d-e1dd-46a5-9c77-90dcfee06bef", "comment": "Malware payload (Xorbot)", "value": "741bb47fa2d090662b653dad64e6543411658f66", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934003, "uuid": "208723c5-4a21-4d2f-b1f1-46414561caac", "comment": "Malware payload (Xorbot)", "value": "c972d6b8c48625d205fb7d0cb3798051b3735d4428b11a7cb310572f8bae5de01ff744b280f1dfd100447bd219277f35", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "Xorbot", "colour": "#F9F751", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934003, "uuid": "60533cd8-f012-4b94-b95f-5735e3f9bff8", "value": "T1DB2203DB01C57730EA83CD507B764881D24A87C5BEEF7BCCD5885C68818DF6BB485AA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934003, "uuid": "27858c7c-786c-4f43-b87e-ba8d07d50e03", "value": "192:3Z9EiyNZALjo0GYr73srD9jt73srD+Z9ElNZALjNNI:3Z9Ei+0GYajfZ9EUNI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750934003, "uuid": "296b168b-33e0-4917-b916-db60bda886d3", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750934003, "uuid": "a3efd9c2-79d3-4de6-9e4a-60b5ad7adb95", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934003, "uuid": "dee1949f-878f-46bb-9679-8efb2e29e927", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9efa5de5-52c3-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750966058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966058, "uuid": "56ca751a-e6e7-457b-b501-88ca4038c6ac", "comment": "Malware payload", "value": "dbf87abadf436e3a498614c70ed57521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966058, "uuid": "505864d5-dfd4-463d-a1ff-63b35fa4b21d", "comment": "Malware payload", "value": "4fc0a65fca70a71c430dedb24dfd883c0e8d687d150e355ab0e9fce25e674bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966058, "uuid": "ccbde7f3-58c5-444a-aafb-8f74dd7d689a", "comment": "Malware payload", "value": "8c3798d8da5f276c6a05cefd467f5ca9ca300348", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966058, "uuid": "c48e9e91-bf8d-4d02-9c19-ab789f854fbf", "comment": "Malware payload", "value": "ef25dc9a4c6a6e91bc3447956593429eb5cc2456bdaa16107e68cd443bdc8bb882eecad0411c5545efc7ca15e0f9c70e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966058, "uuid": "ead8f41b-051d-48df-b1ed-058335545812", "value": "T1869633403D36BBEDDC705A30351BFDBFC49DE29A945299E7C007A0922AF1BD8D1854EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966058, "uuid": "a401d51c-112d-4984-a6a9-552130da2ea6", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966058, "uuid": "1648feca-2a68-43bf-9d62-78dbb977e091", "value": "196608:qmlw76KxBf7855BrsVU6Lo4dKxAx09RYlEJablhSBK:qV76Kx655BrsW684deAx09R9cblUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750966058, "uuid": "4a367b16-6a4e-499b-a567-64afe52d4b9c", "value": 8645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750966058, "uuid": "6242f65d-1b35-46da-a612-9735c27a4c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966058, "uuid": "351d8156-3213-4317-bac6-44e71dc23909", "value": "onetap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8b773d-5285-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1750939509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750939509, "uuid": "5f1c075f-3fb9-4c83-8b0c-90cf11b2d29f", "comment": "Malware payload (ValleyRAT)", "value": "41254cd947c25fb61ea48c5a4abaf083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750939509, "uuid": "49afb3e7-f495-497f-ab1f-fa488577468f", "comment": "Malware payload (ValleyRAT)", "value": "4fce44f0c9eb6df41e0d3c4852f83843ba72a81ed12b442610e3472871994bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750939509, "uuid": "56187cb8-9a7f-4c51-bc92-7c1a31e1e4af", "comment": "Malware payload (ValleyRAT)", "value": "5e8fe463ed3960128dfc8384ea7fd140e245ef60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750939509, "uuid": "0e110d9c-6331-4ba0-a53a-bb6d58ae7d54", "comment": "Malware payload (ValleyRAT)", "value": "59f0655a0072f7990acf76a60c312c356ee4dbc239223f72f762ff9549b3d073f3d78e06743e134696164f6b77f260e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750939509, "uuid": "11f271ee-b55c-45b1-abfc-0e6015666048", "value": "T109852800FE87A9F2E4021531855BA3BF27259D051F32CBCBE6847B6EE97BAD10937245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750939509, "uuid": "a4264253-cdd1-41f9-8814-7c4efe7cd602", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750939509, "uuid": "f33a261e-aab9-46d6-913a-7644cae21fc2", "value": "24576:bYSsVzgfLQ59EJBc8CdnqCbZrPfByI6YFckQjv1SRBkg/ScvFdlTjHdQwicU8HXc:bkvGL4h6MJ9vTj9QwicUexxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750939509, "uuid": "1b7b5994-caf9-49db-8096-94b5e1ec164f", "value": 1740288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750939509, "uuid": "9279a9dc-596c-47a3-b187-cb705ac641a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750939509, "uuid": "0151929e-7423-4b0a-a57b-105327dd622d", "value": "41254CD947C25FB61EA48C5A4ABAF083.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77d720e-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975951, "uuid": "ae170428-7a17-4780-baf0-26787a32763c", "comment": "Malware payload (Mirai)", "value": "7595a160a17e6cd16278e36f0fee9f8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975951, "uuid": "cb16a726-0324-4f4a-bc87-f5c9ed0c8108", "comment": "Malware payload (Mirai)", "value": "53a398f3a2f1370c0695d90e83ab8e6312e70dd312356c100ce059bea2c8da22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975951, "uuid": "5f45f5b5-b822-4e32-859f-a93a492a8431", "comment": "Malware payload (Mirai)", "value": "bc61054fd83ff759a60fab3dea2e76b0ed1c3d81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975951, "uuid": "ca719aaf-76c5-4702-898e-3b31948a5de8", "comment": "Malware payload (Mirai)", "value": "894034db176a94bf16c26dedbdd1a3a573b9b8c3a1772b120726b34299fab1e901d961152d7450c5e6c73621a5bea183", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975951, "uuid": "a66768fb-2b35-475f-b0ce-902b4ed24eec", "value": "T15E83BF32D1156DA8C0468934B9E88E715B13F2C892932EF7EAD1C2A85047DEDF845FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975951, "uuid": "899f3683-4824-4e57-8840-9e8ac3069929", "value": "1536:maR/QhWjsu31AVSiHV4LKMcx/s3ds/fCa6Kj16pzfoVCPfTgPO:mIIhiRA8iWG/+d46KjAfoVygPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975951, "uuid": "2b75fe1b-5b68-4208-8d92-e07b1476a16d", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975951, "uuid": "134e05dc-1f9d-4f5a-87c5-b2414f568489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975951, "uuid": "41ed522d-3482-4b85-8832-2b50f2de499b", "value": "star.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4915fcc-52bb-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1750962739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962739, "uuid": "19e0cd51-17fc-4581-88fe-4cb30fe00bf2", "comment": "Malware payload (Gh0stRAT)", "value": "1fa9a2eef0ba4f1289b638bc588d24a6", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UltraVNC", "colour": "#2F35DA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962739, "uuid": "b2e572ec-bdd7-403c-84d5-4f89bdbfeaf4", "comment": "Malware payload (Gh0stRAT)", "value": "554e246d956e24c0e945884fc93eecd5998df71e12078427933e0d6fe4096ea6", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UltraVNC", "colour": "#2F35DA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962739, "uuid": "08096360-90a8-4293-b511-c4d1a3a4ae03", "comment": "Malware payload (Gh0stRAT)", "value": "fafe1cf9155c3050a7ac2018cd4347f940fbe7bc", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UltraVNC", "colour": "#2F35DA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962739, "uuid": "55290ae1-b12d-4c0c-9add-1c2213d5de30", "comment": "Malware payload (Gh0stRAT)", "value": "496e3ead7396e8ce4aa8d17be6eb9fb9ffda079915462aa6c56f85a90b1817a7501d17a7f0b87f6c3e1cbf3d93cc82b1", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "UltraVNC", "colour": "#2F35DA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962739, "uuid": "44bd1d1c-a87c-456e-995a-bef020b3cec5", "value": "T13618331279B7202AFEA6413D1559D23D533B3A0D5FD7AC669EEC0818CD311CD8E2EE86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962739, "uuid": "786414ab-1936-413e-9010-7d2bf4681055", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962739, "uuid": "dcdf38de-9151-445c-aa5f-553f6c7d557c", "value": "1572864:4EMHSwItG+Dz2tYtbMPoiBJeabZJBMLDMQUoCo45l7noDtBkaAxrMNjCjOqLeSag:v+x+DzuJBrbZXcMuCo4eBoxrMfqLi00Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750962739, "uuid": "9cd868d6-c598-4b77-a740-de13e2bc5d27", "value": 92659373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750962739, "uuid": "725bcf0c-d908-446a-b35e-abc1a3744355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962739, "uuid": "632e8c6a-d990-432f-a737-33385374d873", "value": "Setup-s-w-WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b5d30e-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900872, "uuid": "014ffe27-3c26-4be6-a5df-38e8c70b1b1f", "comment": "Malware payload (Mirai)", "value": "ad6ee20949afd87a466edd078ae326d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900872, "uuid": "14d15878-6475-4bf1-b482-52bed4d3513d", "comment": "Malware payload (Mirai)", "value": "55b96ee2d315dd8ba95ab29cdf25fe6d948f8d8ae33e0bbf8dd1e8b2c84b267a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900872, "uuid": "6a668a73-53e2-4cf1-8657-cdea4dc3313a", "comment": "Malware payload (Mirai)", "value": "f6e7250ff109006fa95825e7d022e0fcc1c5e55b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900872, "uuid": "a189887e-ac85-481b-b5d2-71443d070472", "comment": "Malware payload (Mirai)", "value": "7d675593c2f9134af8e0312f41f8f6954264c6ca230a2204b03eaceea3e023fc2e8bb25ef1b65b994307002cc7a3d6f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900872, "uuid": "adb96f69-b5fa-4cff-9b5a-d544d2fd55d9", "value": "T18B041A45FB418A13C0D21775AE6F838933329B64D3EB3302AC28BFB46F877894E66555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900872, "uuid": "67bdf9bf-dbc1-483d-9de9-be987c188e0d", "value": "3072:fR+ABIPx+9u1qn6DKhAnwioKRvrAPFujWh4xl1D1ieyu/Lsqnkh7+bV:fRXBIPx+E1qn6DWORzvrAtujv1xir4s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900872, "uuid": "8bb2c9d9-eaab-46d5-9618-b2c06a28847f", "value": 181705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900872, "uuid": "6ba34726-20e6-4dca-b581-3a5834a5619f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900872, "uuid": "02ee2da2-8751-4b31-9bb5-a8de2d222e6b", "value": "SecuriteInfo.com.Linux.Siggen.9999.15414.29240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63473bc-52b8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750961480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750961480, "uuid": "00b9d667-1af7-432b-97d5-4783c58fccd6", "comment": "Malware payload", "value": "55a73cee2db722c150f0e8a3cbd0bd07", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750961480, "uuid": "56b5a14d-7524-4e50-bdfa-69615c36b790", "comment": "Malware payload", "value": "5709f9cc6a44d37065bf0d35615eb0169cb5bd04f33eeabc3dedd35b9bc7a0e1", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750961480, "uuid": "10f58c0d-45c5-4f85-b768-dfd35461380b", "comment": "Malware payload", "value": "dfa5b5e8cf6d130880b43edf28000da53886317a", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750961480, "uuid": "2448cc69-beec-4ad0-bc60-4975d0efbba2", "comment": "Malware payload", "value": "d8c4fb6aaf2fe5fc68ccb0fe5ff36d601c1d88600be1043b8140103475f309f9e6292e83abd805fd6d67b1eb371a3ef6", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750961480, "uuid": "d759b677-4bca-4b0f-bc3c-782186205358", "value": "T19B03CF62EE170986E85642A521B93A3D89D9721E9DC036C73D3F8FC6BB10C119F721DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750961480, "uuid": "503e56c4-1c91-4f56-bad8-c992dcc287b9", "value": "768:V5f+dZ6layQ3fqt8yUNldP6G8Nk3LHqby0L7Imm4ploEs3z/1kTGLyA2Yn5cw:VpQZ4f5tzUeCEy0fAEsg2yy5cw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750961480, "uuid": "5a190182-85a8-4f4c-a3ea-622202f991b1", "value": 39193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750961480, "uuid": "e28c0303-3aa6-4e45-b13b-90d0433cc4fe", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750961480, "uuid": "dfb55eaf-fc32-4c42-8180-79e686c9cf97", "value": "673e7e7b5a970ebb85a5720e_nojiledigupapiv.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8dd58d-52a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750953812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953812, "uuid": "756022fd-e247-46a4-a300-25fad7899e57", "comment": "Malware payload (Mirai)", "value": "97e57acdf3bf33fb1282e4c4f7c4c2fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953812, "uuid": "98e71d8f-9686-41c9-a84b-8d13a150520e", "comment": "Malware payload (Mirai)", "value": "57780dd8711b15c05334df427dffd2072e6612b1e21bbb72e06e351b1fd62f1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953812, "uuid": "b05557b7-429d-4500-a526-664558e37f52", "comment": "Malware payload (Mirai)", "value": "6ed1e089eb682ec89aec0aeb31f1bcd7a8d7f774", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953812, "uuid": "ab0dfb9f-72da-4836-8c9f-0da9210e55f6", "comment": "Malware payload (Mirai)", "value": "13b869b953724d557a6faa6babacd6eb10045b303b9881cc4d8a2699cc885bd9862b1af3eaae0e9a12d4fe19096867ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953812, "uuid": "42f26c54-3f65-4a70-a35b-ada15e47faf1", "value": "T140C3E54AEA429B01D49735FAFA8F414933536BB8E3FE7101DE246F6123C699B0F76112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953812, "uuid": "6a41a910-e4d1-4ace-8504-fdf3060780d0", "value": "3072:1uswK+EKPLKTQmtgrZEVAZfJWQHZTfc2vpj80a5m8ZmkF8/Fgx2c87lcpKiVSXD:1usV+EKOMmt8ZEuZfJl5fcgpA0a5m8Zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750953812, "uuid": "41b081db-ea5b-4649-9167-fb46b68b89d0", "value": 125284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750953812, "uuid": "6814ac5a-4637-48e7-92f2-5ed8e87efc31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953812, "uuid": "782bd5a1-8b94-45e4-a129-b6054fffc657", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d64b1fd-5255-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750918757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918757, "uuid": "a632e987-0190-4351-8491-745e96429ff7", "comment": "Malware payload", "value": "2cb72cf169fac72cb75d8032689ac454", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918757, "uuid": "393c9f68-beaa-4672-b7e0-201ea575092e", "comment": "Malware payload", "value": "57a5e867fcda9320530eef4a3f3fc3e14888a195745f89fbb3046a394266d34a", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918757, "uuid": "ed5e3a6f-9d36-4bb9-8132-896f46ea98ea", "comment": "Malware payload", "value": "f855d90ae7c3f20fe91ff7c11569e077100c6fde", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918757, "uuid": "0c0b946e-212f-4a41-bbe8-c3bc865df3f1", "comment": "Malware payload", "value": "c62ae1088ba2f98b93c2539300e26da639aad0f7477ef22b5d02cafaba7b6dc641647ad992991aa19ba5c4e48f85aa26", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918757, "uuid": "e3a7855f-f8ca-4edd-90fa-eeefbbb3d9e7", "value": "T17BC08054C646C5CBC5213C0D9190F815781DF65548D1D9587145CE4F1C858E1CC5968F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918757, "uuid": "a7336984-6261-4539-972a-3e712a1bb39c", "value": "3:HRAbABGQYmcwkaGJKKnnLXgNVRsWHKGmO25YdimVVG/VClAWHyn:HRYFVmKrKKnzgDKzGE54vVG/4xHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750918757, "uuid": "eff6e902-79cc-40f7-8526-4b5cfd5bd339", "value": 176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750918757, "uuid": "54fdcdca-8455-4138-9540-356412ec1ada", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918757, "uuid": "b81c5e5b-27bb-4fad-8086-1f4ca0eab082", "value": "Purchased_Receipt.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0664461-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975939, "uuid": "9f9c9502-de12-4d45-ad85-3a41f030023e", "comment": "Malware payload (Mirai)", "value": "35701d6989c47b68b47235f4b778116d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975939, "uuid": "d044223c-54b3-400e-a951-367795dcfc76", "comment": "Malware payload (Mirai)", "value": "594e6278ebdec8d6b61961004c2f25ed47b1cba21683ed636b2c6fc8ee636730", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975939, "uuid": "a7a2a334-ba6f-4b54-82ff-94b7276a7292", "comment": "Malware payload (Mirai)", "value": "a47181223944b884e00ba4e0efbae58b23f1613b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975939, "uuid": "aa1013cf-6a38-494a-9185-7ca1885789b8", "comment": "Malware payload (Mirai)", "value": "ccdd84f3d036189b01e5264788721c414bbb62105dd20124274ee71ec40be5afe941d3d703c6054eeb06229772d3d28a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975939, "uuid": "3f071ea0-f010-4881-ae62-b31e0a606f89", "value": "T15B734AD4F693E8F5DC070538707AEB229E33F1BA6139DA97D3E46933AC517029502A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975939, "uuid": "98495aaf-a267-4800-b4fe-cf3abf5b7e91", "value": "1536:n8bw//RzreZ6ldbGzoFTgmxEyYXZsoLW1BvlUlXtMHOfEAC5wKEPcOKAuuvqM:n7//tyZ6ldbGzoFTgmx6ZsoS1BvlUlXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975939, "uuid": "624656bf-a354-45ca-b761-2b9784a81f4e", "value": 78928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975939, "uuid": "4174dc90-b353-4ecf-a9d9-d764725ea509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975939, "uuid": "e57b3861-25a6-4821-9366-a84e21494775", "value": "star.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec1b71b-527f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750936664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936664, "uuid": "30d6c305-563c-4364-af22-ccaf5dcca40d", "comment": "Malware payload", "value": "0d3f073eb62bf7dd69d9186efab78c08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936664, "uuid": "0bff9c14-6c39-4fe3-95ab-8eb4d1f547f9", "comment": "Malware payload", "value": "5a3050b4eb9af2332758755fb56bdbbd91888943b3ad901ae87e900746f4da2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936664, "uuid": "8231c3f2-30f4-463d-966c-551d3b3ad868", "comment": "Malware payload", "value": "a507f70f1185aa1d33ac02e42aa6e69a43755951", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936664, "uuid": "5c423cfe-60a8-4fb1-b3a9-761e0174fa6c", "comment": "Malware payload", "value": "c3af4307f2a5a677a0a0d86e85236faa496140aafb1f66867f8ebc9ab93e40900cd798e09e496c1322d326359507479b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936664, "uuid": "684c1d7d-72f7-4583-bbcd-478fb10536f9", "value": "T1CEC32989FC409B16C6E42ABBFE1D51CD33130BB8E2DA7116DC156F2027DA95E0E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936664, "uuid": "8e3648a3-f05a-4e24-b9cc-891d57e59c18", "value": "3072:3K3IuNw48AL5GGOfjMPdeall4v/JDokkTC3ZzHUGhK:3fuJoG8jseall43x0TCJzHfhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750936664, "uuid": "decabfd2-54d7-4be5-ba69-85d165e103c7", "value": 121460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750936664, "uuid": "597bfd50-8ad3-4c98-997b-1b0a8ba3629e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936664, "uuid": "f5f1b3cc-f3ff-46c1-9680-57587b093003", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38953afd-5262-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750924225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924225, "uuid": "35526c97-37e2-4135-8c9e-228b598278ed", "comment": "Malware payload", "value": "2f8145160b9cd87211dfb7a81a7d92b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Skuld", "colour": "#2EBBCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TMPN", "colour": "#365A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924225, "uuid": "df24296d-57c0-4c44-808d-ec66a1e99c49", "comment": "Malware payload", "value": "5a7e38a45533e0477c3868c49df16d307a3da80b97a27ac4261619ff31a219f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Skuld", "colour": "#2EBBCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TMPN", "colour": "#365A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924225, "uuid": "01986a26-00fe-444c-b988-d289efa392a5", "comment": "Malware payload", "value": "4103f19847411aeca3c46fc6f77c6d47c522b198", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Skuld", "colour": "#2EBBCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TMPN", "colour": "#365A92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924225, "uuid": "2f3381ff-3ead-480c-8e36-5b8976aab303", "comment": "Malware payload", "value": "708010e3f0f6dc7146846950deaa735252e4a2d3d2390344ae97b6c5a3a3a2afa698633fb53bb9273e8260c41964e1c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Skuld", "colour": "#2EBBCA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "TMPN", "colour": "#365A92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924225, "uuid": "a65e2162-53bf-4e64-a927-3099acc81422", "value": "T194E68C47E8B206A5D0E9A276C667C6537A713C844F3163C76BA0B7382F77BD0AA75700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924225, "uuid": "30ffcbe5-7d9b-4e30-92c8-7214d13e0890", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924225, "uuid": "c231bd12-6b30-48c8-93a6-e471785967b0", "value": "196608:48awSa50Py7TwBuroK7l2DzYavk/WhThNucXAfO7:4lwFyy7TCDzJ8/KKoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750924225, "uuid": "72e707a3-c343-4495-8f22-923b54e1bb26", "value": 15180800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750924225, "uuid": "13859654-e077-4ca9-942d-5c16374c670c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924225, "uuid": "b2dc3863-c580-4f1b-9f4b-5b75c6e107e4", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27e847d-52dd-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750977312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977312, "uuid": "4d98dc63-c940-40b1-952d-5b53933dbfc3", "comment": "Malware payload", "value": "28eaafb14efb3fa947a5d583aada4b08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977312, "uuid": "097ecc59-a030-4a70-b52e-803f24237588", "comment": "Malware payload", "value": "5a89b31bc732631ac40e01b76ae99692fbbf0ca74d0a74f817ce23685b525b59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977312, "uuid": "99e73705-4e6d-47b9-a2b0-7f95518ef94f", "comment": "Malware payload", "value": "e61a22151d3428130fe627f1fd1300addc6c4d45", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977312, "uuid": "a1997f5b-0d46-4754-880c-d6d43aca936a", "comment": "Malware payload", "value": "f7b04075b828ab6061a971ac281d4a0af4c21b5241ee595722baa95738f6b47d673549e0a036e388c91b94276b16f5b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977312, "uuid": "a2b806c2-e45f-4b72-b801-214daa8d5253", "value": "T189B41228EE4E3881F3D1E378DA0A4BB2B05B7DD0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977312, "uuid": "b4bdc2f2-7c08-424e-99a0-2102c0fa982e", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977312, "uuid": "6a03d87c-2077-4b83-b29d-d5b1a7195d8c", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977312, "uuid": "2df834a1-2c09-465b-8180-827f67576d6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977312, "uuid": "b4b5ecbe-0db8-4da1-87e0-ae0095a44720", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd429fb4-5278-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750934004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934004, "uuid": "f1c4efd9-c169-4696-9911-fe369818e339", "comment": "Malware payload", "value": "c6ab93b465d658682af6eaa766a4782f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934004, "uuid": "b30e8928-e426-4396-bf52-29abac90bb9f", "comment": "Malware payload", "value": "5a93bc917eafffa8fdbfe2eccd068450641a5dada52528c19efb98bc29ae53f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934004, "uuid": "7bc0c21c-a519-4366-a9ce-696b3910476a", "comment": "Malware payload", "value": "d0f11e44b5d0bb86d2fc4485eba0412bff5dca17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934004, "uuid": "e0926617-2ba4-4055-b9b1-3a6467ad81d1", "comment": "Malware payload", "value": "cd1ea5e4c9a53b4d079d86cbaf616eed01f7e4044a006822a18cb56f90455602d78ad113060401eb8fa35849f1ba89f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934004, "uuid": "2b9c3f0c-49ab-44f1-a81d-fd448131ffa5", "value": "T199A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934004, "uuid": "14f5149a-bd90-456d-bc8c-c731d9160773", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzfy:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750934004, "uuid": "acea8ae4-c824-4fc9-81f3-8c37a28c6243", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750934004, "uuid": "b00d581f-f9f0-40c3-bea0-3794c3feb8ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934004, "uuid": "95ff4c15-d852-44f8-b52d-d33c63554167", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2249b26-5240-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750909853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909853, "uuid": "8b10a1d7-e22f-4524-a9c8-c980247edb79", "comment": "Malware payload", "value": "2965220d5df9d7773bde3ec00a5b4447", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909853, "uuid": "87a637ef-484c-471c-b2d8-26e8e7d20ce7", "comment": "Malware payload", "value": "5a9fb9a56f4cb8cf32a3d6fe0af5535cc171dba085519ed8c7cc97f337822cb3", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909853, "uuid": "24f1e43a-1e6f-4b14-abe7-5fab19078376", "comment": "Malware payload", "value": "a5bd99a61c3ce5488378d94061ffcd75c3982e7a", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909853, "uuid": "10b48753-25eb-4a8c-b94a-e0b1e0a78bac", "comment": "Malware payload", "value": "a04e6d87825afc50d7314bb6e0239d1d45f57e346bfe9d18da66d694a2445823a54350d0160ef7abc5d32c8e879a2f0e", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909853, "uuid": "aaeb63a3-a453-4054-a243-9a67c1c057a9", "value": "T16B54D0179D144B93D45C87EDBD4B0C986F6D5B1CA2D22BEE41310FCB7AAD2220E8B51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909853, "uuid": "e0ab9d9d-8d1c-4455-9c4a-7facbaeee2e5", "value": "6144:iSvJwl3KA1oerFfseljQybNE0h7LXFl/xML1qrOC1:l46qxxQiTh77KK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750909853, "uuid": "94397c08-2b24-4bab-bd1b-4d5c39e70f38", "value": 293952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750909853, "uuid": "553856bc-050e-4ee0-aa26-883d9ca1b486", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909853, "uuid": "b1390298-a67d-4c94-9e4a-da30922fcb8d", "value": "1488578931-bandicamcrackskachatrutor.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b83d12-5245-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750911688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911688, "uuid": "7cb9e5c5-024d-4bf5-91fa-430156227e29", "comment": "Malware payload", "value": "864cd8d7080bb72c06ea04c4e8949e7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911688, "uuid": "8c0b2424-98e5-422e-be9c-e6261de88c85", "comment": "Malware payload", "value": "5ad6218e06474e750038337f3f276ed6354d6945c731ff0bf37a3b6a0b083b75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911688, "uuid": "04141321-7854-4d41-ba22-af7a83546e46", "comment": "Malware payload", "value": "fa82a995aa7492e898adbeec3b239363e3458106", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911688, "uuid": "5446bf48-5ccf-479d-8ce8-a8a333f39472", "comment": "Malware payload", "value": "5dfe9d9b8cb6b370641960688dd2177979b2c967ea607c384dcdcd785cce4769a0aee218023853aaa14f6f83bc757af7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911688, "uuid": "3aa8f4f5-43f2-455d-a273-4bb8342f2976", "value": "T11CA41294E9819B62C2C401BFFF0F45BC77A31F65E1EA71068D16EB2662D745A4F7E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911688, "uuid": "9a3a490e-db82-4969-9b51-c41e4f010547", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750911688, "uuid": "df8d0965-9a04-40b4-8b9e-7537c7a38fc0", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750911688, "uuid": "93c82723-a67d-4207-98ca-783aba27f4df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911688, "uuid": "b86d9fec-a6fd-4d9a-892b-05c0f2afd22b", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97db9795-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975925, "uuid": "0593dfc3-afa0-4398-ad5e-ae147f8359f4", "comment": "Malware payload (Mirai)", "value": "89a7a4357281f30c6a0dae4c6c958ed8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975925, "uuid": "d71522a5-8139-413f-9853-ece0f8d59949", "comment": "Malware payload (Mirai)", "value": "5c276a839ff8a30acc815a94cb04a484ba8b34e5929cf74d28e35277d031fed2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975925, "uuid": "8ffc8f1c-73d0-42b4-909c-a42703ee901c", "comment": "Malware payload (Mirai)", "value": "da069e3b5e8667f391351c093bbfab8b074286bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975925, "uuid": "529c16e1-4df5-4edf-8d28-c36dbea93918", "comment": "Malware payload (Mirai)", "value": "28c7cda4f983801b287d81f823cca58124706d04c44c3acd05166ac1272b68ffcf2dcd60a19eba9dd2ae1daa34f88965", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975925, "uuid": "c02f52f2-b245-42f5-892f-f24556050722", "value": "T1C6F2F13EB7E92697D4998930C31C9C06D2F8FD859E2EE7013D4C1102C8199B593B6BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975925, "uuid": "3a8d8551-fda9-439d-a468-50556fbb4507", "value": "768:7+fP5TF7M5jJG91qikI4JZjoMFDvzlcCVL:ifPjQFJQ1JnUjXFLyCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975925, "uuid": "d2d7d220-a8d2-4f3f-b9a7-fa3b9c06cdc4", "value": 34256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975925, "uuid": "765d5216-6721-465a-b840-33fa59f92aca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975925, "uuid": "0eeff8b3-e35d-43fc-891d-f84e85f42ad9", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebc646e-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978003, "uuid": "2149dfe4-a275-49bc-a51b-67eb0cd63151", "comment": "Malware payload (Mirai)", "value": "bddba1ed2bab36df3e547b614955f3b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978003, "uuid": "724d8cca-901f-4fdd-9e96-292c26bbed43", "comment": "Malware payload (Mirai)", "value": "5c3e7984f7928d073029feb5f290627e51b01a6ed517a6f4080a89f4302b7446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978003, "uuid": "ab1dce98-73f1-404d-bff6-c580f4e24bca", "comment": "Malware payload (Mirai)", "value": "5b6663180d2092e56faba7ad344dfd8f5f2a5e22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978003, "uuid": "9eb7f353-cb24-4ec6-8993-9d397bba4c03", "comment": "Malware payload (Mirai)", "value": "5471139d8fd8db1dc6205771f11c63d2807a860b3a4043d1a71858a8d945701fca65acacc3fc18bdee1f2f8b5fe5861c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978003, "uuid": "713dd542-587b-4e42-953d-19bbf3275311", "value": "T17B03E11715F873E6D626C03200E97D1A2E61DE4A8D88C5DB1890B963D79E72F9A0B302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978003, "uuid": "b750aef0-b9c1-4c21-86fb-f71931e5fe86", "value": "768:dTkSbi7h0BDyFe7/sjWTCiqA26+wLV5xl1YBDC51/bMBkdE5Felx4nbcuyD7UHQk:dR+7hyDyFe7+kj2TwVw5kdojFxnouy8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978003, "uuid": "bbadb776-db0b-4ec8-a6b6-a6e1c64cc23f", "value": 40024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978003, "uuid": "ef90eee1-81a6-435b-9179-4eb8d8c036ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978003, "uuid": "915e9126-5fcf-45a2-bd17-4aec7faa413d", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d1dd46-52c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750964994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750964994, "uuid": "bdad0ce7-d0e5-446d-9f53-ac7db7230b8e", "comment": "Malware payload", "value": "657b3e7af5b34b794243e70f0cc3da52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750964994, "uuid": "139d433f-ca38-4b46-99a8-6f82d45ac2f5", "comment": "Malware payload", "value": "5c630778d4787f86871e6d4391437363e7961fd82c88ef94f2dbeb589db2e551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750964994, "uuid": "39b527dd-4002-4236-ae75-88ae8fd8d883", "comment": "Malware payload", "value": "67163e3069da1a3be2b3968ce9484f478ddb6e83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750964994, "uuid": "58c59c05-390e-4ef1-ad64-37b6a41678e4", "comment": "Malware payload", "value": "88c9ef906bfe4c3ea1390a8783573c20177a8802eaa6bf5ae4f579c50b6d6daaed5bd9b08bda81536d0d3a9a7b9a2632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "netreactor", "colour": "#9E1F45", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750964994, "uuid": "c8d56a47-250d-4720-824d-5478850d13fe", "value": "T1880623A96B784926E3AE66BDB8B144110FF4E094BB0BCF1F161098DD1957B90FD03F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750964994, "uuid": "906df233-df31-4860-9bd4-0fcd6f8ee431", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750964994, "uuid": "8ca5c396-08b7-41ac-a712-043d2da85683", "value": "98304:itdPZvyV/YK+aXqDecw3GzC3Wi2Ok1c3L74x8:itdPZvGv+2qDy2hiKi3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750964994, "uuid": "a4333884-b529-4916-a5fa-89a8a8af76fe", "value": 3682816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750964994, "uuid": "c19ef980-0724-42d1-bd50-cabdac71063a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750964994, "uuid": "d79a07a7-0785-431a-ac54-8876f0ba00d4", "value": "mng.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4191ad21-5279-11f0-8bd0-42010a9c0005", "comment": "Malware payload (KoiLoader)", "timestamp": 1750934119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934119, "uuid": "513db4b1-1c67-40ff-817c-08cfe9e1684a", "comment": "Malware payload (KoiLoader)", "value": "784ee2ca6572eee4bb3ef368828b82d7", "object_relation": "md5", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934119, "uuid": "b9d92084-92fc-4d1b-aa7d-5d8031da3185", "comment": "Malware payload (KoiLoader)", "value": "5dc336e0f6481f2d00bf2097716176277b45fc2cae9a96b0e2f9f42489edc9c1", "object_relation": "sha256", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934119, "uuid": "9d00e1d6-8ea6-457e-948b-251815372894", "comment": "Malware payload (KoiLoader)", "value": "936dc3ca7e77091a04ad9a0c21fae33ae3f2cf34", "object_relation": "sha1", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934119, "uuid": "ae307dc4-38f8-47b0-b357-ef78a3aba126", "comment": "Malware payload (KoiLoader)", "value": "4ce3435ba205114d7374c06542c0688fb591faf51319cc7416a1924fde3f24491e6e9d63901f42d7e4942d79484b60e7", "object_relation": "sha3-384", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934119, "uuid": "61bb7a2b-61f1-49b9-9022-bc31e73430f4", "value": "T1D6A464EE676E1C9B0D873B7CD3415A92EE8A15A1026180DFF9DD5926F4CF11AC0B0D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934119, "uuid": "ba3bc9d0-b1b7-4284-9acb-d45a8843b7bf", "value": "6144:r4MQ8/9J3u3BiCb0ZoyzsPy9SVrO1lk5/bG0Y8StJzW1T1utLlb9NoUzBvU1V4LO:r4MQa3VSYue2IlJIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750934119, "uuid": "46cf8bfe-7e04-46e8-b750-2a89e7d562e9", "value": 478111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750934119, "uuid": "84be81e0-ea54-4af0-b95b-e6ae4155da29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934119, "uuid": "b8f2bf86-9935-424a-9d66-5bd82a4528a9", "value": "sd2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649e7e41-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750977986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977986, "uuid": "40da6fb0-329a-4867-8000-d2f528f3aaae", "comment": "Malware payload", "value": "c57e1c38ce1707d57d1e462e4fddf01f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977986, "uuid": "816514e0-a246-4488-9ee5-e785171dfc8b", "comment": "Malware payload", "value": "5e65465634d02ef6cedf98b46670397f929e34b0e0c7cf1b04b5399fe061b231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977986, "uuid": "6e7b0777-6ce1-415c-b53e-8350fa383771", "comment": "Malware payload", "value": "ee2aea5bbb62f66ceef7ba5ebaa49fd7dcf9630a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977986, "uuid": "540c73f3-b826-4933-8a77-8034f943027e", "comment": "Malware payload", "value": "e49ae51468e3a62b42f70a4c9eacb2abdaf065c71c03923e5299d9bcd006dc8f4feb2f4dd79a7105fa0635d125f1573d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977986, "uuid": "ba29f19a-0bee-43e1-934b-7ff7973d932a", "value": "T1F4C4F1A377204F90C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977986, "uuid": "3ee0008e-648c-4cc9-9df3-73911a3c52de", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zs:W7v+mrY2xzf03yvZ/YIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977986, "uuid": "cc51ed13-cd16-420d-9f02-fb91ffced1fd", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977986, "uuid": "7e654c5e-7367-4df6-b6b0-c9a8b9c7e5b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977986, "uuid": "10aed03f-80ae-44dd-a353-95dc142c17c1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fdb99e-52b4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750959623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750959623, "uuid": "931211bd-1def-4972-955b-59462b8136ff", "comment": "Malware payload", "value": "dab7bf10cad3999aefc313dc9ec9b5df", "object_relation": "md5", "Tag": [ { "name": "185-156-72-25", "colour": "#8E9969", "exportable": true, "hide_tag": false }, { "name": "185-156-72-77", "colour": "#E30BDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wait-load-page-com", "colour": "#3A265B", "exportable": true, "hide_tag": false }, { "name": "wait-load-page[.]com", "colour": "#20E960", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750959623, "uuid": "92c48eb9-9d36-45a6-b744-251835d4a04c", "comment": "Malware payload", "value": "5eada362d1a6d182540885c33598baf3772e3598028b789b4f8f2dbcf44bfa75", "object_relation": "sha256", "Tag": [ { "name": "185-156-72-25", "colour": "#8E9969", "exportable": true, "hide_tag": false }, { "name": "185-156-72-77", "colour": "#E30BDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wait-load-page-com", "colour": "#3A265B", "exportable": true, "hide_tag": false }, { "name": "wait-load-page[.]com", "colour": "#20E960", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750959623, "uuid": "c264b1ce-596a-4d46-be6f-5a2a261c6a23", "comment": "Malware payload", "value": "450c375c42ef2df3326087d6f280c2c3bb7cf0b4", "object_relation": "sha1", "Tag": [ { "name": "185-156-72-25", "colour": "#8E9969", "exportable": true, "hide_tag": false }, { "name": "185-156-72-77", "colour": "#E30BDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wait-load-page-com", "colour": "#3A265B", "exportable": true, "hide_tag": false }, { "name": "wait-load-page[.]com", "colour": "#20E960", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750959623, "uuid": "9ee98811-0435-4210-adf0-ec403e537c44", "comment": "Malware payload", "value": "e6da3f69f6d0a5da6c4835024bdbeb86d1edeba6c731516ae814f07942f9be4cb4baacf66610fc924af94dd11ef40da7", "object_relation": "sha3-384", "Tag": [ { "name": "185-156-72-25", "colour": "#8E9969", "exportable": true, "hide_tag": false }, { "name": "185-156-72-77", "colour": "#E30BDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wait-load-page-com", "colour": "#3A265B", "exportable": true, "hide_tag": false }, { "name": "wait-load-page[.]com", "colour": "#20E960", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750959623, "uuid": "ed4d1ac0-8101-4469-9b61-bb874cef7bcf", "value": "T1296412051A7BF337CB1C867890F5130F1A7EEB4BE45A7607DC8D6A45648E6C898C4BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750959623, "uuid": "e1263550-4256-43b7-bb1d-d2db2dad45a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750959623, "uuid": "5f14cd31-9269-4172-90ef-0f5d6cbc371b", "value": "6144:5qv0+i92DBaWIiNLW3UxeVZnr/nnPqq0rcyq8U81tVmfdQwMg0ffC:5qMSD6iovZnr/nnPf0oyqStO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750959623, "uuid": "d9d88372-bb2f-4698-b209-d1f0222a2e4e", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750959623, "uuid": "231f3bc8-c42f-45e9-b870-2b605a017d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750959623, "uuid": "85858f97-e039-4e40-a7e1-f36a5b1b7987", "value": "bryjf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6665f49-52b0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750957991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957991, "uuid": "b7c3703f-b9b0-451b-86b2-78184be46091", "comment": "Malware payload", "value": "994a9b6c3e294962b6365b63ed71faee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957991, "uuid": "573b337b-c5fd-459d-90e8-1007bc7d0a66", "comment": "Malware payload", "value": "5f082d73fe1442f024f6f5ea20ee8047a9ee2e3e6017c9a75ddfcb7524f5ee2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957991, "uuid": "a59c62c4-f444-46b1-b607-a522e10d7e67", "comment": "Malware payload", "value": "58d8a2c8eb7e4a98d8cc0fbe689092ae4a9a842c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957991, "uuid": "7bfc4e60-23ff-4dc9-90aa-a17341b14aac", "comment": "Malware payload", "value": "13b45cc6cd373825da51b9e8ed9a7ec19d864eea6cb8698614548b91aafeca5d29ae232296ae17bf47e76ae24ccc918f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957991, "uuid": "a1283534-148e-4edd-b8e8-84bce3ad224b", "value": "T19CA41212E290D8FEC4DAC070469FD27BFD76BC544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957991, "uuid": "7373e220-2f6a-4ff7-9ca8-400d86c2b3c1", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957991, "uuid": "94bd6376-381b-4840-9476-abe2db17203c", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957991, "uuid": "678a1e1e-a694-458e-965f-6882b7e5ef1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957991, "uuid": "e8d4880c-bd69-484b-bdf6-c5ad377511a4", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34040072-529e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750949987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949987, "uuid": "024b6573-2292-457e-978a-7f5055c0a759", "comment": "Malware payload (Formbook)", "value": "3a651b6fcc14e6c127e202a5520ffd56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949987, "uuid": "15400368-85b6-4c5c-b4c2-8160347a069c", "comment": "Malware payload (Formbook)", "value": "5f192f10cc75f3be973d6f3725fb0479f70f67fbb3412f9900a272730acf17b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949987, "uuid": "e1365a7c-4c49-4e6c-a0db-e7c3087de72f", "comment": "Malware payload (Formbook)", "value": "fbd989763f795be94715baf2beb2da8975314891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949987, "uuid": "7e5e0aec-dd35-40f5-8043-655542d25533", "comment": "Malware payload (Formbook)", "value": "263e5a20284bcb14eec2389c316f6e326a4c12afb517ff1c87249c7a61a7be139cf520e3832168483a82fbdb95077671", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949987, "uuid": "4910e273-38e4-4fe2-a10d-56f205a1f8d9", "value": "T14DC523846799E320EC9887F51832DB7A173A9E4D7010C30A44FEEDDFBDABB503585686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949987, "uuid": "f418c783-90c1-4140-aad9-ee0f5587ac28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949987, "uuid": "178bc436-b826-40e0-b497-2873c45b8e85", "value": "49152:5lUBawZjERX6DrdvbFbOfd2C0zhVZmNbbEHdV1IhErRIlGY/M415B7+2URSMHAjp:TUsw1YX6/dv9OVZqxmhoolGY/M4zBCr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750949987, "uuid": "fe327ef2-48f6-4e0a-9272-c94fdb3f96ad", "value": 2565128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750949987, "uuid": "51f421b8-752a-404e-9cf2-9aba7721ebe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949987, "uuid": "6831d239-32ae-49b3-b7d7-6334439f9dcc", "value": "3a651b6fcc14e6c127e202a5520ffd56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcee85c7-52ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955854, "uuid": "c4c77415-6d65-4832-a3f9-b4be4c2fcdb3", "comment": "Malware payload (Mirai)", "value": "bd1663b94610a6e133b74326188253ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955854, "uuid": "25cac650-4e78-4de2-b0da-c18a9a231e37", "comment": "Malware payload (Mirai)", "value": "5f309b6b89d4c77aed0be3ce30068b586a15df2e48188698d440e9219e1f929b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955854, "uuid": "7c11cbe1-2f53-4c81-923b-ce67f041f8f4", "comment": "Malware payload (Mirai)", "value": "f1ca8374dd0ee0f23683b1eb2c7b00ec651eb4e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955854, "uuid": "8469418c-9ca8-4465-8f22-268a332d3166", "comment": "Malware payload (Mirai)", "value": "47af06e65e4c91a046243d441b78602d86e58d6dc9903ae7f6ba8fbdd54ab156347b03448bdab4bb76ed36389dc27d8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955854, "uuid": "6b0c217d-8b41-4aa5-b266-11ddaa2f161a", "value": "T149630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955854, "uuid": "6425d293-a922-479f-972a-5a2fc4704b96", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955854, "uuid": "6ec0efcd-6d01-41a4-96c5-d704da5a876d", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955854, "uuid": "14ac4905-f21c-44ce-a94c-914742bd8a0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955854, "uuid": "ea0a5a8b-d807-4584-aa15-1371ae3ea8ef", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e58baa-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750978007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978007, "uuid": "eb5718f5-c55f-4989-9e85-88e94b125077", "comment": "Malware payload", "value": "ea4676fca912575a2be28d7954eec1bf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978007, "uuid": "f7b50868-5893-471e-a2a0-32eda0c42702", "comment": "Malware payload", "value": "5f790f8504566bfc480cf246efe43638b05e4d59cbb674dfb53d3cce38193d64", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978007, "uuid": "aaddfb51-b722-4e80-877b-b95937e42d7b", "comment": "Malware payload", "value": "cfd831b2faec3dcb74c302061afc2e281ae67ed4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978007, "uuid": "257f13a4-f5c9-4d00-817f-9f3161f03ab8", "comment": "Malware payload", "value": "15273a4dd3c728c07f2e4a81fcfb5b95ff70f65e536f12db32de1698ce953d3f1ff0417b7a95113f220ee52b6bf39f62", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978007, "uuid": "7e0f1f28-80c2-4e02-a3e0-829ab97b7404", "value": "T12F1150AA286135E64E355E47F4334364B02E96CDEA208F04A98F58BECCD67003914B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978007, "uuid": "1a00d0b8-604b-4223-bc15-efa82950f5d8", "value": "24:EURUKJUSNI7PUqKOUSBU9U0qU4tJUAU41oSUNozUIYogUIGoVU6KvGUuQtU6:fm5qiElg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978007, "uuid": "a6c2b1ce-294d-4b9f-88d6-d252e30555c9", "value": 1042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978007, "uuid": "c1fd286e-e367-4af6-b5d0-d0ceb6cfe812", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978007, "uuid": "790d70de-7849-4abf-81f6-fb189fc6262f", "value": "wget1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd713a1f-5248-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750913308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913308, "uuid": "97a28bda-18d5-46b4-8670-79799e72eff9", "comment": "Malware payload", "value": "c433a1bf1311558a28d092d5202327b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913308, "uuid": "d033a8ef-601c-4053-b031-948674d725f6", "comment": "Malware payload", "value": "6003067a0d75ade3b7c4ee81d5df24781b529e67d8c272d63909e5734e9be525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913308, "uuid": "886efd40-f4b3-4dd5-b27f-0ede184c06e8", "comment": "Malware payload", "value": "040c0bac57ec17cffab3f50c6046cd49f5f582f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913308, "uuid": "411103cb-7014-4cdf-b6ff-94dd86d6a4e3", "comment": "Malware payload", "value": "323615d99b964b46732ad586322d08c64b78891bd0305d530efcfc5560aabb25a5802cc8ee47c2aacc13ff4ad316a1da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913308, "uuid": "64be0f72-7436-4012-aa22-5272777db909", "value": "T1C555E129D281A1EAFD6A40754551A1A5B463B923CB782FFF43A0E7324F0BBC44F2D764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913308, "uuid": "2bf2c8db-f062-4dbf-bdd4-801b172dc974", "value": "f1f4088bde79fbcfaa711f90bc2bbed4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913308, "uuid": "978cbc6a-165d-4980-8e1e-d9991d7fc35e", "value": "24576:gavuxytTiH9b2zpKJw16YD6+V70LzwJw16YD6+V70Lz:gavuxaiHCpKJetKMJetK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913308, "uuid": "abbe3f06-4290-4e95-99a5-bb6284c73012", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913308, "uuid": "96bc3582-272e-4063-88ba-9e0ac6b73edd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913308, "uuid": "54f79d69-bd9c-4499-9796-8f904fd07315", "value": "SecuriteInfo.com.Win64.MalwareX-gen.6638.18505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76671fe5-5244-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750911444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911444, "uuid": "5811185f-60cd-41d5-89b1-7a844f025809", "comment": "Malware payload (Mirai)", "value": "cf2ca957223cb51d6a28e6a82d8f8ed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911444, "uuid": "ac42c92f-5297-4832-bd04-fe62cbe1c5b5", "comment": "Malware payload (Mirai)", "value": "6075c80a7ada9ccb2bc15808af49eb30e5229e4b5299dc49f843543a2b1bc0c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911444, "uuid": "ad4c5791-173e-454b-8ee1-b5864b976a08", "comment": "Malware payload (Mirai)", "value": "17bd0ff62e304a9f4b5fca105d965426fa85edeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911444, "uuid": "47b2fba2-30d7-4994-9932-df26e76012dd", "comment": "Malware payload (Mirai)", "value": "f73d79a205620dcf3dc92eb0434236308f637add57b81f00d55baa9efa011b8bd1fbe029b71522686baf035299137c64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911444, "uuid": "c49a95c9-2b27-4bd8-91d4-7ed2ebded972", "value": "T150E3291277B60A2BC1E4A579B1F75333F2BA478514BC860B3EA15DCC6FA859031277B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911444, "uuid": "b19489d5-a769-4b98-862d-2d76dfb198db", "value": "1536:mrwqeQRSNGnPMI8k++UxqUFjFnKBkSbVnNLoEdmXXtX9OuqXGwobPCX9gBN5te5I:ktQ2e5jKaNIZGa9H+lMD6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750911444, "uuid": "07045fee-de61-43f9-a444-9f3ff5e0279d", "value": 150588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750911444, "uuid": "cca866e6-7cb5-41d7-a3e5-e6451d5d515b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911444, "uuid": "129ad562-fe7e-4d38-830e-582d73297981", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e90c68f-52b0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750957843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957843, "uuid": "4919d04f-bec3-46de-a3b1-88591c2507c2", "comment": "Malware payload", "value": "b1d409f0c36544b37ac405d0c9db6c71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957843, "uuid": "192e3a47-a62c-4096-8276-e0700515e39f", "comment": "Malware payload", "value": "60fe3132562b2698178904d158d600437c0316ace0ebb2c13fd44d9431a51cf3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957843, "uuid": "8b43cb20-add1-4a31-8952-d5ecfb68a781", "comment": "Malware payload", "value": "f58534b63588b605fbb4fb454d1bb8a28e43fdba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957843, "uuid": "e5c42f89-d08b-43b9-a0a2-494c3d28dacb", "comment": "Malware payload", "value": "ca0882a95322666175a2d7e6b8fbec22f2ad801f4359636c7b72605252b23c80718beb1b95584f9d2ce39830f1a055bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957843, "uuid": "1dd5944d-5e6c-4a72-befd-31f1d6493e63", "value": "T1C5B402118F881F87C5AFCD750A2E167311AEDD9F46CAA43E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957843, "uuid": "6cf7612c-1343-40ec-b714-3173a0af7291", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957843, "uuid": "e67c0766-1000-4355-8552-96e50163121d", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957843, "uuid": "fc661ebd-4381-4398-859c-1cf60d51346a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957843, "uuid": "3d35227e-fbb0-4211-85e7-1716068e9606", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ee47de-5295-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1750946414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946414, "uuid": "c1edd69b-2590-4ccb-bd6d-21d18c116ca2", "comment": "Malware payload (DCRat)", "value": "4c500b5b338520b36a3372174a6b6857", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946414, "uuid": "220df3cd-7f3a-4cd8-89bf-f35c9e6d2881", "comment": "Malware payload (DCRat)", "value": "611694c5d97d8e22b16be5aa8cd834e896b3c44e72dfc7237b84ce7baf7882c0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946414, "uuid": "b97df543-98a6-4e9a-8968-1e5d6a0822a3", "comment": "Malware payload (DCRat)", "value": "780097cf39b4fb56e16a8d66781b2b0466a9b7b5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750946414, "uuid": "34959078-be3d-4ca3-a1d6-f92952c8ef47", "comment": "Malware payload (DCRat)", "value": "77b5c7829bf8182907245e87f6a36c350503535f974e2bed59987f970434c83e0b8bec35cdc7fdf203a8bdba77727327", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946414, "uuid": "b0f08301-c9ac-4bd9-925c-adf171b1315b", "value": "T149B58E3439FB502AB173EFB58AE4749ADA6FF6B33707589E205003864713A81DDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946414, "uuid": "503d3eb9-63ce-4c9a-8f5e-0ceac3f84a9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946414, "uuid": "feaf8eaf-2462-4488-b4bd-ad0d794286cb", "value": "24576:LhIk2Jj7cJSjv1BuCw7sULd3yUJVdzxlkj/7WUx2VzUN+XpOPwOl67:ak2JuYNBI0KcWBAEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750946414, "uuid": "c0b303f3-6dea-4626-a6b7-328c6a08caa7", "value": 2429952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750946414, "uuid": "522ca016-38d4-41d1-bfc7-e5608c312db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750946414, "uuid": "e4ecda07-cb7d-4e43-b660-66c262a068f7", "value": "4C500B5B338520B36A3372174A6B6857.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5506e63-52c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750965210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965210, "uuid": "f1984044-2489-496c-b559-6b3029941db4", "comment": "Malware payload", "value": "79acac91f55be714d9830628d0bf77da", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965210, "uuid": "31056fb6-b91d-4223-be67-d91ab8bfcedf", "comment": "Malware payload", "value": "611c8e735238134f8461eaaf7c0af8dd3b499ce9881009b897ea62e272b761d7", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965210, "uuid": "819485fb-236d-459c-a630-aa9ff0d4784c", "comment": "Malware payload", "value": "5756c11fc686bbcdd770902ab3e6da2f389f477c", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965210, "uuid": "82de88e4-79de-4af9-9dfe-ccc65cb6c0c4", "comment": "Malware payload", "value": "32a190d399fc99b8d5bcc8edda272c661f78deb81c1bbec8fbda81b310a6e1465794f1c620493f56174652d5e59704ae", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965210, "uuid": "11bf77be-86b7-428b-9736-c25eb8a15dcb", "value": "T1C5089D01B3F64108F2F76E717EBA59A5947ABD521B30C0EF1204A64E1B72BC25BB1763", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965210, "uuid": "5372f501-4ae6-4b83-9b0e-06e1a4a6fc76", "value": "1572864:JFRb32wO4SqOTZ3mcFpX/kyYM0iY5L3Hh7vuTPXXLrB9kD:GXbFpX0iJ/Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750965210, "uuid": "e41430c3-7a5f-4420-a729-348b2ad1cb98", "value": 78563328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750965210, "uuid": "f3e23998-99c2-4c6c-8b97-1de8a3fe3161", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965210, "uuid": "c5d79446-0020-49ed-bcbf-ae80e1602cd5", "value": "o.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d53e6b-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913879, "uuid": "95785aff-815c-480c-943b-755eef5d7beb", "comment": "Malware payload (Mirai)", "value": "f99bf960a68a08aff0afce3e2d030aee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913879, "uuid": "8d88c5e0-80c4-4abb-a866-39e6850823cd", "comment": "Malware payload (Mirai)", "value": "6126c8fead53e7c94bb69aedd6734edcb5132b299723f391f2cbf0348507256e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913879, "uuid": "2a66b01a-a64c-4f2d-acba-e63a06e0663c", "comment": "Malware payload (Mirai)", "value": "53cde7d02fab06eff01159329273a89723b42b89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913879, "uuid": "cec74ea5-6462-4084-8af0-df84ad7a7337", "comment": "Malware payload (Mirai)", "value": "0822708148c2862326c629834f4aa9a636863a31c1f94b976a49a5f40be9d4b0efa65a601160b6d7b4749d8533f19aef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913879, "uuid": "3a7fbff1-279a-4483-80c2-14eb9cbbbbc9", "value": "T12053E995B8819F25C5D022BAFE2E01CD33232BB8E1DB32069D116F2477DAD5E4E3B951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913879, "uuid": "2a4998d2-466a-4abe-9d87-bc917d376f99", "value": "1536:UPnot2W8l/Hz97mJvNWVK+MaDQcBXY2k9BAo83YLgd2AO52ZlVqpn:1w98G6aDQcBXY/96eh88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913879, "uuid": "86d8a000-4528-41b6-952d-2494f1bb0cbd", "value": 66340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913879, "uuid": "96c180b2-ad00-4952-81ab-d3ddfb8fe374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913879, "uuid": "5896a322-c273-4b5a-a9ef-6171bbb0fb88", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35e5719-52ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750957154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957154, "uuid": "bb3a6ed4-3be9-4831-880e-d586bc74561b", "comment": "Malware payload", "value": "d34e37c741bb6472c6bc3a7be2ca27e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957154, "uuid": "8d8d02db-7d18-43bb-91ef-711bf8b698ac", "comment": "Malware payload", "value": "61c803dbe93ee3a0c20b40cd70fc3facee26ce139715aeae7dac05af45d03c82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957154, "uuid": "ca2d122d-f831-48a9-832f-ee1e414c42a1", "comment": "Malware payload", "value": "d1473184ef14fb4811ba81d1f0196600928bdb8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957154, "uuid": "906ca7d0-6895-44b4-a518-4655e3ce2f16", "comment": "Malware payload", "value": "a82202eec97b64e896b659b8a8a219506b525d6245529f2d704bb7e17e1813099c5f476e33edd1f4d178c986786eb98b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957154, "uuid": "d11ec92a-7a06-45b0-bfb7-6b8b1b285e0d", "value": "T113B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957154, "uuid": "d56b2390-6471-4ce1-abfa-4eb76cdc277d", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957154, "uuid": "2bb9e05f-1946-416f-8342-08581423812e", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957154, "uuid": "1a0a21f9-e3ce-4629-bf4c-4a54383b1489", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957154, "uuid": "ab71373b-ffff-416f-8d23-9e7ec33dce55", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5222e986-52db-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750976237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976237, "uuid": "9db4a9b1-ced7-41d3-9d19-ad82b0cbe266", "comment": "Malware payload", "value": "b8f404ef9f03d302e9ebe49273eb5c33", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976237, "uuid": "51d0d476-fe1e-4661-8d82-6588282a2506", "comment": "Malware payload", "value": "61d26fef5b4e12466ce360d08c15ee4df9ece4cdc2a213e4814ac7dc9bcf0a9d", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976237, "uuid": "9323d776-e802-4451-bcb9-f91b29f23f4f", "comment": "Malware payload", "value": "074350b0eb84f68ecdfcc54625c0b9c38822deb0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976237, "uuid": "ea500a7b-2002-406d-a511-b26c84537c03", "comment": "Malware payload", "value": "32975eb724c56d4a6b418d5b518a7f490e0e67132bf36a6df52a7f342468cc33e8190acc0ebae8dd74f0c5329d02db2b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976237, "uuid": "81c89202-54c1-4cdd-87b8-c478cfd5fcac", "value": "T1163167171A63A830D03A469EBEE39108F68152B397135F25BE8CC463AFF079094677C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976237, "uuid": "c4b94285-b30c-4b2d-b737-cb232c4cbae6", "value": "24:hPBabe7hHV2rcAdUIsRReFIsRRBUoBpABbG6VMXF+HXDBmMQhBJxJl1MThGdR5:t8aocALsays1Ukgb5VMUNaBDJIFG/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976237, "uuid": "e54422ca-990e-4091-8e23-802bb32a3271", "value": 1598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976237, "uuid": "5d043781-8c22-4531-b11c-a0ad04200c6c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976237, "uuid": "5917996e-1447-4aa3-a7b3-14d3ff117857", "value": "r.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5dc5f7-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955368, "uuid": "64a1cf0b-4226-40a1-9628-4e0bd4ac604f", "comment": "Malware payload (Mirai)", "value": "55987943a8b4824a886b705984109060", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955368, "uuid": "22ef918a-6146-449c-9925-3cae4bbffe12", "comment": "Malware payload (Mirai)", "value": "61fa0536fee3522844f3f3adf90bfc24fb15de5091561a87fd241ee97688c7fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955368, "uuid": "cde96a93-964d-47aa-b1b3-aada1c4f650e", "comment": "Malware payload (Mirai)", "value": "f19acc1f3c03257cd689f73ce335de201ab4fe01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955368, "uuid": "1032e85c-0ddd-40dc-98f4-7ba642f4b88b", "comment": "Malware payload (Mirai)", "value": "17be9df8628cf419c335148bf256dc05a7516e7ec9ea542e695becbc43486627c25711af0ebb7a33a4ee2aff1421efbb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955368, "uuid": "df20d98e-89b6-4e99-a923-607144a49ca5", "value": "T1DEB2C0CD61443084CA8D7C7C278D4A664F6CA090BAED9B26E354CD98B3BEA8F345D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955368, "uuid": "e21d3c88-153e-405b-92fb-352f3161acb5", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpIQZq8Wvb:BQlS07FUXqIYSXQKquBqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955368, "uuid": "5c428139-007b-495e-9a70-22418fae53b4", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955368, "uuid": "08cca6e5-ced3-4809-8ced-f9f92cda58cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955368, "uuid": "a833eee7-4315-4ad1-baf2-bcbf332dba88", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7036bdf6-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978006, "uuid": "7463c0d1-d562-45fa-9ea3-320550117f08", "comment": "Malware payload (Mirai)", "value": "89f60817a81d83c617e28b7da8e10ee8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978006, "uuid": "7a16b425-7fc9-4285-876c-6d1fbd5eda9d", "comment": "Malware payload (Mirai)", "value": "62448f7129990d5ae52a58f206f564dbd8109e9efed9034f6b8006ca327f21c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978006, "uuid": "f6455070-0002-47a5-ac43-56f248549bac", "comment": "Malware payload (Mirai)", "value": "88fcbf7ba40215434c339100e56f0b20af8ad6b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978006, "uuid": "48890c1f-93ec-408c-831e-362f8570920a", "comment": "Malware payload (Mirai)", "value": "d367f9f6475ce3f561c4204d4bdaaa9b2803ccb9e4782f69511219382ef27ed0fd870bf51c361bd6a3178507fed87aab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978006, "uuid": "5502d7af-62cf-4553-98da-f4f154a87504", "value": "T1F3B3BEDBF74B21E1C86247F007C74BDE3E6322119F6BA8E76C0E2A7A05391DB1916391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978006, "uuid": "8bc1e091-e7c7-4dd3-82dd-f22fe8ed4a49", "value": "1536:hBrp6BovIYUGrA7oiaIWqk3H0JN2/kD+8i0xZJr6kgQ/LWd:Hrp6BPPt7oixtoUbS8i4NgQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978006, "uuid": "3c7790a7-741c-4904-82d8-8ea601156c9c", "value": 116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978006, "uuid": "fd64f3fc-3b06-4397-ab50-e30357db7af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978006, "uuid": "2aedbc53-a451-4a66-a206-ce271a5911f3", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5ee21d-5299-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1750948146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948146, "uuid": "9b1f1d12-aec3-44bb-a312-7620deefb9ca", "comment": "Malware payload (AsyncRAT)", "value": "00828c6b62ba3e3c3484f7e32ffe3fd8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948146, "uuid": "96fd469f-d651-43b3-8381-12b43f949ce3", "comment": "Malware payload (AsyncRAT)", "value": "626de7fbab534f21cc16349e3cd1566b0456de864a3f13724a0866286d948ab7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948146, "uuid": "0c3365a5-3b9e-4a93-ba57-8b46c7cde560", "comment": "Malware payload (AsyncRAT)", "value": "3ebaf945109fad822389c5992175c882c8e5100b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948146, "uuid": "c8e30f07-474d-4101-909c-3e62f9a95b96", "comment": "Malware payload (AsyncRAT)", "value": "dcf00ab4ca801b1c31200ae71398f6c6d16a63815117298e5b8c7a9376832791ab5a10d00d2d9d370985a3eabdc0752a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948146, "uuid": "1201eafd-4957-4e9f-9f67-964af951c0ea", "value": "T152F6126772088E44C07687FC1023DAB597332E5C25B5D35625FABDA7FAF3A424C0A987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948146, "uuid": "86819cf1-d86a-4559-ab13-e15e9b3b2990", "value": "88f70fb82598484a7ce88eef6418418b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948146, "uuid": "c5d8c70a-8ba4-45b9-85c5-f2d7ece4319f", "value": "393216:U7F7tC23UGZSL540B0PGZuDtLQMWu0VwCnzo+vSe7PymPkSh:U7F7pa94tQMWuCzie7P7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750948146, "uuid": "b6a47556-9cb2-45b5-b38e-2473166f0174", "value": 16678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750948146, "uuid": "29268bfe-af56-4d99-885f-66e0cb8d3adb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948146, "uuid": "386a1260-af7b-4264-9b11-0cdf880af02c", "value": "64th Services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f770ef85-523d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750908654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908654, "uuid": "988bd0e9-cc7d-4fb5-8c53-d8882d2a96d5", "comment": "Malware payload", "value": "74f3c7cb9304a4fb80825bc471025c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908654, "uuid": "245353b0-d49d-4951-afea-4f8489eb8e7b", "comment": "Malware payload", "value": "640c37f34622fb9f162caf78373c8329292526496ff50343b586d8549216318c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908654, "uuid": "bfd659ef-a7c6-44fe-8377-9b0f48771f47", "comment": "Malware payload", "value": "d24e330faa2f870bb07bb2f134fd1db254bf2d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908654, "uuid": "0da041cb-8b39-430f-b897-910fd92c8dda", "comment": "Malware payload", "value": "bcdfc91b3c8150ddfd1ae679ff5b2cff87b6c34df271eab9594d226ac5310032ae4e67cc2ec4670c8376c92d39edfc55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908654, "uuid": "7c7d174c-e575-40cb-be74-469f8a5b2091", "value": "T11DC4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908654, "uuid": "3e6149fb-37cc-4d75-b385-351165055885", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zJ:W7v+mrY2xzf03yvZ/YIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750908654, "uuid": "3d5fe862-6d74-4eaf-93ca-f8ac9da1e42f", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750908654, "uuid": "82f7bc52-d955-4416-9a40-1346a51f981f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908654, "uuid": "74d0bc86-931a-412b-b298-888b40116d42", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dac041-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750905489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905489, "uuid": "163c3593-230d-4790-80bb-4c79c85767e2", "comment": "Malware payload (Formbook)", "value": "3518fee3b7c42095fb334064e5107e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905489, "uuid": "48f6f566-83c8-4ba5-b6e7-c74a33882d74", "comment": "Malware payload (Formbook)", "value": "649facade465ad92983e7f91f592eed9b04bd84bb4d2d78fcee013dd004f8758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905489, "uuid": "87bbc255-f6fd-4aea-b163-e20bc525f35e", "comment": "Malware payload (Formbook)", "value": "ab9dba44fa594c51bceb7f6813b7309fab93a5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905489, "uuid": "b9be7dc4-c593-4026-b8d6-b49463c8cc0a", "comment": "Malware payload (Formbook)", "value": "19690f94719b921857f9a51f12b2afb73fb5193b92bd8e66a0a88b6b077a0025628d9377029c3ff589969c735c94bcec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905489, "uuid": "c82a3f4e-f283-4731-960b-943b7de61ab5", "value": "T1FDF4120A6DA38491D0693FB4C9F3C1B45A703FDA98B3C7C6BBE63D8F75659016212326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905489, "uuid": "daa91433-16ba-4fa5-b068-664357632bb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905489, "uuid": "2458cecc-4386-4afb-accf-a9babb2ccbd9", "value": "12288:cmnbLuRxTs6bmQvB7j7Pds6IOMU4J/iwbWEkf8aafRIixxzajY8RmrVI4q:cmnbLmGQvZjDe3KwqEk2BqmhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905489, "uuid": "e01be7d5-c9eb-43d2-b8b0-dfaff372b8b6", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905489, "uuid": "68a10bbb-4dd5-4ce6-8fab-014b8ecfa8d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905489, "uuid": "e1cf04c6-8c81-4b33-b6e6-69e10bd9e94a", "value": "kJEGOTR85wajtzi.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192f8fba-52a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750951231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951231, "uuid": "378ad073-4362-456c-b119-393cd473eb31", "comment": "Malware payload (Mirai)", "value": "1cfffc9b10c105bba630d8cfb65b6d54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951231, "uuid": "573125e7-7847-4cf5-a646-507c01ae33e6", "comment": "Malware payload (Mirai)", "value": "663b2d74f54209952b211c9ed9e98dd9180dad6fe7fabf9e84abdd213f33593a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951231, "uuid": "65947f7c-6ba7-48e2-9ab4-8515b74bb674", "comment": "Malware payload (Mirai)", "value": "54898c737d97194976f86001a07304f160d44eea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951231, "uuid": "9aff83d9-8d7b-4585-ba2b-f45a81a5cdc2", "comment": "Malware payload (Mirai)", "value": "cf014a33b9ecd95d5df3b78cb870dd586b8465f8bf534559084f02e6ce12347a9ddab164414e9d03fd3dc22539ff7f09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951231, "uuid": "0e1b19ce-9363-4abf-aa72-2ea6d8dce9a7", "value": "T143835C92F718BF7FD1B74A3684C2C7193729BF408649226B509D36632D732A11E276CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951231, "uuid": "93583055-726b-457c-82c0-424f90043ff8", "value": "1536:VHBP4OnUjQGrLNaSVWUEv4tTHaIQr38xIY1pNJ:VJZnUE/SwUEv4t2IonKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750951231, "uuid": "dc288f74-63dc-42f3-b915-d27e8f20dd73", "value": 82604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750951231, "uuid": "313dfe80-7338-4053-bf96-d7b25dff091b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951231, "uuid": "ad82321a-97e8-4495-98ca-2b2118c44bc5", "value": "SecuriteInfo.com.ELF.Gafgyt-MV.19738.25097", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993e7f8d-52ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750957029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957029, "uuid": "47bbfb70-9fe4-4710-a8a5-9bacc726b1b4", "comment": "Malware payload", "value": "442907ff69048160372dca6bc95fbd13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957029, "uuid": "f5610bff-f2c8-482c-bab5-048d217dc1c7", "comment": "Malware payload", "value": "668073e1b64a3564e4cf380de998c58cf41677d624df12695f954e1f82e2b2b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957029, "uuid": "1f2a9170-8d37-4ed1-9c48-afd83c3eddf9", "comment": "Malware payload", "value": "3237ebd901911280b65e4d64d0c16edaeead4a02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957029, "uuid": "bfcc0eae-ee45-4457-836b-3251d25c5475", "comment": "Malware payload", "value": "d6610ec80948c120149d2714d80edfa7f04ae8b7336fe98834e4d08ed8f5e11851f44b25045d07cdefe14e8b10775c24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957029, "uuid": "83de4dd0-20cd-40b5-99e5-a914d6414c17", "value": "T15FB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957029, "uuid": "770fd5e6-046d-4257-94e3-121a129f2206", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957029, "uuid": "322bdc7d-c421-4616-8d16-d586cc766d28", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957029, "uuid": "74e5f6da-04d0-41d3-b34f-3fd2fbcbf96a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957029, "uuid": "61271816-f1c9-44b2-b78d-a486242b2467", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bee31a-5256-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1750919221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919221, "uuid": "1f66ef29-dbae-4cf8-bb14-952fbab14363", "comment": "Malware payload (GuLoader)", "value": "bc5213c7cb0e9f6a8d6abd34faf59307", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919221, "uuid": "99eda317-ef18-4832-8da9-c6307112cd13", "comment": "Malware payload (GuLoader)", "value": "66921267ea9e4efa6311a9b65bdb800adc315a058e1720f3ab3b12a5c8b771b4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919221, "uuid": "ebea8cde-255b-485e-b39c-398c35acc4c9", "comment": "Malware payload (GuLoader)", "value": "adb771bc3a60a1048fd21bea58e2949a5ac1bd9a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919221, "uuid": "8c433b91-be7b-48a9-a1cc-0d6a98e22c25", "comment": "Malware payload (GuLoader)", "value": "71bb3444e7dcb2f10e2f032220cbda811f9a8a39e47fb5e8c27fb47df14415b12724e6e8ffed0d282d210b6b945ce0cd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919221, "uuid": "294d40a0-bfcc-49d5-ba4d-6b03c23e163e", "value": "T161635D24EDA4015B1E0AF7D9ED841B11C2B9D10A052353B9FFBA576E600F35CA3BD64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919221, "uuid": "60625f24-73e0-49ee-a994-cb5286605356", "value": "1536:+MmkoMMfrc1AHk8Bw969NQfOMkVRjLxyNS6H:yTrc1ATMkVZLxp6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750919221, "uuid": "88a8d79a-23b6-47b9-9e5b-eff7972ef55c", "value": 69248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750919221, "uuid": "0ea96fe2-cff5-465c-862e-c33f5419e9b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919221, "uuid": "a698d6d0-9e7f-4744-b15e-41e0dc978a07", "value": "Zapytanie_ofertowe_Polmet_czerwiec_2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e91d7d1-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978057, "uuid": "a8c97da8-9dac-4c84-b7b1-ee3bc7fd3d20", "comment": "Malware payload (Mirai)", "value": "5a357d550c526c63adb5c9a1aca5f57e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978057, "uuid": "6025ac4d-5025-4b42-92ca-44e130c29347", "comment": "Malware payload (Mirai)", "value": "66b70564d5fd2e9fc6c5c663440846e0b1d28750318af10d36ee14fa56db45de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978057, "uuid": "5a1caa3f-8414-49d5-9b39-8f5b05d7f1be", "comment": "Malware payload (Mirai)", "value": "b27a31fda7cef2669abc326ce3df664a06442142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978057, "uuid": "960e57c9-b146-429b-9619-d83708ef1005", "comment": "Malware payload (Mirai)", "value": "155e8f43c1cf9d6501f002a43d1ca3bd27d458d235d9ee0a51a4fe65942a387fa8add43fb1729ac228d9b721d87528c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978057, "uuid": "71c1a108-bfe7-4dbf-9b00-a3164a36b456", "value": "T10DB3D709BF611EFBE85FDC370AA9070624CD696A21A93B797530D818F24F24F16E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978057, "uuid": "e2cd7d33-ad5f-4381-8e37-e94ca5e6478b", "value": "1536:tIanyAJKfd3Xr2A7V3os3hJzQR3VDmRwjtUu0KbC0ZD1/2HhfNfrnaA2Pqk:aa/Sd3Xr2A76scau0Km00zgPqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978057, "uuid": "6c249a3f-d226-4b17-90a1-076e0850d32c", "value": 113860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978057, "uuid": "dcf3f809-7206-40ba-88dd-a1ad11a85461", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978057, "uuid": "5c2008b2-e1e9-4f49-9bc4-475a2de749ce", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7fac4d8-5299-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AsyncRAT)", "timestamp": 1750948169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948169, "uuid": "fccd7667-6304-4196-8671-e6324ee0808e", "comment": "Malware payload (AsyncRAT)", "value": "845d8434ea438e297a27ad511bd9bd20", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948169, "uuid": "0449232f-f7e6-4e08-9520-c0be160b0e29", "comment": "Malware payload (AsyncRAT)", "value": "672cd511ef8a2309a953ab71087226a738c77c05185469a674ccaaefa93ffa99", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948169, "uuid": "0304551e-3321-4267-9d16-e7edbd52fa6e", "comment": "Malware payload (AsyncRAT)", "value": "eab2b4f703794fd7e007ce042010d550ae7b0e22", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948169, "uuid": "c0c05429-5e0a-4130-af79-ab08babfb093", "comment": "Malware payload (AsyncRAT)", "value": "6783b596c4119eb96a3738f9f34f9a0fa80b87c464dd3289314b7dfd9ca1bfeb0d31fa0554dd96ecc90a921013ff76f2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948169, "uuid": "2911140f-9a67-467b-ae07-632fafd897fa", "value": "T1F32408968AD48515ED6A0F78A472CE390633BE557C35F20D8DD97CAB3BB33C20426762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948169, "uuid": "78eb3448-9b02-4942-8366-b800921020c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948169, "uuid": "ffbbeef3-74cf-4b03-8c0f-793c1a702b06", "value": "1536:G8lYAiSZ2w7vubEcrK19xJMNexuev693dPVXpNuAjR3ZL9+Z51e/Ws64TdBFc3dH:GIYs2wabEcrIJyDpgsnWiZxdGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750948169, "uuid": "cd29c3c1-d8ac-481d-8335-331eaa2afc52", "value": 224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750948169, "uuid": "6fd9bbe1-3bb5-461c-901c-84edde489e18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948169, "uuid": "3dedd8fa-a185-474d-a22b-d68cfdcc342a", "value": "64th Service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9a454a-52a1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1750951233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951233, "uuid": "495bf0e6-106c-4c50-8976-639ca04691d6", "comment": "Malware payload (LummaStealer)", "value": "fa07f32a59bbc8421c39b6d88de213f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951233, "uuid": "86af40c8-2f47-455b-a7b3-10268b783c07", "comment": "Malware payload (LummaStealer)", "value": "67c3f6d42f682af4f47f796521afc3529ea918b0a4ca51f09c21591afa82b7c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951233, "uuid": "dd49c9fa-9e58-4104-b9d9-93903aa9a7dc", "comment": "Malware payload (LummaStealer)", "value": "e1fb8d706ba9bf56405dfc989a9424b507a724ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750951233, "uuid": "7b41b204-520d-43ab-8798-78ce0a3755ec", "comment": "Malware payload (LummaStealer)", "value": "3e4cd70a1f4aa0e6e8dfaf7b4851465bbae91f9439dee1258cb8bf2721b4736bb37d84855707c61256badb6cea82708f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951233, "uuid": "b0473552-c52f-440b-b65d-e96fafe01d35", "value": "T10B757C477CD114B9C0BAC13088A5A3D97722F8E6133123D72E51A6B90EBA7D41FB9B5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951233, "uuid": "7baf92a6-4577-42a3-be1c-ea31148503e8", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951233, "uuid": "1d3a0d29-de49-40c3-aaac-29bb350120e8", "value": "24576:U0hKQqDNod3sGcYEBuEcV32eWKhpf9niCgghghwBEKRK1X2:U0hKQqDa38JEEcV32Kh3NgYghsRK1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750951233, "uuid": "ead7c460-cfb4-4cf1-9acf-1e2effc639dc", "value": 1632176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750951233, "uuid": "d4ec1a4a-f3c5-40b4-a87e-5c605d7c3a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750951233, "uuid": "85f83fa5-8a85-4dfa-83ec-05469566ce40", "value": "SecuriteInfo.com.Win64.Evo-gen.25807.29910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13dfc03-52a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750954519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954519, "uuid": "1fef0017-d8d9-4016-b2f7-2304c811e7cc", "comment": "Malware payload", "value": "c9f55a0aa6fccf4c2039fafa6ffc1195", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954519, "uuid": "8f92055a-6573-44d0-824b-c6a3c4024cf9", "comment": "Malware payload", "value": "67e2b411b41a0a6023c55c3303d18a46cc9e09653be216e2bdc2acaacde9ec91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954519, "uuid": "cdcf67bb-0b43-49dd-bbd9-4f389c4b8d7e", "comment": "Malware payload", "value": "3366b3bfa4ba1ced5b4a307d341813f1c26c9bb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954519, "uuid": "4cf7e613-c0df-4054-afe6-8f2b21cd07a9", "comment": "Malware payload", "value": "8d7fe9d9507ad482350ee46a1a55cb82246dfce12096c46a8393eb7845e6012b1a4e7804d4f5d1284ac31c3969f3bcc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954519, "uuid": "195160f2-9882-47ca-a6af-ffcbaf0d8089", "value": "T1A5A41294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB2662D745A4F7E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954519, "uuid": "a5938a34-0ef6-445d-af28-05858c27d808", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954519, "uuid": "b7e28804-b644-4b3b-a049-a99a00f77037", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954519, "uuid": "259c1aa5-61a5-4204-8acb-3044669371e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954519, "uuid": "b7fb4d30-9ace-4b4f-851d-63cc62f7833f", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc32d38-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978052, "uuid": "d5855bd9-0de4-4a99-ac46-c76d1135417c", "comment": "Malware payload (Mirai)", "value": "ddfefc29f6de39d777d4d4f57ef57aa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978052, "uuid": "cd6f8959-59a2-426d-9a8c-62e6db2f9d6a", "comment": "Malware payload (Mirai)", "value": "68fe557136bf076e36a8d6b6e19678472e82b9f496da38d45313055a77512995", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978052, "uuid": "7b4b62be-2a97-4760-b294-af0067db1385", "comment": "Malware payload (Mirai)", "value": "619f0f9ad68c84afadb2749098a67515b5827f3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978052, "uuid": "fc3adc16-2464-46d3-a4ad-8f35967aa1ca", "comment": "Malware payload (Mirai)", "value": "022cf19a313985fcd90ea36703d02dcd46a58d0a5ccdfb994a7e5e04236275462eee00d09d271adfc3eaa0fa6acfc417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978052, "uuid": "16a2e9bd-d5ac-4aa3-afb2-af484254e9dc", "value": "T1C5933A46FC818B21C9C512BEFA1E118E331357B8E2DE73129E18AF25738A56F0E7B455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978052, "uuid": "c29fd389-a887-4a3d-bb1a-51f5374a9579", "value": "1536:UAnz5SSnk6T65rjtOABHfxxwGVQiE1r5Tka8L/zXADERin1Uvci7T73P52YZ:z5H8HfFQ55Tka8SUvci7TzPQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978052, "uuid": "55680d0f-4046-423e-88d2-4a2f659b177b", "value": 95708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978052, "uuid": "6c5191a5-f9b4-49c2-916d-f55073026a55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978052, "uuid": "b0faedb6-9c85-43d6-8e97-8f9df2be58fc", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8358d260-528d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750942819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942819, "uuid": "f18887c7-7804-44fd-b289-13dcc5208946", "comment": "Malware payload (Formbook)", "value": "1b86fe843c3aed2610597f0bfcd31dc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942819, "uuid": "741c0798-958b-4ea0-8e8d-4bb97435cba5", "comment": "Malware payload (Formbook)", "value": "6924363cb427ecd59994781e876040d4f0f2422fec9b0e1f61dbe9000dee2baa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942819, "uuid": "1b9568c5-6693-4b00-8430-5a52b7b9b818", "comment": "Malware payload (Formbook)", "value": "95d594a12721199485caac63c6464a19e41e3bf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942819, "uuid": "cc1d5cc4-9861-461e-ba31-61acdbcb6bb3", "comment": "Malware payload (Formbook)", "value": "81793468cc67c9d48b74b880770bc772751053d08718b096019ff88234095daa20a1b84d4842b54743b23ca4a0b85f92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942819, "uuid": "48629b38-721b-4539-860d-694243e07136", "value": "T143F412047216DF31D5A907F51A71E23623BAAEAFA426D3078FD5ECEBB8213583841647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942819, "uuid": "63c5b2c4-46ea-4cfc-8892-a1dee5323f01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942819, "uuid": "2050be59-62e2-4322-9c2f-a50e62a487d0", "value": "12288:K1a1/nkJss1rS/u1couIYWLpWqey16Js8q8zBnW8PMrrm9oeTosNjSI+b:fFkJs45VL8CSB1qq9dTBSI+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750942819, "uuid": "5c4e54f1-6a8a-4076-bc5b-92ef085f7920", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750942819, "uuid": "22cc0105-c069-4609-ac57-ec0eb2f37e00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942819, "uuid": "7589cee5-913c-4501-bc05-af07ba9123d9", "value": "Tf89gh00002286_pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276a9b57-524f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1750916036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750916036, "uuid": "4a1ae730-5b8d-44d1-894c-c2075487fdf8", "comment": "Malware payload (LummaStealer)", "value": "beffef4d4631c6ba0f0b28c096519a9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750916036, "uuid": "fbeab90f-5d0b-4a59-9f87-dab2436b8f2f", "comment": "Malware payload (LummaStealer)", "value": "69b4d3d31f6e0b0bebe9fbdde180c8efd654756530efa4085e5b24a7c04a8c37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750916036, "uuid": "3d59389a-aff1-47b2-b584-0e1826d0460f", "comment": "Malware payload (LummaStealer)", "value": "1fe15addb4e5bfde3ac618afa9682149ab4130c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750916036, "uuid": "21914142-74ab-4240-89dc-e681db7e8d19", "comment": "Malware payload (LummaStealer)", "value": "b750b0f7f6d7f4503168804c3864f5290c8c560c8b20216e11fddd50ba04a91521fbfe9170eb1535f5c16dc85b5ce967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750916036, "uuid": "dddceb46-ee9f-49e3-9a1f-9740649be33c", "value": "T1D176332713A1215DE0D8CC71853FFDAAB2F107678B82EC3589DA69C53A179F5E212E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750916036, "uuid": "786966a3-cfe5-4cd1-965d-0c3f80cd118a", "value": "22bb3dcf02fba328c1516fb34a465b73", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750916036, "uuid": "42d7a313-7ca6-4149-a0c6-75e7d29b9dfd", "value": "98304:DZFZMZsLWENkLnDx3AL5dmc7ei4PoUhgnrY1czHzHkAttDDbn/+EOj4xfH3aSQ0l:ySMzDx3ALiDPoEurY1YJn/n/BOj4dmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750916036, "uuid": "a59f734d-257f-4b23-a60f-c015d71a1ec3", "value": 7236608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750916036, "uuid": "70dc111f-89e9-4b1a-b2fc-30cf53fa4b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750916036, "uuid": "ac0eff45-ef4b-4168-bd7f-dbf247ab4166", "value": "beffef4d4631c6ba0f0b28c096519a9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59aae3b-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750978149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978149, "uuid": "2c065ee4-6af5-406d-8b43-d9f911d8070e", "comment": "Malware payload", "value": "df60fd52850ddef876dfe84db78bfb14", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978149, "uuid": "5b03846d-f9c0-4607-b356-4715bfdfb615", "comment": "Malware payload", "value": "69c4a5da3be73c028658c6fec571de7dcd6222445fa46698f93cbd87f15f7b08", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978149, "uuid": "13fc5f9d-26e0-43ff-bf2f-00796cc0f496", "comment": "Malware payload", "value": "af189f2b3f702e25390c52bfd7487c01d901871e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978149, "uuid": "8ce58a4c-1d97-40eb-af8b-63eb4b979179", "comment": "Malware payload", "value": "a87b85fd3066e96d17b0c632e9cf2cfff9fe28d57f78f39014157599b261e3a9bdd6b3fb2d4d3bcae5c6111ff6336ce0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978149, "uuid": "b487d4b4-c6ef-41d1-9373-e9309d9eabd7", "value": "T1A121878FC32D1D090055DE01B5169BA48A46C6D8A9FEDBE1FD90DB734E87530B248F1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978149, "uuid": "af054d28-191f-4f5d-8774-aac80f2a27da", "value": "24:xh33IghwSIXhxNIejIchKLK/IVhiAfIkOhmwIjhysIdhft9Iih9lIKh7n7nI70Vl:xh34ghwHXhDkchKLJVhiFkOhmZjhy1dD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978149, "uuid": "9e1cac29-f3ec-45cf-940c-c1d176cd981d", "value": 1161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978149, "uuid": "765f6470-4243-4d41-b93f-f99d572f7c2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978149, "uuid": "e7c711ee-66c2-4c13-894e-872ffa75dca0", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88047cb-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750976006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976006, "uuid": "4d10b388-1407-48e4-ba5f-d8a445d2077e", "comment": "Malware payload (Mirai)", "value": "080040aa7ae76bafa335ffc49f998c8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976006, "uuid": "abadb856-d892-4719-a10a-8e597395631e", "comment": "Malware payload (Mirai)", "value": "6b432d255c26f84068208c7e447b07076beedf9a2efac4e4592ee1dfd04089f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976006, "uuid": "5a5a345d-9716-4701-a8bc-a961471dfb4c", "comment": "Malware payload (Mirai)", "value": "02e675bf0c98dda34b9f4b9024f534b400741b7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976006, "uuid": "64dcb0fc-6790-49df-85ac-9684a98dca7a", "comment": "Malware payload (Mirai)", "value": "9ad3d01548ff6150b10e086dc778c06a8a45ec1fdd71082d5eaf990f2441b086b77ad9e9c21668f8733d58a85ed0d38d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976006, "uuid": "820e8c42-5a8a-4207-8ce6-84d389b52bac", "value": "T10CA3D50ABB610FF7DC6FCD3706AA070525CC551A22F87B3A7634DD18B64B24B5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976006, "uuid": "2cf69fd8-4101-4d27-a6bf-4c162b31ed63", "value": "1536:FloyX5u5SUBP/qKm7KSknPhOQ0G87MRSVQwZX898btrE2awtkawP:PPpeSUBanoD87OwJ+ukaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976006, "uuid": "e217a229-5b86-4d3c-a375-821379a6ef15", "value": 101556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976006, "uuid": "57e62999-3932-40a0-ac65-a11e469aa500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976006, "uuid": "2ae24ba4-82db-4800-924f-1626b7890827", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65588291-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750977987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977987, "uuid": "813c0c38-5c32-4a1e-9e12-ad94a92dee61", "comment": "Malware payload (Mirai)", "value": "be2fae5f281c9060219f3d4b4bec974d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977987, "uuid": "fb1b56a2-17bf-4974-8de3-2140cbc8d2ee", "comment": "Malware payload (Mirai)", "value": "6b77ee61da12987cf16030d1da9cbca848f4b2b72b76e8eea679ddee62586157", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977987, "uuid": "fa87f1ad-a978-46d2-9b8d-03a1581fabf4", "comment": "Malware payload (Mirai)", "value": "f828a0843d48fd605b5d85ca52be1935159ffadd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977987, "uuid": "6b312a03-327f-405e-b873-ed930c56cb53", "comment": "Malware payload (Mirai)", "value": "8176bb7edb6b30777981b66c53bd428075741a7982a24d8b441ccf53da029a80c200d92d5a920b3cff3e90fe1ee0b3b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977987, "uuid": "facf2838-8d06-4623-917c-f5ec239edea1", "value": "T1C913023497D34430FE245075E8E509C21981AFACD5DF2997226AFE58678B05B8FD940F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977987, "uuid": "1fb613fb-64c0-49d3-a0c6-dfe0c050968c", "value": "768:t3gkM1q6f00ws1G6tF/DBNiQgU8pD9rd3sugWn3a4k3mvQV3kvfHR9q3UEL+e:to1iXsbbBoQS5BBgWnfoLOcL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977987, "uuid": "94b19811-ccb6-4656-a07f-7c58dcaf32fa", "value": 42868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977987, "uuid": "75a042a7-4674-4f3f-98b0-fa88f185cdde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977987, "uuid": "763211be-2409-470f-8293-f751c66963e0", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e035ae-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975945, "uuid": "f6f11422-7d58-4e3f-bd28-c5e0ed7e202b", "comment": "Malware payload (Mirai)", "value": "2ad436987ddbdf8ffe2f1f74ac0ecf8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975945, "uuid": "e87f21ac-fa33-4a6a-bf7b-a38b3148c7f6", "comment": "Malware payload (Mirai)", "value": "6b7cec0e1b61e36829b95e1846f024a9a6364b55d9cac324223824a1bfb02080", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975945, "uuid": "7aa30f6f-64db-4f9c-951d-3cd8f9eb69f4", "comment": "Malware payload (Mirai)", "value": "46d45113ded5547722ee24e2271a477c7f5d41d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975945, "uuid": "d7df445d-df48-41db-977b-22d6feaba99b", "comment": "Malware payload (Mirai)", "value": "936c22ee1b2a1a62578c32d9b5a3718915d5b5c207ad7eb93e58f72ecbc5d5afe32a3541efcac23a29acd5e8975c7ac1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975945, "uuid": "8846d934-d97e-4d02-9c6b-f563cac6302b", "value": "T17C53F2E2D0DA8AC197E0AD30F59717D3B23F4DFC91A896012390495D4EC1B63BDBA94A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975945, "uuid": "ca299611-c084-4f26-989d-b1baaa62d0aa", "value": "1536:0T5Xz+vgYnN4cFnJGH6HrL3BFo8l4U/o3l93g8:0T5XEN4knsHgLPFgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975945, "uuid": "ba03da91-7fde-4332-8487-52594fe3a5c2", "value": 61060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975945, "uuid": "0c66161c-71c5-49ab-8ff4-1c6200edf874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975945, "uuid": "eefb6e4e-2d69-4a28-b706-58f29f4e355d", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0070b0ed-5276-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750932721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932721, "uuid": "6518f4b9-c212-44de-8e87-d9797efc438f", "comment": "Malware payload", "value": "a9706846a24994a20f400c2b72927eb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932721, "uuid": "681b0d95-59c0-4dfe-b70f-7c07e7df12ef", "comment": "Malware payload", "value": "6c7a2d4d1d2981e3459832bada6663000063a19da3a4ff67fc72b3d110537c7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932721, "uuid": "73d68106-af31-493d-bb46-4eebe218006f", "comment": "Malware payload", "value": "42278f188e98f6db8ca3a464f99d642de8192909", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932721, "uuid": "93fccde9-73a6-44c4-9522-feb886984a37", "comment": "Malware payload", "value": "0fc6ac87a7c2b163b8ab1339622dd4de08c8563b8dbec89401a27f96980aa23a02e3ab622be29c2179dfdbbf62f50b85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932721, "uuid": "dbfc2318-c001-42c7-9049-9a49b3a834e5", "value": "T1C1B402018F881F8BC5BFCD750A2E167311AEDD9F46CA653E807CDD48B6A6D096783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932721, "uuid": "1deece82-40c4-48c7-828c-807c1d11bea0", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932721, "uuid": "76da1736-4327-438f-b402-58f93427f1e0", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932721, "uuid": "a9922d35-0a98-469c-8a76-844a0bc3bec2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932721, "uuid": "3f8fe44d-be68-44ef-a17f-ec22dbc6bd81", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4d2ce7-5229-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750899889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750899889, "uuid": "4ba6f6b3-a5d9-405a-bcf9-51d57d543d34", "comment": "Malware payload", "value": "2d3e9b1c1bf367b77ce3d49e4c450a97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750899889, "uuid": "22ce1708-9b30-4911-a261-6fa0e9683af2", "comment": "Malware payload", "value": "6d87c01f68c4b63a78d009e4c700e353e12ce0064b69994729bccfee2bdd38c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750899889, "uuid": "ed83ed78-adfa-467a-989e-f9aa20bb3d27", "comment": "Malware payload", "value": "aca78b41e8d1ab569448948372d0105f158dffed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750899889, "uuid": "11eb2a26-0452-4f3d-abde-471773d3fece", "comment": "Malware payload", "value": "e188021954cb4fff50888b3200d64deb776b41865128aea71b54afb94c56e693e9b2082c39b9745c336d9831b926eaa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750899889, "uuid": "0e5ce926-a29f-4dd3-bf63-0c681141db4d", "value": "T119A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750899889, "uuid": "6dbab080-3cea-4892-b65f-f9e6fa96c241", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750899889, "uuid": "cbfe6ef4-1abd-477e-9434-09676aea134a", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750899889, "uuid": "0c9e9e96-4e3b-411e-bccf-18f245ce9853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750899889, "uuid": "c892bd9b-4d3a-4a3d-aedc-e29c771552db", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9ab87a-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975929, "uuid": "78c1bac6-33bf-4666-8a2c-06d5ea4472a6", "comment": "Malware payload (Mirai)", "value": "39002dea7953adf07ced4a17055a2b12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975929, "uuid": "0fad6fce-cd14-4643-aac7-0390971a5346", "comment": "Malware payload (Mirai)", "value": "6e5b0c893b0fabb3b440a3c396dfe45ed176ab02c28dfc539b8fe66fcf782af7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975929, "uuid": "ae3ad495-e5e2-4849-a3d7-ce43d9a089d0", "comment": "Malware payload (Mirai)", "value": "129ccf7b3fb76da30b52380bd222ca646dbd6f1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975929, "uuid": "84cc3c16-7c2a-4172-956f-64f962c99dfb", "comment": "Malware payload (Mirai)", "value": "a88fa633707cef4f478b29942658afdbbd0658d04eebc3bbe2dca28dfcb05ed325c504f6676b47689a110e77d4714f80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975929, "uuid": "c455b002-cd8c-42a3-bd62-c084d23ce386", "value": "T1FD03F111923BCDA3D6B1357B6A7607C68F3445BB637DE762A2D0013D62E20AB46B00C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975929, "uuid": "65610d03-17da-423e-96ad-782d71985907", "value": "768:aqwnSTjsxbx/XWXgTxDEPKJwku5VxeTnK2z0tMXyOV9q3UELE/:avnSTjcx5DEytu5Vl2g/La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975929, "uuid": "98da1d3f-80c8-43a5-b588-7a4060a00f0b", "value": 39220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975929, "uuid": "336f57ab-7d13-481b-837f-e34eb5a700f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975929, "uuid": "2cb6510e-834f-4a75-bc2e-1fc56aaa05f2", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00dc875f-52b9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750961498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750961498, "uuid": "f7de1423-40d2-4af0-9ce4-f615c6635264", "comment": "Malware payload", "value": "51bb5de52aa8736b85cd574df5e59ac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750961498, "uuid": "f4ee3a98-cb78-44c0-b91d-8b776f23f7db", "comment": "Malware payload", "value": "6f271db47b47e2166da8350e30e32bfce9b908c01c54773bd2e5f66dead22d9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750961498, "uuid": "76eb29e5-6851-4928-84a1-75548fb0126e", "comment": "Malware payload", "value": "63aab6eec4267ab939b94ed7fbae747dcbdd9c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750961498, "uuid": "08e02e92-a461-44b5-a235-0d144743f735", "comment": "Malware payload", "value": "58ccadc07679f842ceb4514c2b94d8d1d767b049e6fd3a68728f13d12c48dc3b2f288be96508aaccd96157ddc7546f27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750961498, "uuid": "89034958-343b-4e29-ba05-6a6b407f42b6", "value": "T19A45127D76E4A8E3CC86457001A27A729B30FB16079D53E3FE541BA7C9522F2293DE09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750961498, "uuid": "75320e15-487e-4baa-8272-72dcf5aaa28d", "value": "40de15f58e0b1af12d2882b9af4cde07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750961498, "uuid": "1e99bc64-bc57-474e-8ca3-ddc54dbfe3fa", "value": "24576:1ttstdxGpQ2rOzhJEWDrCdvuap98T8T6lUhwVUgpBD0GHrpCV3xvL:1UtbLAOFJESGdGap9OW0agjncdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750961498, "uuid": "67a1cad1-1887-4c99-a3a0-a551a902bb70", "value": 1196032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750961498, "uuid": "4e6331b3-f4e8-467f-9af4-c3e3d17fbbed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750961498, "uuid": "89fbadbd-c3a3-493a-a115-f30953b537e9", "value": "setup_actualearth1.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab85fc6-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913894, "uuid": "1384c6fe-bc25-4ee1-95dc-43d9279f6130", "comment": "Malware payload (Mirai)", "value": "7c5282c92ddccfaba97d3804f685ab4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913894, "uuid": "037be619-fa60-4b8f-950c-63ffc53d3efa", "comment": "Malware payload (Mirai)", "value": "6f83e5c36f8454491c6ce4621f5482ccc3c671b216b7e3ebba85715ab3dd4380", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913894, "uuid": "1c265720-14b2-4021-90c9-55ac81c4edf9", "comment": "Malware payload (Mirai)", "value": "dbaab05e099bcfda5d5f413527ae63ec7ce39dc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913894, "uuid": "00bc36e9-dc0f-48fc-a131-aa686b89dd02", "comment": "Malware payload (Mirai)", "value": "fb7c1aef0c7e0a7b9f59c10a61edb1ad9c8511354d332543dff471c161b6b041e9f9ff5572dee931ff9bfa8343151b5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913894, "uuid": "491fe8fe-2896-4f21-afbe-58f9154e34f3", "value": "T132B2C0CD61943084C98D7C7C178D4A675F68A1C0BADD9B26E354CD98B3BEA4B385D078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913894, "uuid": "76bf9367-d21a-4316-b1b1-a82db37f7a98", "value": "768:obrQlS07dEv0UXqUhvQE+CXQKMQKCXBp3b+ZqSWv/:4QlS07FUXqIYSXQKqu3Wq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913894, "uuid": "411102b2-af06-4fc0-81e0-0fde478fb86a", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913894, "uuid": "3b480afb-2363-4b1a-a10b-029fef530b85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913894, "uuid": "fd06bc6f-1369-4bbb-a773-f862b84b39d6", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ca98ce-5274-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750931921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931921, "uuid": "5ba3ebb6-3ffa-4a7f-83c7-20d8e6421d2e", "comment": "Malware payload", "value": "6d5f96193dc6ab3c8f0a85e131fa6307", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931921, "uuid": "ad0ffb18-46d7-4cba-a2a8-d9e05205ebc8", "comment": "Malware payload", "value": "70489effdbf885cb281e7af822534f4d1572abeb47f50de1440831df4488649e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931921, "uuid": "edf834df-4b8a-43d5-8fb1-c4900c37e88d", "comment": "Malware payload", "value": "3eb61791e6e5c4c62ff00273af3ed5ff2f7c12f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931921, "uuid": "eb63fc54-ff66-447e-98ec-46e403e647e0", "comment": "Malware payload", "value": "fc415fa2f441bd445a450eb40f4d9fd1472c6324b8951afb03ca078bb830ead5f9de8ea12aa194f573ab857e440cfc7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931921, "uuid": "f140b792-8886-49f0-a240-04440fbaba95", "value": "T10AB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931921, "uuid": "c0242462-8cd4-4bc7-9948-e9dad7788325", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931921, "uuid": "635f8508-a088-410f-8781-c5541d1aeba9", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931921, "uuid": "cab23737-93af-449d-9665-f2c6d4f10777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931921, "uuid": "ac70201f-e85d-4d7e-9709-d17cd2f6284e", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db11280c-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905600, "uuid": "7e6af0d6-a537-4533-9fcf-517f77d47d06", "comment": "Malware payload (Mirai)", "value": "cf7197fce48882f1ccabe4469f724b33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905600, "uuid": "6dad2ea5-b0b1-4f88-95af-074d2c2b745e", "comment": "Malware payload (Mirai)", "value": "7064ba0edb3fcc4134f746e80aedccc568ebc493787b3971c4b396565d78c82c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905600, "uuid": "c2d2e6f3-f216-45fe-8b6e-fb3ce37c6ac1", "comment": "Malware payload (Mirai)", "value": "ff567851a776edcd0f50d14482c39c978862cb23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905600, "uuid": "0a57b767-6ad6-4386-9266-bd6eb7bdf003", "comment": "Malware payload (Mirai)", "value": "3803d80abf6cd44ae8490e484c875580dadf3b0455461828a1bc2c6809b0d1f5a26aa3e19a8df9177f00e9e52d50ea26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905600, "uuid": "f40547ec-feea-4770-8b87-8c7c9e1b2b59", "value": "T172534C9EF94DC883CA874338448F8A93B237A91C9155C58F531C435C79CB7FE96AA5C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905600, "uuid": "21832f98-fbe2-47fa-a858-cefb0e918f8e", "value": "768:RnEFJye1O96lVvYilr6TFkwbTxjJb0G0j3OoTh6AIhqhSoeMPM5qMOBTQzDxtS/e:J0JRO92YNjs3OoTh6A5hSH0TQBif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905600, "uuid": "b8cf501d-d06b-482f-b1c7-269f7b7f20ec", "value": 61912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905600, "uuid": "54da865d-072a-42e8-ab4b-0fdc57cd2b9c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905600, "uuid": "74c5090d-5fa9-4753-a480-beaead6e50a9", "value": "SecuriteInfo.com.Linux.Siggen.9999.18909.6092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ceff90-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975941, "uuid": "d5f2dea9-3fb3-4fef-8b7d-a3cb4a0c0d63", "comment": "Malware payload (Mirai)", "value": "fcddd6110e13880c932f95b668e2aa27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975941, "uuid": "f8e3de43-c8bd-4ef1-9b77-f36061d1bc18", "comment": "Malware payload (Mirai)", "value": "70a376578da3838ee5052d30c9f3fc324214e1762bbde5a5fd81f513665dcbaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975941, "uuid": "4d0c5a1d-6f9d-465c-9320-8a5c74abea7b", "comment": "Malware payload (Mirai)", "value": "6ff32c7efd0f85aa8b74117e86d294480ff80723", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975941, "uuid": "2645439a-8ccc-46f9-a4b7-c9d853c379f7", "comment": "Malware payload (Mirai)", "value": "1234c6c5b2b446fc096fe063e7c3792bea2127a16471dfcd3bc880714f79744052e16cc85d3cecb6ff1156a28a6001c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975941, "uuid": "5f6d613c-cd82-4d4b-a01d-7eeb4ebf9f06", "value": "T1EE043B46EA414B23C0D7177AFAAF41493322D794D3D7730699286FB43FC669E0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975941, "uuid": "d548ed04-35f1-4429-b69b-d0d3a2345246", "value": "3072:nGFYH2qJsdKLr/JVhLXphfGiaUfsKB3rYmWVaEWKP85+LYRM/9jvgE:nGGH2qedKfJXrOiaUfsKBcmANE5+LWMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975941, "uuid": "77e49d09-20b7-4035-b557-f0282600b38d", "value": 173688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975941, "uuid": "9b81ef68-e328-4f9c-9fc8-325485530978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975941, "uuid": "006b949a-b083-4e2f-96b9-b6031d0e46bb", "value": "star.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0983fee9-5299-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750947769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947769, "uuid": "da4e5331-ac15-473b-bb9e-2870c0dea80e", "comment": "Malware payload (Formbook)", "value": "79e46099ba32951c8aac8d9c3d579152", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947769, "uuid": "07d0aed6-cc22-4fff-8af2-20e55005e5ea", "comment": "Malware payload (Formbook)", "value": "71061c247762961b52c05043f9aad7acd24d6be55da97b79136685dc8d71fbcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947769, "uuid": "66765f7e-0ee6-4231-bfac-3656f904251c", "comment": "Malware payload (Formbook)", "value": "be1fc2247026bc0671651ad5695b4e964addc1d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947769, "uuid": "dd66b249-e458-48d7-bd38-bf68516395e7", "comment": "Malware payload (Formbook)", "value": "7915d8e28ead86f0f3c3bd57547bf4cf80d360fd797ef198ebc0910421e5d0075e1b400f7cb2ba3173414976c57c7270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947769, "uuid": "1997faf1-e73d-4f1b-9644-96bc2672e427", "value": "T18A050218224B6F12C6BB67F81901D0B2637A6DDE6160E7278FC92CFB7D727810606B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947769, "uuid": "d96f2372-ee3c-40d3-861d-a8905d49c809", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947769, "uuid": "7f948cbd-6aaa-4734-b660-ec1ba64b2757", "value": "12288:6gr5WnbtZZwJLNWtqvWE/3qFiILx347h8dwvVumVMZG2Yo53JqapyJCWa/:1WnbtwJOqOSqiIVm8uIa32Yopx8oWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750947769, "uuid": "e5d24687-473a-4e73-b5f6-febacf258f82", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750947769, "uuid": "bcebf256-8555-4786-a65b-b9331e7f4fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947769, "uuid": "9b5e22e3-33aa-44f1-8fae-b1a8c088712d", "value": "Draft packing list & invoice, Awb.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbeebeb-5265-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750925737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925737, "uuid": "3c41be1d-fe1c-4b98-b3ef-fb163158e7fe", "comment": "Malware payload (RemcosRAT)", "value": "f18005b33971d4c6dc1f844d4e08dd9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925737, "uuid": "2ff133e7-f909-4398-8480-d52ffd1a18e5", "comment": "Malware payload (RemcosRAT)", "value": "712b8a327b43b2548751f3de73716ef242119f01d37b062fc990f4a6eb3cc515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925737, "uuid": "73739099-4245-4714-8127-a87f7461a620", "comment": "Malware payload (RemcosRAT)", "value": "d3b20350f213981392c3b75165584cab68d9faa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925737, "uuid": "13821a22-b40e-4690-b9a2-7e2b24b6d359", "comment": "Malware payload (RemcosRAT)", "value": "b33600c4f7efa460cf51d49298c7b6e5ada6d2b10c89479b44577defba5c2433e084413bea7043150e2a2edf8b17084d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925737, "uuid": "7b62331b-f697-4dd4-afbf-b6b7b909be6c", "value": "T11CF4129067769EA6F6381BF82021AE6491941DFCF87495095B30388BFCF37435C3999B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925737, "uuid": "8a9d0442-a907-40dd-8b7d-ddee6a486bf5", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925737, "uuid": "1293a5d9-7017-41b9-af73-e4e741a193e0", "value": "12288:ORcIur/Ki0vGKNK6nUqBXwE6sFEMqzjPgXTbiz6U7L+UXzW9du2zAZT:OR+rCjvTNK6ZZxxqHPgDuz6U7yUXzWb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750925737, "uuid": "a20670b3-aa11-4735-8ee5-0e4ee8047c34", "value": 767761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750925737, "uuid": "968395a8-57a3-4930-8783-2ebf72e11892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925737, "uuid": "802dd71f-59a4-4f2a-a9b8-a38911bd3471", "value": "ORIGINAL INVOICE COAU7230734290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f82a9a5-52a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750953980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953980, "uuid": "db84ff10-3325-4049-a17e-2417f5f9b2bb", "comment": "Malware payload (Mirai)", "value": "d0c8ef5add125c05a0265ff59e92a1ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953980, "uuid": "62878f09-0678-4716-8257-597dc28a4f95", "comment": "Malware payload (Mirai)", "value": "7133391d2afb2ba104c3f7b6e3420ca341a52531b3ee62e64ea1a1c732f8c55d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953980, "uuid": "0dfa854f-ba7a-4ff8-a8b7-b21f1f6de470", "comment": "Malware payload (Mirai)", "value": "f6eafe2534f503172b534a15a1f222dd7cb57f9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953980, "uuid": "f46ab520-2979-472f-a0fd-7e69dc56c25d", "comment": "Malware payload (Mirai)", "value": "56021205bb00925e9659002f5f70dcfb4fb82a251b53f39447f5cd6a707d87672b0005e61820589cced8df41e28c2b7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953980, "uuid": "967484f4-1959-43f9-a4c3-1b1e3fa6390d", "value": "T194A33A05B71A0A87F2A61DF02F3F2BE183EE8A9110F46689395EFF459171D321582EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953980, "uuid": "5f4c00ca-300a-4123-9e82-eb1cdf357406", "value": "3072:a5bWGQlHFpN4cAEbwESqICW2/SISigHKd:a5bWGQlHFpN4cAEbQFCW2pSiQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750953980, "uuid": "93e5c952-c44e-42cb-bfd4-638c68288bbb", "value": 99600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750953980, "uuid": "49752bad-8187-4591-9c02-968d4567e25a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953980, "uuid": "e7bfae88-cf89-44b6-9ae9-0a379c504a61", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "013af746-5249-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750913395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913395, "uuid": "b38de584-ed98-40ae-9cc2-9d503f319fde", "comment": "Malware payload", "value": "0826e6e37efffedc71ee904872756e5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913395, "uuid": "8233b6e6-3a12-4c7f-bb8a-97f3f3a3cfa0", "comment": "Malware payload", "value": "717bfd60f9d0672d9f3a80d3e576fbe05a19f9f59f09118042afcc9c5ac64dea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913395, "uuid": "3504237b-0d7a-44eb-a455-c2a6ac2c93b6", "comment": "Malware payload", "value": "bee23a9668ae6d8f64453e3d1b6a3140a0ca71ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913395, "uuid": "98e68938-d102-4723-9cb0-e83052c1ea62", "comment": "Malware payload", "value": "b9598f2a904b22ae77024daf9fc4db14b322c8775451cf448e3a098a26f9492817f676467cd5b4713f1c7bd8e026514d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913395, "uuid": "3cf3f129-0e98-489a-8dbe-714bc202cf05", "value": "T1E7E4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913395, "uuid": "fd1a9284-3a23-4d39-9cf9-3b00239e1a94", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913395, "uuid": "c42aaf45-2dcc-44c8-9b7e-350040f508c0", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913395, "uuid": "66e35484-fef2-4d6f-ab08-bea9964ef2e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913395, "uuid": "a5b8ba85-db6d-4780-a6a4-f086c31d49fd", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da3b14d-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975800, "uuid": "24b42a3e-045d-4456-97f8-9f53d9252ebe", "comment": "Malware payload", "value": "1f6c27a2a68eaf50a85b3508436ebb16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975800, "uuid": "ed1432a3-af95-4121-b2b0-65f94786bbaf", "comment": "Malware payload", "value": "717fb1dfb242a5b7931364e7c21d1c27f5f68cf94a04a8fe9c6697dfa23ad779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975800, "uuid": "3c9553b0-44ba-4e65-b00c-2891e14abef1", "comment": "Malware payload", "value": "893130c15390908c1665f2bdd028f92fc3c66822", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975800, "uuid": "4fc0915c-9713-44c0-bf82-02d2c7f2e2e1", "comment": "Malware payload", "value": "b57d05ff06cbb7ff7927d5ed67140276cb0d5d658adedbadd50a32ea7186292091f29e32a6dbd57d232b6e5e0e7c29dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975800, "uuid": "cec8a38d-6078-4204-b856-9ea103c75ba7", "value": "T139D2B24E2D22DFECF62C85368E778E20A7A523C623E1D640D79DD9005FA120E556FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975800, "uuid": "e41ebd74-c85a-4016-86b0-1f66968d50f6", "value": "384:3jHicbPjGJb1Lu4vadDZQLyqWcMgr6RTd8LGHjE9a8ORmWCm2DPxDcWfN2ATsi/6:OQbYbMfVeyq1MuGDYVQeGWDTV/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975800, "uuid": "50f83a5d-7f25-483e-b50d-d4070b762104", "value": 28856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975800, "uuid": "51a1b1ee-e4ac-4b53-b8d8-c7abc5d2b327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975800, "uuid": "d9a9e5ff-8936-4305-ab93-0a1c2365a0e3", "value": "violetmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcce050-52e7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1750981575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750981575, "uuid": "6fdcc09a-83be-44fc-badc-160f7a06b8be", "comment": "Malware payload (QuasarRAT)", "value": "d90ddcf6fa1cadee7bc976b95ba7fb55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "what do y'all think about this", "colour": "#3503FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750981575, "uuid": "c99d1a2a-056a-47e7-8cbe-ca6921321da8", "comment": "Malware payload (QuasarRAT)", "value": "718e1041eb8f21c96791254f51b15e9394b8b55f4490713dc27d4a3bb4cb7e9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "what do y'all think about this", "colour": "#3503FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750981575, "uuid": "6819baee-135d-4732-a771-601310241dd0", "comment": "Malware payload (QuasarRAT)", "value": "f74610d069899f6bdebf1e8149e8ddabb15b6795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "what do y'all think about this", "colour": "#3503FC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750981575, "uuid": "8928a9a8-778a-48d6-835b-6ff72681047c", "comment": "Malware payload (QuasarRAT)", "value": "622a365495199d82aa54ab57fe0930f50a5aa1d34c596a480543bb34d4d3ce8e64747e0bc01f0889517876420b39beb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "what do y'all think about this", "colour": "#3503FC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750981575, "uuid": "b7ec76f1-03b6-4ca9-b828-65f33d4a8afd", "value": "T180E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750981575, "uuid": "98777cea-b7fe-42f7-8075-34d494facf09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750981575, "uuid": "ac849a9c-ec08-4b15-93e6-365aa23752a1", "value": "49152:PvDI22SsaNYfdPBldt698dBcjHDxcEjItk/JILoGdfYTHHB72eh2NT:Pv822SsaNYfdPBldt6+dBcjHDxnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750981575, "uuid": "45d2d1c8-7da7-4c69-9bf9-af7ad2252760", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750981575, "uuid": "4fbc47ad-c8e9-4d6b-9672-0b359ae9a4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750981575, "uuid": "c82db2ac-c710-4549-9dac-b6660363d112", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9e48f6-5299-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750947801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947801, "uuid": "18a9fc4e-5fc3-4114-b410-321f43f6fd72", "comment": "Malware payload (Mirai)", "value": "e06888a47b43252b08a7f00f189f54b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947801, "uuid": "0741ebe2-c231-47dc-8dc7-f2d07df1a270", "comment": "Malware payload (Mirai)", "value": "727c34b81f58ac4db5d0b69ceb6e95e939757d1bc0283efb35162de738af8d19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947801, "uuid": "b4703b23-5194-4172-a48b-a7b12d43ec6f", "comment": "Malware payload (Mirai)", "value": "714fc839326bad115eeb6751fa4f513faf9c80d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947801, "uuid": "972f57f6-179f-4755-8db9-433350c6cffe", "comment": "Malware payload (Mirai)", "value": "d319d3f2d3c56f4df02ecfd1aef291b5c431bd8826319b0d6daac1369a2f424027802f923c18b60a25f6633148249727", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947801, "uuid": "dfc472b8-e4a7-4e23-a436-d769e4e87f25", "value": "T15FC34A07B4C184FDC4DAC1B44B9FF53AED32B0AD1238B16B27D4AA222E59E215F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947801, "uuid": "6823be3f-26ff-4a79-b513-9b2ed259a209", "value": "3072:mTUTfCdO6FFto6T68wKhc/t/ekNaogMewcgsK027u+Ol6:mTUTfCdO6FFto6UwwQdj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750947801, "uuid": "fa782542-5c55-4098-99d0-b09f3d2b495a", "value": 122815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750947801, "uuid": "58eb0867-b28e-484a-b24a-8b4942a8a85e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947801, "uuid": "dc8479ad-f339-4079-9653-b8e44e0f2826", "value": "cutex86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d4279be-526e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1750929360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929360, "uuid": "55a7a106-9f68-495e-ae03-32e2dd902311", "comment": "Malware payload (SnakeKeylogger)", "value": "f007991b39f52eeb59f8292128dae578", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929360, "uuid": "e164aaf1-5e8c-4477-be41-0a618a02e989", "comment": "Malware payload (SnakeKeylogger)", "value": "73279a96db5afd794bd62b193a1644092d45ec85b7f8484025e5ada6a3dbdaf5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929360, "uuid": "ab977c99-8eac-4c6f-a808-d7b023f9083d", "comment": "Malware payload (SnakeKeylogger)", "value": "95437d7587449fb061381e8a5aac2c32e4b59f9d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929360, "uuid": "c6276011-c5d5-4f4e-9ac7-7f2bb4e4af4f", "comment": "Malware payload (SnakeKeylogger)", "value": "0b94a388563a1431e094bd161a5d12c4dbfd4e3ab6c173b1cb300bb9a6f0bb1ce8d8a172cad51d2a7a5e94086c1abec9", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929360, "uuid": "acb4373b-2c0c-41ec-85e7-1bcf671b54c1", "value": "T1CED423FEB6A7B83886E72D78F8DBC47C9C20DE24BA047E543F0A106D85DA7869155C1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929360, "uuid": "2e602d26-0945-4685-aabf-8f42c8b6f0fb", "value": "12288:aFjzmfxlj1aEpKOohLj+Qz+SJZiZHsD/+CJrqzqW9LB6SUQWdb6p8cz:aF3OTZaE+hLj+QdqI/NNWB6SAb67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750929360, "uuid": "25f57a06-9ff4-413d-a798-79aadf8a74b6", "value": 640525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750929360, "uuid": "840d108a-0cf8-4485-acd7-cb8b43c50577", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929360, "uuid": "ffd93cb1-c2f7-48e7-82be-56fbe1e6458a", "value": "PO#80967.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea2a9fa-5277-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750933523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933523, "uuid": "e14cf5b3-a560-4f83-98ef-e7fe3fb9af48", "comment": "Malware payload (Mirai)", "value": "b8f42653f5d3ffc5f2bc42eda10d82be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933523, "uuid": "695012bd-a95f-4c36-a6b0-95397f8a9e7e", "comment": "Malware payload (Mirai)", "value": "733dad30bbb081801d7774c4461516fd4173fecb7bff19c5fed28ccdb47be660", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933523, "uuid": "db58c825-5af1-46e7-81a3-ad6cad8cb296", "comment": "Malware payload (Mirai)", "value": "d8738becab770aee94f950a9d22274fd62017f3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933523, "uuid": "7b7c072f-cb59-42e9-9311-6c52cf1b48fc", "comment": "Malware payload (Mirai)", "value": "b28d05444ca520e7307d6e56f7ca739ac54671db5e95372f31b21e2ceead5869041949053ca3190ab4e86416240de2eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933523, "uuid": "83bd09c2-a1ef-4c96-9e5c-acf8e74a97e7", "value": "T1E16312E02BB5178C1276E8393ADE306F8124622B379A29241D9791CEF85B6039573DBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933523, "uuid": "afae2b90-4df7-4b1c-8f17-b05c7817e3bd", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzr:8D+CAXFYQChaAUk5ljnQssr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933523, "uuid": "48639051-30db-43cc-a572-4c1d8609f0bd", "value": 72012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933523, "uuid": "3875915d-d976-4998-9780-1622235e0038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933523, "uuid": "bb76d675-005c-4f59-b540-4a11586cfac0", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b6c1a2-524d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750915288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915288, "uuid": "4a0f5ce6-5079-4cbe-8b45-5ae268fa479e", "comment": "Malware payload (Mirai)", "value": "537dfea4cc5811873c452b96b3cffd24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915288, "uuid": "f6092f15-7246-4f9f-96bf-fbeb2fd99b6d", "comment": "Malware payload (Mirai)", "value": "73fabcb1a2585a999ca81ac5d78ea95d83ada1a919848668e89ce70e3f3a8c75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915288, "uuid": "80532160-b692-45ae-ae93-598e679e3ed5", "comment": "Malware payload (Mirai)", "value": "1c17555b148bc8ef1fed1899b34af91b99ab970c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915288, "uuid": "48e989bc-bfd7-4901-a30f-13b2ad3137c3", "comment": "Malware payload (Mirai)", "value": "539fd446f7496bdf07bc6907024480c6a56add9f34dd976d4faecc6d2480a2acc4af58b100de317bae6375a821b57030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915288, "uuid": "e05148ae-0b53-4aff-ad57-f91f0aec11ad", "value": "T17C5329027618094BE8E35DB03A3F1BE193AEDD9120F47149794FEB459632E321456FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915288, "uuid": "57f0bf7f-2485-4256-bd15-aa4117390b66", "value": "1536:uLloZLPWKyM5EZvour2KwcbNUSrzk4tQsTOfHay:JZLPWVvvSIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750915288, "uuid": "b20a4563-43da-48aa-a85b-4d3b457cf0d3", "value": 62180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750915288, "uuid": "22e4b44e-a4b7-4ba0-8439-289fde599ef0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915288, "uuid": "5c10009d-472d-4d41-a55c-7cf58f98de25", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59b27144-52a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750954775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954775, "uuid": "82dcffd0-6867-4a65-9059-30a6bfda4234", "comment": "Malware payload (Mirai)", "value": "93751ae43fdf9d330cd7aa10e07b3244", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954775, "uuid": "119e1dbb-de20-4785-b196-b4cb7663f780", "comment": "Malware payload (Mirai)", "value": "7418939311768be639b3ab2fd50c84816649c14d338e3b7e29af0c4c9f8b2b44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954775, "uuid": "25d393fe-5d36-46ba-bb59-901aaa32704e", "comment": "Malware payload (Mirai)", "value": "8ff39a2243346a94b474d3b1a6686a7d7a23e13c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954775, "uuid": "85b43e0f-434c-4ae1-b573-f06ef7c46571", "comment": "Malware payload (Mirai)", "value": "6983da737268ad090bc2913a9d4937ce9de01b5d0dc19ae60584c5f5a97af5510f94043295e909f9991aa13ebb9be198", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954775, "uuid": "a1ac6f1f-738a-44f3-94fb-0fed057d75cd", "value": "T174E31A1327790A27C5E1A57951E3D337F2B95B892478820FBEA09ECC6F5C9D032933A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954775, "uuid": "08870952-dc29-41b2-8a6b-29cbc56eb1da", "value": "3072:PzOLFDuz65ouyjyKHrRpNWOXtEV0STZSRT:aLFDu0HyjHps260SdSRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954775, "uuid": "ff1194f5-8d99-458e-9e10-eccd82ebd28a", "value": 149536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954775, "uuid": "1021d8c6-2864-4bcc-8311-43a15f207f42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954775, "uuid": "48a0a9f6-e5f9-4e15-828f-a6ee9798dc19", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccec75b-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913898, "uuid": "129717e8-c1c0-4344-a300-e71541e145f4", "comment": "Malware payload (Mirai)", "value": "910932effe03224800cc0fbda4ad1e99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913898, "uuid": "b7406afe-6c37-48ad-b73c-b0c0ac5cec44", "comment": "Malware payload (Mirai)", "value": "755667347b4245f965a4f4eb228bc82777ead558e68400227e8344386fabc64a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913898, "uuid": "1eec3a47-0cb9-41de-8080-12e1b1cedd64", "comment": "Malware payload (Mirai)", "value": "f5c80c8bdecb454860a101d75e78c23fdf1a299c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913898, "uuid": "9e73fc55-be29-4e51-970e-ecab4ed145e7", "comment": "Malware payload (Mirai)", "value": "f279c8d2dfadce6e205cfc27413b7bc91204211aad78c40454417c9ce4d22556add593495ae8c240eada09733912044a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913898, "uuid": "151ec55b-30c2-4795-89d5-6dde47550c1c", "value": "T15AC2D1E0B726FD31C520AC3DE53B4D8A3A510A7C91FF393664158C399FC165B63B84A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913898, "uuid": "84ccfcb0-d679-419e-a13c-922c7f26f18d", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrHgY9q3UELuj:NKy4qfqoeJdXWgELu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913898, "uuid": "8d97c043-3e46-4e4e-98e6-c0990a724710", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913898, "uuid": "3781c6d6-ef3a-4e97-b0ed-330d767ccc9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913898, "uuid": "5553ceb5-de97-4da2-829c-60ead264a3fa", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bfd02e4-528d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750942834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942834, "uuid": "32c7069b-cc0b-41b9-bbd3-5b63c9998023", "comment": "Malware payload", "value": "979135bedf200152a453c51b98856208", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942834, "uuid": "ffd9d65e-fada-4d41-a8bc-ca6f6d6b6fc1", "comment": "Malware payload", "value": "75f5a421b9eba49a658b96fc828be29f4e90f14b7db5654b85508e66a152cda4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942834, "uuid": "45d4f995-0674-4524-9ba3-ade5cbafdca6", "comment": "Malware payload", "value": "f1b82fb3a1c59ace3bb928c37e4e196049b1037f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942834, "uuid": "0ecbe9b1-6c8d-4b73-b2be-78da8d982393", "comment": "Malware payload", "value": "78a31b8373d10453eed4c912a0fbdaf7b08806475faffb4ab54332655cf8923c4d8caf22fd737dee3ce58b22a7ab5430", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942834, "uuid": "e29cb110-d74c-4e04-8396-b86a787f7f59", "value": "T1A64633D0E90DE3D509E13012936F083999DB3A0BEF9E64F0E66E1EC4CD491536DBA786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942834, "uuid": "dc6d582d-072d-48f8-91b4-d754d54e0ab9", "value": "98304:qnP9DCm3IotQAfECeT4N3jFKnfFdp23BfLvfD2qtbGbmf5FlZmLNESnodK3ZQYCY:qDIoxfysNwnfF2dj2alZmZVoKJyAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750942834, "uuid": "a0171ab4-5224-48c1-b5ba-8d622004038b", "value": 5771512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750942834, "uuid": "b9d794a9-e93c-4b47-a3ef-95e29af37d8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942834, "uuid": "f9b3413c-c3c5-4a1c-82f2-3978c1cf4a90", "value": "flashcenter_pl_xr_rb_165892.19.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2176342-52a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750954521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954521, "uuid": "2d22c6c7-8a0c-4e25-93ee-b187d812855b", "comment": "Malware payload", "value": "0e38751491415da89853147fbda5d916", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954521, "uuid": "91159b72-decc-45e6-a404-d702d34fbc9a", "comment": "Malware payload", "value": "75f67fffb65ab1cf1de6f83d1d48dd742915dfbed39d0fd57c011ba90082ebaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954521, "uuid": "ab7d2bfb-8af7-40a9-9150-93b07fdc3b4c", "comment": "Malware payload", "value": "1f7937c81448862ed68c6368d78625d8df1f8a7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954521, "uuid": "6fc42159-1683-4af9-b121-5e6838565feb", "comment": "Malware payload", "value": "fa1e28a7d28144d7df2632423bab8d9bfe138aa3075fa9ba015b4c955e66a96b091d0881b931abcbf9b59b6272946b69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954521, "uuid": "0708a9ff-f014-4094-b159-47f88f0e15b5", "value": "T1A6B41228EE4E3891F3D1E3B8DA0A4BB1B05B7DD0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954521, "uuid": "0af644b7-be52-41c1-9e32-759bc27b6dc8", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954521, "uuid": "544c2639-aadd-4329-ae96-7b979cf14b72", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954521, "uuid": "0a585765-5ec8-4170-9037-6dd90f99e78b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954521, "uuid": "778018a8-621e-4f18-937d-f296a465f1be", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988b9e4b-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975926, "uuid": "6fd36a4b-f9f0-41b1-bf4a-892149be8e22", "comment": "Malware payload (Mirai)", "value": "4094b666701d182c3f1c090f32dfb27a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975926, "uuid": "2ecd3e20-9e57-4bec-bd6d-f475348f39c5", "comment": "Malware payload (Mirai)", "value": "770d84a2c5e7dc58aa7532e0706aa7df977e49bba4e6840acf24a399afc8ec24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975926, "uuid": "07e6ee2d-1b34-4ec9-9137-780ad4d8039d", "comment": "Malware payload (Mirai)", "value": "59e05cb4b46dde776bc2f8643dc33b2895ceaf01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975926, "uuid": "a035a7ce-bf83-4d3e-87a0-efd5b046dc58", "comment": "Malware payload (Mirai)", "value": "8e199e7f907ceb47de987ec95326c69aea315d47ede02b5a3f289fb78c1c04c8d454c41882cee7a186127a17c7344c88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975926, "uuid": "7dc48152-60df-4197-8e3c-85776557cfdc", "value": "T1F9933925B9391E27C0D1A47A21F78711F6F163CD22E4861E3DB10E9EFF24A502953AF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975926, "uuid": "2c080b91-21e1-4ff6-a191-74d4c95e6011", "value": "1536:l3poS7/PWRdL81razypaYzbjME35cSnn94g6vSKRfXYk5+C1tnwljH:BpbXME3p6ZvScXYU+4wljH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975926, "uuid": "cbb84a1e-c61a-4fc2-874e-88752546ed5d", "value": 93384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975926, "uuid": "7e728018-99a7-4c15-b188-ac4e75161dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975926, "uuid": "f347aab4-344b-4e1e-9b89-04f8064aa158", "value": "star.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183e736c-52e2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750979147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979147, "uuid": "d65c440e-c8b6-449f-8c00-a8d583891093", "comment": "Malware payload", "value": "043706dbf24ad57eead5918fd4f9c1d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979147, "uuid": "2a65552f-2426-470e-9cfa-734273846d0e", "comment": "Malware payload", "value": "771a75a5513dee546eec345da1f7428fb5ca6058eb944e48f3bf771987d39c1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979147, "uuid": "c4a88bec-efee-4e93-a6ba-6616a19d3329", "comment": "Malware payload", "value": "719c7dc84d5721b4802218926120bb1ce98d7883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750979147, "uuid": "a74f9e47-3bf5-44a4-b0b4-f8c71d50f27f", "comment": "Malware payload", "value": "fd50d19cbdea737d61cf6b886e865b1517d6ede10ba57c2cd37d948d267de319e3dce0b39f9e1c1c24d2c0b6d0cec651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750979147, "uuid": "a0295e45-5e89-41f4-aa08-c6192b3842de", "value": "T1BAA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750979147, "uuid": "8aef0823-0d5e-49fc-9a66-e481c710b743", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750979147, "uuid": "e67367e6-9877-4d70-8031-85f4f23ca06c", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750979147, "uuid": "f7418c9a-f029-4605-809b-f0d4bb9273b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750979147, "uuid": "0b7dce44-54c0-4ddd-9a03-8357b4f50b11", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8fb9885-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975953, "uuid": "447af334-b579-4171-8847-73a07b748908", "comment": "Malware payload (Mirai)", "value": "58625ee27950239cf0caf6d53b983252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975953, "uuid": "9f9b11be-db50-4313-8f2f-cc3a8746fb21", "comment": "Malware payload (Mirai)", "value": "773f677a0b4d7691694088286c3198abea53e4432e3f8e2d8dcc702bdf1acc17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975953, "uuid": "bf929c72-9d35-47d4-a334-04b364f22925", "comment": "Malware payload (Mirai)", "value": "dbec4dbf1cb33ddaf1d1c596de47acd4b605f73e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975953, "uuid": "c7474074-1664-4eaf-b056-3af7db120883", "comment": "Malware payload (Mirai)", "value": "f2a3f9d744c89d519055c7bdf9eb09ab0ca416ad98420fa90782e8ff36d80615d2fa01638ce41ae311025648ae78a2b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975953, "uuid": "fe6dfe0b-3b44-41b5-a43a-93cb4ad464e7", "value": "T1C6A2D025D345AEF4DFEF9DA053C2D3C276E547C6278AC8E240EEBF016916042B789C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975953, "uuid": "03854a4d-4230-42cb-990d-d22998bbfe7d", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5FM4uVcqgw05VxJM:9RxsSVsMD6xiJJE5zRWNw4uVcqgw09C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975953, "uuid": "c07acb68-767d-4ec2-b9ab-c0493975b893", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975953, "uuid": "9bd305d0-4538-41db-ad46-96f35d13326d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975953, "uuid": "bb103fa8-96da-4b54-a726-c4c5b87aac32", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c021acb-5288-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1750940713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940713, "uuid": "46b99e1e-089b-46fd-95e5-bc37afdd5220", "comment": "Malware payload (DCRat)", "value": "14277159da5d9608867d4262aaf66279", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940713, "uuid": "a91a136d-f09e-419a-b777-c19f7687e7b0", "comment": "Malware payload (DCRat)", "value": "77487e24364782173be916875eb1f459ae2f9bb839b8203da130c45c9caa7e40", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940713, "uuid": "1b17a803-b06e-45d2-91cc-808a36c55f8b", "comment": "Malware payload (DCRat)", "value": "4a587872e540d54f179f992cf444b36bf5438ab1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750940713, "uuid": "caf2d105-9f44-4502-997f-49de83defdda", "comment": "Malware payload (DCRat)", "value": "f06335871045de2b04951294fe01d420473a6680da54ddfc7be0d1e51492f9d52ecfa741b63c1527f9b6df12003112de", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940713, "uuid": "7f6bd074-130f-49d6-9f2d-50d97b6360c0", "value": "T173B5BE2674915D32CE71663045E7037E5186D722AB52EA0F761F12E2A8177F2CBB32E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940713, "uuid": "077d6ca2-0ca7-4afc-bf0b-6c99f46bb87f", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940713, "uuid": "5db2a341-09bd-450d-bda2-0fe5138d2d4a", "value": "24576:2TbBv5rUyXV+9fDr1F7t0JtHfuuiRErTTP38ZyYY+HlUPejoneX1EjHrE0ruI3sd:IBJSc93I+/PYyPwlKVwKo0P3sY7S8YZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750940713, "uuid": "97b4adb4-7c7c-43c8-a0e5-c80c1d2e204f", "value": 2400435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750940713, "uuid": "fff07608-8cb2-427f-9191-664f5e30391d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750940713, "uuid": "a905e54d-010c-47ca-b7e3-49f56f8399f3", "value": "14277159DA5D9608867D4262AAF66279.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ab4bf8-5262-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1750924507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924507, "uuid": "9db8b13c-284b-44c8-b56b-422a047cd464", "comment": "Malware payload (GuLoader)", "value": "4f0e4cd24e1dfe6297a3d980e4fd5533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924507, "uuid": "28c7e2a3-713b-4f75-89d5-38f2c3632106", "comment": "Malware payload (GuLoader)", "value": "77f8fad67f52c862b94097fa1bb0ead403d246f4e6dc715bbfd0dad6383eb511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924507, "uuid": "e91d0c91-85bb-4435-ae55-a6401a3a3409", "comment": "Malware payload (GuLoader)", "value": "d370dc0a8fa4d496e339f88e6848fc2886ddd29b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924507, "uuid": "66f96941-e3d7-4dbe-9c1b-542926bee126", "comment": "Malware payload (GuLoader)", "value": "658a3edc59781a2e29a94a51a81f54dc542192bce50b3fc4e64eff00a832c4a3552afcd1817b3b983069e0cb4ff25205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924507, "uuid": "e3e9c435-4598-4451-beda-acb8f402ee14", "value": "T153F4F1122E050EB3ED3A9A73983710B74DB57D725E70558B0BD6B237C9B0206E92F47A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924507, "uuid": "7ae535b6-e908-4898-9958-438d78dcff4e", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924507, "uuid": "eb057b4f-2044-499f-a6fe-13f0a1d6c963", "value": "12288:2n2A7wOQd6ANIv2ZIWuCVhCIrgpAwU7zkAbq1bQbZE0KKWz5Tzl29:2n2TXd6GIO+mhjginkAbqwoBl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750924507, "uuid": "f37c6dc8-9aea-4117-8d07-6d0968d1892c", "value": 729716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750924507, "uuid": "7bcc300f-2296-4b16-9ba3-456fcb18b835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924507, "uuid": "2b9aa08d-8f7a-416c-b59a-45d531d31981", "value": "BWS_ZAMO.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab170ed9-529b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750948899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948899, "uuid": "54e71287-cdda-4989-ae14-326432a56eab", "comment": "Malware payload", "value": "bcdd5c1d88405f5d03ca4b9283403686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948899, "uuid": "72aad1e3-92a1-48d8-ae7f-bff4ce7590e1", "comment": "Malware payload", "value": "785c8b88c22dd93746e1224535201cb91f4fbe8be01b989b024e37ac6c394889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948899, "uuid": "46b5c5a0-daf5-489d-b878-d831ca3d3e60", "comment": "Malware payload", "value": "d98950bbd466ea9ea6bfe9dd1b42b7bc7e68cc70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948899, "uuid": "eac01fcc-a2ed-4341-a01f-7e8c37cb5313", "comment": "Malware payload", "value": "5d16ed9e87a29246459d8c323190ed9dd09ac893f933023ff5f9a9406fd2a53584caeb6d4d06761dc478e97c82d78452", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948899, "uuid": "dc4e32bb-f228-4597-97c9-4ecf1c7f8bb5", "value": "T17885D0D572419971D2520B34FF2AE3A87D2D7A3E2B3876463EF5CC0C8E6D29066291D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948899, "uuid": "0b1f5316-1e99-4f59-85d8-9bbeb2aaf92c", "value": "5fae3562d65c699bbac99ff256b12f49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948899, "uuid": "3355232d-0fcf-47c7-beb4-4e6779faaf9d", "value": "24576:QnY8m6hUrSNROa+3Y/Ffm6bUyyebXLLJP1dT8hjamMel5A8Lz:QS6CeNDfrbgeehja6AE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750948899, "uuid": "9c01e1eb-f3f0-45cf-8831-1862fe79e206", "value": 1849856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750948899, "uuid": "7331230b-ebf4-4efc-88a0-40b0a44619a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948899, "uuid": "10301a6d-99be-4a9e-b3ef-8dbaefe94315", "value": "RFQ for Material and Equipment Supply.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977ae298-5273-11f0-8bd0-42010a9c0005", "comment": "Malware payload (XWorm)", "timestamp": 1750931686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931686, "uuid": "f2a84263-5831-450d-9af9-b426dd144885", "comment": "Malware payload (XWorm)", "value": "77abe7f94a9edc8aa844946a7465a692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931686, "uuid": "1eb0642e-e8c4-4837-a161-666abc496131", "comment": "Malware payload (XWorm)", "value": "789bc81b1ed6782ea8295d01a38b4e072c9274d36c359ae936173d78a4b96a2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931686, "uuid": "8ec6bfcc-2d0f-4f18-89c5-214c9441e832", "comment": "Malware payload (XWorm)", "value": "012f513cc16a1c1f3e8cd03a80ceb4ab0d3b595b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931686, "uuid": "a8db26ab-4c17-49d4-9436-ca26a0c3284c", "comment": "Malware payload (XWorm)", "value": "aa0715fd72af3bdf61abd352500b89533e0d97d2e6ffad8298ebecb0cd5914b2d94eb0260d012b9ef7d4d2ce5030d42e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931686, "uuid": "96649ee2-9d63-4069-938a-ce2090185f6b", "value": "T1C9B4F11862A6EF51D9AD0BF80921E13113F6ADDEA816D3074FDAFCFBB8103583591687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931686, "uuid": "e5363877-b1d9-4b44-91a8-f8656dc1032e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931686, "uuid": "d2cc5a1c-9d6f-4072-b8cd-0f956ff582df", "value": "12288:i1a1/nkJsly69ihPm9I9+Yyocy00uso+AG:PFkJslyGsm90+n0Q+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931686, "uuid": "fc7c1370-8046-4c8f-a693-690fcfe8efec", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931686, "uuid": "1ba01707-24de-444d-84f6-8b2269cfea22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931686, "uuid": "1f0e6989-b6aa-434e-b558-dc72192e1a4b", "value": "NEW-Order-2025-06-25-pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd11dc2-52d9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975670, "uuid": "2a9e22b9-5808-4b2c-90bb-eb1b9c8c4f33", "comment": "Malware payload", "value": "f092e1e9ba87154f427fcc8489c65982", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975670, "uuid": "fbc5c5b1-48f6-454e-aba4-b1c51bc65797", "comment": "Malware payload", "value": "78f3fa350281f474720daad91455ee9f545af81af44c84cf426e46d908c1f0e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975670, "uuid": "7dd17dd0-83ea-4f67-9b89-81e0a98cc4cd", "comment": "Malware payload", "value": "94aa9f941f74f68fc55433fbf0b31810a56080ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975670, "uuid": "c5185b45-28ee-4a95-a015-7c96125c6219", "comment": "Malware payload", "value": "62664f125716998e010e73a3c6d6d3ca23891dac2aaa1402f3869d233a87d650ff81bd1bf03e3c789ac8e32aae447799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975670, "uuid": "989e838d-ebd0-4153-9138-6f8eef7c5cc9", "value": "T1B5E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975670, "uuid": "f93ae6fa-c8b3-45b2-aa8d-6257dc16cb7b", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975670, "uuid": "97447d73-ea7d-4f9d-8774-4ba018cb9fed", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975670, "uuid": "5e084c67-a23e-4a44-8b0e-7e042705d3a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975670, "uuid": "4a4703ef-3f20-4370-97d3-e9c45f39c660", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e8c121-5248-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750913166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913166, "uuid": "402614ed-ae30-4a7c-b191-70565e37ccad", "comment": "Malware payload", "value": "9015036d519233aafa5f5c364ce2086b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913166, "uuid": "b7542990-d583-4237-9891-ab09799b611d", "comment": "Malware payload", "value": "7984f3945d3a8f5bc56e9131737ba0a791ced2c161bd56b53617a8a2b7146a77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913166, "uuid": "83a6031e-5e27-41f5-93ff-47427af21223", "comment": "Malware payload", "value": "8247b9c6c74dfab9f27eac2f5ba6d206e115f6be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913166, "uuid": "6b22a322-266e-4f0f-9689-b2c74a844f9a", "comment": "Malware payload", "value": "af781818d6b25d722dd71c3c137882fddf71a451bc82201e61cf515d08cccbd1b08611237a6d54e92d0a096941f512db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913166, "uuid": "aac1a7a6-440f-476c-8cb5-2f5779914858", "value": "T18EB402018F881F87C5AFCD750A2E167311AEDD9F46CAA53E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913166, "uuid": "aaed3164-244d-477a-8ba9-ac3b98d4f759", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913166, "uuid": "3dbe72c2-2229-4145-aeda-437078b5c17f", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913166, "uuid": "1b768061-a5c8-40d3-a4fb-73eb3d3bc6fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913166, "uuid": "b7e47484-1dd5-41b5-a868-72af25b8d654", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9af101b-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975955, "uuid": "cfeb527f-0eea-45fe-b629-09dc7306ff73", "comment": "Malware payload (Mirai)", "value": "a6a2e0a546567269afa35c6eecdc9fbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975955, "uuid": "f0973c2f-117d-41ad-8a97-96c49287b0ff", "comment": "Malware payload (Mirai)", "value": "7a8d7281be3a82970674eefe5fd380e2a0ba13bcde558d8ff26bf06d15a21831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975955, "uuid": "b2c6e099-6bea-4a95-8fa1-2f759b23068e", "comment": "Malware payload (Mirai)", "value": "749a4499943d55acefaf0f353c102c11eea21b20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975955, "uuid": "9d88f168-3b5a-4073-88df-2b8fb4b78af6", "comment": "Malware payload (Mirai)", "value": "2c3d242e53829375ec5be645cb6e52a1ea43e0d50a31d55a1f25f64a72f0c57dda25fee78b84fa1aefb1041dc0f850da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975955, "uuid": "ac081d1e-5860-4adc-98c0-b55d20b28572", "value": "T13E63F981B882663AC2D1137BEAAF018E3354A7D8D2DB7217CC251B657BC651F0D53F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975955, "uuid": "02e43fc5-de10-45f4-9e11-e25fce09c07b", "value": "1536:6ZjqjDHrHDmYrIG5VT4xJ2Jj+1qrSNymeZW7yrklfOP:6ZjqjLR3GJNdwj44P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975955, "uuid": "24087a36-f9a6-445a-b7f9-d5fe3edb1773", "value": 68324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975955, "uuid": "ed2aa711-4ae3-419e-a873-35a956515e19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975955, "uuid": "99f22eca-0137-47d9-8ac0-d0e9ccde97b2", "value": "star.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca960b4f-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750914162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914162, "uuid": "b38b2dc4-0bd6-456c-b016-eecb2db67c87", "comment": "Malware payload (Mirai)", "value": "08c1f482416985c6b0c3ea78dc2beac8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914162, "uuid": "6a8b8966-7ead-4ef2-8312-b14b0733877d", "comment": "Malware payload (Mirai)", "value": "7b61b7a04330092c7dea3f09e5eb02a27ca64ec810c868c9b051a00c7d770050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914162, "uuid": "9db027ef-fece-46cb-a4f9-734c7ce9854a", "comment": "Malware payload (Mirai)", "value": "e5c1a8f5d53bd2f810628665ee531bf3ac6568dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914162, "uuid": "e72cce9a-8989-42ef-81c7-bb44935bee2e", "comment": "Malware payload (Mirai)", "value": "cdf53ba266e69704b29e407390f795dc5243808f03d8e112da30fece9244e6c028add17c9f2cfc337ed634f7088eb938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914162, "uuid": "dd3e4a43-ab18-456f-9f15-6566add11c3d", "value": "T16BC35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914162, "uuid": "c7f2d773-42de-428f-850c-2d96766dc2c6", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHonrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuInrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914162, "uuid": "84004076-a359-4de1-94f1-dcfbb6b70724", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914162, "uuid": "4817da2c-092b-4776-b446-08170f0afc27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914162, "uuid": "401fce5b-19e8-45d8-88b7-ee0a109b5e41", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb16961-5258-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750919882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919882, "uuid": "2e6dc564-c37b-4fce-bc8b-4a07772e13e6", "comment": "Malware payload", "value": "2408cd19e15bebed9d55e8134ceb7bf8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919882, "uuid": "93d2af22-85bf-4916-aadc-c15346267670", "comment": "Malware payload", "value": "7e44a3677b0455ab482ff7fd0f1420d9f726c682b3578c81fcbca1b7ab68f556", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919882, "uuid": "3ab05796-eed8-454f-8c51-7605961685ca", "comment": "Malware payload", "value": "9ae093f4215491c57a9019f79e8c0d8faa01c421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919882, "uuid": "cb19077c-e35e-4d34-bfb3-38a095c7798c", "comment": "Malware payload", "value": "a21337fb813d31028776db9cc8ffde8a4057c724ffa02923e27a4e4637e757672fa0ba3e361c1e583e677539b4aabc69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919882, "uuid": "8161fee1-9966-4688-8f0e-269382f81423", "value": "T108A41212E290D8FEC4DAC070469FD27BFD7A7C544234BC6B6198F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919882, "uuid": "d66e374e-84bc-4978-8cbd-6fbdf9eec3b6", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750919882, "uuid": "fba4c608-f8aa-447b-896a-8ee4b3f0e1d6", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750919882, "uuid": "5288eb23-654d-4774-bff7-2a9298420dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919882, "uuid": "c02d86a8-2139-4c1e-a64a-b534e53ab839", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce6adfa-526f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1750930138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930138, "uuid": "418a1c92-a5af-4d7e-9b44-2929bb87d7bd", "comment": "Malware payload (SnakeKeylogger)", "value": "eccbca4c4a90bc739e1aa50f5ff29b16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930138, "uuid": "9908ae30-ec36-4919-ae85-fcd25f2a4dad", "comment": "Malware payload (SnakeKeylogger)", "value": "7e545a76c16dee6d24d3e86c6667c07bcd0f76064f232463b58fd4ec6d930090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930138, "uuid": "5e80e303-51dd-468e-981a-ccd726000299", "comment": "Malware payload (SnakeKeylogger)", "value": "8b07207c3eeef77e052bdbb1d83f87992117bd93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930138, "uuid": "741b462f-bee7-4945-950d-b5ada516230a", "comment": "Malware payload (SnakeKeylogger)", "value": "f5997cc274743ab7fe2043cf4633d5a9c00f53e29513bcd2f1b7cb4f975bd19ba4ecb66872b883835b7644f1f398ecbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930138, "uuid": "6ea03a67-db65-438f-a958-aba25eea6350", "value": "T104F4022C23AA8B22C6FB17F50501D0B2537ABDDE6400E35A8FC66CDB3D667E2450A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930138, "uuid": "1271ba11-ba75-470b-b3bf-84f90e49422b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930138, "uuid": "6cf1f033-3910-44a7-849a-b213c2b28665", "value": "12288:+grcnbxokKnO+ion6l7fgEG6HTWEjNeosiIrk1EhIpQ0jMneGlej:knb+kKnOD06NYYy7sIQ1EhIpQ0weT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750930138, "uuid": "c2901160-35b2-4e54-b30c-e00e34c2c159", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750930138, "uuid": "a9e612c8-ed9c-4078-a9b0-61ce79e7aee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930138, "uuid": "8f974fbb-37db-4c37-a5e1-f33ae5244b2e", "value": "Makine Fiyat TALEP _POLITEK OTO BOYALARI San Tic000580360 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47865734-52dc-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750976649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976649, "uuid": "d6671034-1819-48c2-b06d-0915bb57b6c6", "comment": "Malware payload", "value": "4b10b928a11789f396f3f64e392842ce", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976649, "uuid": "2ee56e41-d108-42f5-bd3f-d491a745b014", "comment": "Malware payload", "value": "7e5f9a2d25d222500d074467150a88c278c24ad2948341f150d6f45c3fcedbcd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976649, "uuid": "dc0ec2ae-a644-45cb-9053-849a08cc0ac8", "comment": "Malware payload", "value": "d5f11117d560ad7d39d8bb39b297b92fd97bd4bc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976649, "uuid": "00f8bb69-319f-4c1d-ad19-a97290015bf8", "comment": "Malware payload", "value": "76d34e1d5baa9ee0fbeaa2316f83ddc866f12f35f6197e3b16d8ab46bada5911862053c85614f6d152d4e0a37d73f81b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976649, "uuid": "d2ddcd83-96e7-49dd-acc3-50462ad3bfa4", "value": "T10822CEDE05D87274D6E3AD257F624484D61197D1ACEB3BE8C98C8C7C90D8B5FB288E21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976649, "uuid": "20e9527c-a243-489d-a788-9cb9502ce2ad", "value": "96:JXcqBrKoRhpRTaD5OSLKjWXcZprKIxBFGPMCPpRT3e2S:JZBrKchpRTaDA/rK9pRTuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976649, "uuid": "8480a0a5-2743-4022-97e3-e17cab2d6f46", "value": 10578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976649, "uuid": "6d355a9d-abcf-4050-bb2a-7e2e259dcb44", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976649, "uuid": "150bf7fc-19a0-4b25-8b86-ca0ac3d3867d", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdeff13d-5248-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750913282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913282, "uuid": "efa43f79-16a1-4a10-9c45-624be2784df0", "comment": "Malware payload", "value": "a49e6761e7fb05c2c27e94eab4de4cb2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913282, "uuid": "78cfa645-42ec-45b2-8ad6-826771dfb23d", "comment": "Malware payload", "value": "7f229af121fa15e50f7e754df32e4346ce1761b4575965d552e5e5e35b36c387", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913282, "uuid": "6019d711-c8c7-4668-b368-ac41ebfd91ab", "comment": "Malware payload", "value": "2c01cc125bd23a786ba99b4229c029f040cf2921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913282, "uuid": "3badd725-7936-4581-8f05-26fb7f257e79", "comment": "Malware payload", "value": "fb40dd55665a0cb5d97daee0a9ea0080965f3707b1554193bbec5c9012b0df24b1a53a847037eaf06b720653f1260360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913282, "uuid": "9c1f2a1a-2865-4734-aaed-7e71f62ecf81", "value": "T1DFC42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913282, "uuid": "b350c2bf-0049-45c6-aafd-bc90e8f8343d", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913282, "uuid": "4f534235-5dc1-478f-b66e-7c5c023502e3", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913282, "uuid": "4a8785ae-a3a6-4460-ad0d-478fc12fda9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913282, "uuid": "cdb8f116-70f1-40d5-a321-2b4b19c1591d", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a3eeed-5246-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750912320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912320, "uuid": "c3079698-7e14-48b0-93c3-9e021f557d41", "comment": "Malware payload", "value": "9ab1755673b862c2ab37df08045d4f7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912320, "uuid": "fc303240-478b-4a78-8d66-53bf767304aa", "comment": "Malware payload", "value": "7f839d0b5315c90e96326052c22941d859b2980affa170d4bc41c37b672e9c65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912320, "uuid": "e3125f53-cace-4a2d-9ed2-4be5c773b9e7", "comment": "Malware payload", "value": "12117acf42957992dc89d929d0ee8e014c0c606c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912320, "uuid": "5c24fc3f-ed19-4595-a44c-89a001c75be2", "comment": "Malware payload", "value": "a94b23093b5b8191a34e73de31902ab80bee2be76950bb0c1382a7284384d785e8f387f0e3a631922f82de962cbece0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912320, "uuid": "cd5438ce-7979-4706-b301-6caa5e759fb8", "value": "T1E2B41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912320, "uuid": "e926fe57-694f-40a2-87f1-a1033076313c", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750912320, "uuid": "dc8cb1f7-40da-4025-be97-c899f5e15256", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750912320, "uuid": "b0de067e-12e3-4349-81e6-dae2f4ec7180", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912320, "uuid": "d0686112-d609-4670-be1c-4611659edce7", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1ce33e-52a4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750952662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952662, "uuid": "9bd39c82-d324-45e5-b8c9-ff439bf595e1", "comment": "Malware payload", "value": "a700692fd5d16b2e263d74a868bf5694", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952662, "uuid": "64693528-19db-495e-9ca1-4e422f670cfc", "comment": "Malware payload", "value": "7f88fd57ec2b8b0afa36b9602d4133310e3a8577c96379c3223d69c577560057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952662, "uuid": "56862ea7-beb8-48c7-bdbc-e3486068edc1", "comment": "Malware payload", "value": "294fdd0715c4e4a56912bd57527c884fe8f785b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952662, "uuid": "4434811d-643f-4915-8ef5-7380c683aa19", "comment": "Malware payload", "value": "d9902e9be5170906b5207090c3f073f717202d68a9175beef52c429356fd0b65a5e63601ebd99dbf2b433375da9d6d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952662, "uuid": "a3c9fe9a-7b44-4b1f-9fe7-c2cb1e75e5a9", "value": "T105558D0733A2C0E5DE6791F2C6299232D77278101B289BDB15E06D2EEF93E915F3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952662, "uuid": "92475d1e-bb0c-4591-a41d-5356590a4b0c", "value": "a649e6750bcf2911044dec744c57f40f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952662, "uuid": "ecd5e391-d464-4ff8-be70-996768eea3ca", "value": "24576:DUNxvqF6FGYJf6yjNQpNONZNlTX5PlGPgquLEIWxUc7N11QaSYx7GqVv:DUNxvC6FGYJf6yjNQpNONZnTX5PlGPgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750952662, "uuid": "5160f24b-9a34-4392-91d5-71dbca4c2680", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750952662, "uuid": "b6c7e9a0-7400-49f0-b48d-c7c73f432734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952662, "uuid": "a29973c8-0a94-4591-b220-d253debf9277", "value": "AudioMapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19091b88-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750977859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977859, "uuid": "73d6e5ca-83c2-4123-8aaa-ba0ea2c2f591", "comment": "Malware payload", "value": "0f4816e34c23544756c621e5e5a5b962", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977859, "uuid": "96398a9a-a8cd-4148-9032-c9a29785a2f5", "comment": "Malware payload", "value": "7ff0d482e6a26acaa8573847d62dfd8b396e796b8f8176dd4af0f282093e6e72", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977859, "uuid": "9bddc1f8-cc53-47f1-8971-d16b2dbc3da1", "comment": "Malware payload", "value": "2b802a8355e67be513e88b33eb5ace4224c57b88", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977859, "uuid": "302ab5e8-e583-4513-9ad4-664718c47263", "comment": "Malware payload", "value": "443a7f33d17b138deffe17a1508749e2bc5d844df02d7ffa70661d926aa275ec2d31545c6cb29f27225a5836bdc651d4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977859, "uuid": "3e992113-a0f6-4571-97e3-92cfddc85435", "value": "T11FD0A98E30D823D30028CD8060E241204E03D0F081B07B016788C8B0E8CC6C3B81CE0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977859, "uuid": "4afa43ce-9c60-48e0-8bb7-1e6fd3a6e343", "value": "6:SXxeqTKjBMK2wv9xeqTmGNIvBMm+wb5xeqTagBMLKwmFW:VCiMvwvSCxNIpMbwb2CaqMLKwGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977859, "uuid": "958a0719-ec25-4522-8b1f-b9a38ae34ac6", "value": 249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977859, "uuid": "9537ab6d-38eb-4fd0-b325-5a8195443849", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977859, "uuid": "19273b03-5288-46e7-a95c-fa2cb3ec8e69", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0e919e-5270-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1750930509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930509, "uuid": "6f7c5a1c-c9bc-41fb-9221-0c0283937613", "comment": "Malware payload (ValleyRAT)", "value": "29adef488561912aba8932b4001c99a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930509, "uuid": "1ca9377c-f26f-4294-b312-646d227f2035", "comment": "Malware payload (ValleyRAT)", "value": "8051b471e1ab06553b0e7397f289612655d69e5df42c70801c3bad1c7ab20471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930509, "uuid": "c8631b05-09e7-4027-90c0-00cb97411b35", "comment": "Malware payload (ValleyRAT)", "value": "c671a55ee2ba68044a8b14ee6b4a756e92f6b489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930509, "uuid": "1aaf17eb-6105-4983-9dc1-bc1bef7a0e93", "comment": "Malware payload (ValleyRAT)", "value": "cd19bee6180098ec92ce8dbf9139c5ec19637beda0ef776de1eec8f75aac2d10dac52fd57a8d4e81a751d55539b7ab7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930509, "uuid": "687b4052-8c93-4587-9a4e-5a2912be97c7", "value": "T1CDB73312F287D57EF15A4B3B05B3F52894FB6A246513AD9693ECF0A8CF321601C6E247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930509, "uuid": "a8d3008f-37dd-4b5f-8f5f-66a2794bf006", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930509, "uuid": "fc1dee96-7bf8-4a3e-8218-eee43493de42", "value": "1572864:W05u/mC7zwVKOxB5wvhBRKMaejnuhVry:W0oT7K5wzJaOee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750930509, "uuid": "e5e94916-9827-4c5b-8278-82e983de3e63", "value": 50722466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750930509, "uuid": "402daf87-63cb-4ff7-b490-dcb7aaafffb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930509, "uuid": "cfcc1fbb-91e5-4e49-997c-3277a8790767", "value": "29ADEF488561912ABA8932B4001C99A9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a66ffe4-5231-11f0-8bd0-42010a9c0005", "comment": "Malware payload (PureCrypter)", "timestamp": 1750903210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750903210, "uuid": "fbcd0c61-4e36-44ac-8231-791edf78a9f3", "comment": "Malware payload (PureCrypter)", "value": "2852b882d8412a5178b84de730f3fdbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750903210, "uuid": "661b03d8-3cf2-4214-b458-15dd7cd227c1", "comment": "Malware payload (PureCrypter)", "value": "818f25f1096a4e8d508f050ac2a2683982ac9cc2176c33614faecde87a4600dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750903210, "uuid": "bcb27194-e2cc-4f99-87ff-65c9219ab4fb", "comment": "Malware payload (PureCrypter)", "value": "d0f0812f46438911901627075d30530c8c7187c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750903210, "uuid": "47718579-f813-45a2-800d-98224dcceb62", "comment": "Malware payload (PureCrypter)", "value": "622fd5361ed84d1ba57520c40355e4095380bc6c0d6eaf00ddd947f15ba7745d27471a4f1f40fa7731789f5be0ceb91c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750903210, "uuid": "ce638562-9957-4ae3-8f51-5ef897bad748", "value": "T128449427BBAD571EE2694270B071453087B0EF5B6341DB5A75C8ECAF0862B4CAE413F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750903210, "uuid": "0b674b39-f5e4-4b5c-99f6-5e43c7d45a16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750903210, "uuid": "a505e638-797f-40cd-b0eb-7617bbefe67c", "value": "3072:tT9LYTV0enEY1lsKqEzDWCkJuJcbCp9758HsdXjjZl5RRO876pDoAkLOojapitwQ:tTJYx0enbxkJDbC775ooZ2z0KyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750903210, "uuid": "54e98f08-b461-4dcf-81cb-a7c4e3dcac20", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750903210, "uuid": "7f57cd05-5f56-4a9c-bd78-3fb92f6ee89d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750903210, "uuid": "c70e76bd-3fce-44af-8e84-fe5007e0996c", "value": "r6252025546789ARRIVALNOTICEHBLSCAN_pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dd5e4e-52b4-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750959741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750959741, "uuid": "ad82e39e-b412-4887-b3d5-38d5e25afb7c", "comment": "Malware payload (RemcosRAT)", "value": "b13eebd55c0e129b97cfb16b387dc121", "object_relation": "md5", "Tag": [ { "name": "cirugia4k-con-ip-com", "colour": "#DE4F2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750959741, "uuid": "224af3b4-dadd-4c48-8476-bf9bb3fc460f", "comment": "Malware payload (RemcosRAT)", "value": "81bd5ea2395abf6ca7e0959d84a2ecc797c24f789ab18afc6eeeea69c41a2457", "object_relation": "sha256", "Tag": [ { "name": "cirugia4k-con-ip-com", "colour": "#DE4F2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750959741, "uuid": "2eb5925a-146f-4b68-88bf-9743190c80cd", "comment": "Malware payload (RemcosRAT)", "value": "30da55ee747359debe1916c706ed8b524f742bec", "object_relation": "sha1", "Tag": [ { "name": "cirugia4k-con-ip-com", "colour": "#DE4F2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750959741, "uuid": "2613bc52-3544-45b1-98cc-d98e01830d96", "comment": "Malware payload (RemcosRAT)", "value": "139db015ae8386583e1edf66651ac874b2048301a72075722c69d90ea9baf6382a49db60055e4aa2eea01e1a9225bcc9", "object_relation": "sha3-384", "Tag": [ { "name": "cirugia4k-con-ip-com", "colour": "#DE4F2E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750959741, "uuid": "5dc61ba2-7f4c-45b0-a0e6-7b2d5038be2a", "value": "T1DD3523A6539BD631C27E833A00E67F0D4AACB4F6878EEB990D4C6146F453BD6A407347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750959741, "uuid": "e0c333e2-932f-44d8-8656-c651aa12da9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750959741, "uuid": "86da9647-3d86-44c2-86ca-4d75dcf31d8e", "value": "24576:b0VSe8kjzKKNosJQKLv+SmhuRZdrsx5Y4t1DfjH5tXdz+B0f:YTNLNosaa5fRLrsI4vjZtX8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750959741, "uuid": "de0b44e8-2c75-4980-94b1-acc7a40cbfc5", "value": 1155584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750959741, "uuid": "0c34b2dc-77b7-4b63-94f0-a1a44c21487b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750959741, "uuid": "60c631c7-756f-4d36-aba8-1b18593412fc", "value": "81bd5ea2395abf6ca7e0959d84a2ecc797c24f789ab18afc6eeeea69c41a2457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a85a4cb-524d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750915290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915290, "uuid": "baf1b370-e962-45c6-8b1e-7a8176551413", "comment": "Malware payload (Mirai)", "value": "2d7ca0fd278a76a30ea108125af5102f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915290, "uuid": "0f9f572c-e95b-4f55-928d-07ef92cd6f6e", "comment": "Malware payload (Mirai)", "value": "82386ef0c0e7604676a4d86913b520d02c8ae6143213ecf3d6b13af465b862ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915290, "uuid": "0437aa1d-4a15-4136-bfcd-68c003b8b3c1", "comment": "Malware payload (Mirai)", "value": "cba1a704b8bd19f6e51bca61f570de9d147f2a16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915290, "uuid": "26666603-9339-49cf-a6a3-e7701cf61ac6", "comment": "Malware payload (Mirai)", "value": "b589f6409d2816210184aa7ad4e954059b5486fcd4e13f7f81d14b835c2dac46105dd018b004f7cda4dbf7dac560bcc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915290, "uuid": "d8f9ecf1-73d5-4c7e-b95a-10af78faa788", "value": "T1E643F948E60791F4DE072D30515BF67F8B31A924C970EDAADF88BD15ED33A12900B7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915290, "uuid": "112075d8-27d7-4def-9f61-5c5072793805", "value": "1536:Zh2s8gWSPs5JDhMaHxVUK2huGGnGWlhIgoDz:ZBYsTkDvXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750915290, "uuid": "daf84167-f404-4e23-baed-93cf5831f1b3", "value": 55492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750915290, "uuid": "972a7fd2-0c4b-4103-8d04-985112c8f3cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915290, "uuid": "466dddd0-8d5f-43e7-9468-5ace132fb8d0", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03278f46-5258-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750919841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919841, "uuid": "49a03bab-5235-49d5-a872-0200548ffe12", "comment": "Malware payload (Formbook)", "value": "e92a3da0a13e3c5ccf6a67fcb98e2039", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919841, "uuid": "9e0f9392-351e-4359-b427-3f139787716e", "comment": "Malware payload (Formbook)", "value": "8240717ce45dad96e990f6cfd500228252adde60ae7ba07ac2357aaeb8f11889", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919841, "uuid": "3b3cb7a9-8309-4163-a7a8-6d0bc38fdfb9", "comment": "Malware payload (Formbook)", "value": "b23f8fe81264328c6638697054cdf7c9d9af41e1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919841, "uuid": "35cc0cad-95e9-43fe-a078-792bee415706", "comment": "Malware payload (Formbook)", "value": "eb3fc4a4d7faefa8b51d4d576867e9222f2e8aff1ac9f1413f2593afcd3051baf5813c8962fdb97562bc267b244d829c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919841, "uuid": "0e81d468-d411-4c9a-9882-ae493f416c00", "value": "T1EB84123B59E83C3DC68D85EB465B3930F5854C00A538B929E11B8BEE2D9C16E09154FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919841, "uuid": "ae50d8dc-3983-4598-ab2d-bab55be27a58", "value": "12288:r54rVxjEzbdEjVIbbuuqhgS+fl2wA++ZrQ814W:mrIzb2ja2uqeS+fgwA+0rQ8aW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750919841, "uuid": "dd0162b4-f53f-4d60-9830-34d2c81b391d", "value": 398151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750919841, "uuid": "e16ecdda-4c7f-4a43-8c1b-97c610590c58", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919841, "uuid": "77b5e322-7dae-4a29-9b68-b8757eec8d0e", "value": "Boeing Purchase Order.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006e4194-5249-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913394, "uuid": "7b4642de-6366-4683-90b7-56e2ca9853ee", "comment": "Malware payload (Mirai)", "value": "77feb57340c960085a8d795a75d2a541", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913394, "uuid": "c37a8a00-580f-42d5-bc83-ccb4c27e27d6", "comment": "Malware payload (Mirai)", "value": "82e6bd3887c84122633bbc24d3dff087f5f8dcafb59e036c38235ad09e0a7617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913394, "uuid": "589bf733-b36f-4a71-a106-1bfe345b7de8", "comment": "Malware payload (Mirai)", "value": "3b5984382be1d3e5c8a9ed24cc4313a663fe4dd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913394, "uuid": "9645d790-8d67-47a3-8935-51d28eb5d60c", "comment": "Malware payload (Mirai)", "value": "78ff4bcad3b03d09aac72347a13bbc58ca5a8dd023bc6da8ba7b92ea73948360d85c0beedfc0c0a5b0285e679af4f7e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913394, "uuid": "6e910c44-a2d9-4477-b6ae-8fd489c53076", "value": "T1A3D31A06B31C0947D1A72EF43B3B27E1D3DF9E8120F4E644295EBA8992B1E321546DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913394, "uuid": "e09fb936-836a-4b55-a734-423414de8c10", "value": "1536:Mrl8sXbqjsnuq79b5DGKxvFCTQd+NjgzH0SK0mn5UFZ0RqmomfRRAdAWfCZR+sBG:6825xNCTiCs0hjnskYypk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913394, "uuid": "aaafe831-3d9c-45ec-bb65-9a38550438fc", "value": 141332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913394, "uuid": "a9035b0d-3275-4bad-9e67-df8256454142", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913394, "uuid": "0edfab9c-596f-4d53-a561-1752ed256bf4", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7ec854-5272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750931265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931265, "uuid": "f3c601d0-f27d-4da3-9526-ce7e92f9c7cf", "comment": "Malware payload (Mirai)", "value": "b82a49878e1eb4676fddc7a260f04e55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931265, "uuid": "7822764a-1bce-4f81-9d85-a2c01607a90d", "comment": "Malware payload (Mirai)", "value": "839d3b20ae143395ca13cc513a0db880b0296d1a5b8cfacf35a17831a64ea926", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931265, "uuid": "d3c2198b-6073-42b5-b4f2-d12b25b80174", "comment": "Malware payload (Mirai)", "value": "71d7fc89655d6fbce3c81ac43a113752fba310c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931265, "uuid": "a3d63de8-3b9d-419b-907f-4e6978704d79", "comment": "Malware payload (Mirai)", "value": "b879509d5a4a9dfd4988152b07dcf1df361776229485dd89d10097025028f27255f5668f617681bd1c76c362963bfac4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931265, "uuid": "ec7dd599-9e6e-41eb-b575-864fadce678d", "value": "T17EF316D7F900DAFAF80AE7374C5349097270F7A149921A336357366FED3A198142BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931265, "uuid": "7ce10f00-5a2b-40fa-9596-618a55306d1c", "value": "3072:TRZ6dEFqX3QeuacWjcW0JcWcBXbJLe08F2e7RDVdU4Lh39v8eIr9:Tq3QeuacWjcW0JcWcBrJi0He7L7v8eo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931265, "uuid": "128313b5-730e-4cc3-8aa7-041f6442ac98", "value": 163516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931265, "uuid": "d3cb06f8-3ea2-41ce-9be3-91b6bead5121", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931265, "uuid": "323b0991-3a0f-447b-ba05-cfeff27bd874", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d764850c-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900869, "uuid": "c757e32a-c197-4526-9962-fb31e5e8f84c", "comment": "Malware payload (Mirai)", "value": "e2ec555c03a35575bf600e67bb75ee12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900869, "uuid": "7e53802d-bf9c-4516-940f-3ab2147c0823", "comment": "Malware payload (Mirai)", "value": "842d231363c9431e93a81b68c3028142f2aa2a06dbab5f940e8d38522ede91ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900869, "uuid": "0abf7b73-cb5e-49b8-9005-aa0532737e49", "comment": "Malware payload (Mirai)", "value": "9116b8d36f3353ba6e12521ec32244fbf8c79427", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900869, "uuid": "d40a782e-678b-442a-9f1e-3b5dba856d2a", "comment": "Malware payload (Mirai)", "value": "b1d8fe48eda33a6cd6f77060b54d1d98b1f5b3c2d4a9a35a16f4ae610a4ddaa5c23575bf92827d439e32dcc071f8907c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900869, "uuid": "2826cb6f-ab79-460f-9287-6bf49f67cb81", "value": "T15434956BAF20DB19F658973106F76E34C35A22A32BE5E649D15FC6002E3235D1C0FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900869, "uuid": "f98c7fcc-6f98-4efa-8d3b-817e941b88bb", "value": "6144:yoWpW438c2PgrUcilFxBPYZZuFb1lRWjiEzCws4:YpW438VlFxBAHiEzCz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900869, "uuid": "67ecf2b8-b09a-4c60-a8f5-2cbeb0864d2f", "value": 252617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900869, "uuid": "cb791f3b-1119-4f6e-95c2-248c83d6ed1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900869, "uuid": "a8c2f847-f230-41df-b697-ca1261a675ae", "value": "SecuriteInfo.com.Linux.Siggen.9999.19634.13309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a600eb-5235-11f0-8bd0-42010a9c0005", "comment": "Malware payload (GuLoader)", "timestamp": 1750905022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905022, "uuid": "f4281816-d049-4056-8b49-48c7b94df021", "comment": "Malware payload (GuLoader)", "value": "78aae83bbc09f4697bf47dbc0cd5687e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905022, "uuid": "87ae9a86-29ba-440e-a05a-b22af48b41af", "comment": "Malware payload (GuLoader)", "value": "84c868874f298528ad5c30d50d7d3ad53abfd401d95ef14d1e7ef14fef639971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905022, "uuid": "ac5b6204-a59f-488f-9e51-04b9913c2cca", "comment": "Malware payload (GuLoader)", "value": "9e951d464bad00e0a86bebd98d23b24ceefeb1ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905022, "uuid": "677619fd-5b13-4c42-8b4e-058be43d63f9", "comment": "Malware payload (GuLoader)", "value": "2f49b5fdf0ee60b6a26803faf3ff5b45920eaad37cd4c3f23e2e3c038d735b081d397c0dc70983553ea68872521805b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905022, "uuid": "fee7c70b-7ba5-4e69-82b3-2894bb4f1c20", "value": "T1F9055A321C6A6911FBFDC93178D472261A81BDBF9DE85B4EE54179CA2A3B8CC41F4630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905022, "uuid": "bb2fcf90-3187-4996-a9d8-df0488337806", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905022, "uuid": "488f798a-6d97-4e67-9481-3b08d7c27a31", "value": "12288:1MwL0t3nItIWZDqowLd1zTpVLswWNOyfEP6Ut:1MwL9tIWEowXzTLLswgODt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905022, "uuid": "af1dab1e-8e23-4c9d-bd66-9aa0aa677d1b", "value": 861576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905022, "uuid": "182705ce-e50d-4faf-a58e-16f3457d926c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905022, "uuid": "17c1f637-22f6-4892-9325-ded4e3aefe6c", "value": "rHSBC_Payment_Advice_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f72ad55-5243-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750911083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911083, "uuid": "f5569391-701d-4d4f-8d3e-c5f249fbfee4", "comment": "Malware payload", "value": "898144df3b8748a1baff8021ed11a387", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911083, "uuid": "0dd3c076-bd43-48fc-9b92-21f5ae1b0bf7", "comment": "Malware payload", "value": "8646eda654b66e1d3abb2f7c4f6a9a52278e16ef35d59a287050c3ed325e8fdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911083, "uuid": "de7508d6-2cd5-4553-aa18-8a411b629c24", "comment": "Malware payload", "value": "7e59f7b64faf62715919516bcf71976009704869", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911083, "uuid": "fce9c69c-d3eb-4b6e-ac63-d6d14352e1e1", "comment": "Malware payload", "value": "b722f6bf7dcce48302f37bb4a793a3575170a4c8e0d871bb34e16a2e5f5763a1e11e9994a004956230932e829d13c0ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911083, "uuid": "67fb5f4f-87f6-4828-83e4-8ac915fddd76", "value": "T1F2B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911083, "uuid": "ff9445c5-f1c3-44f4-8c98-aa48ba3dea31", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750911083, "uuid": "2c5dc5b5-1e3c-413e-b304-2e6dede86647", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750911083, "uuid": "612dd779-96b6-4218-9d73-25a5959eb258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911083, "uuid": "8fa746c2-d3fc-4ec0-a025-e15d61f8aef5", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ce6c302-5274-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750932098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932098, "uuid": "762a9ca9-a8e3-403a-af68-e23cc3b1dcf7", "comment": "Malware payload (Mirai)", "value": "01bcbd781b8d6a8144c39c3f95270007", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932098, "uuid": "0f5535f4-21cc-4fff-af74-552858380e2f", "comment": "Malware payload (Mirai)", "value": "869c89e75998e5e4bb9fa024316806afd3ab373b744c37d559b67ce267e26cf6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932098, "uuid": "17cf8b1b-1f76-4449-be2e-cd5125261940", "comment": "Malware payload (Mirai)", "value": "66f03874799f40b05878dd312801d62463579db6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932098, "uuid": "cc2180f2-c7ec-42f6-a0ca-87efcc3323af", "comment": "Malware payload (Mirai)", "value": "6165b590c535e944e1336b7a1935b8f06acf94326e43b746119d32b8cc387c2b184a7fd356dd297974b6e80586794ee0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932098, "uuid": "422d2b64-829d-413b-a345-8da183e19eac", "value": "T1A5117DCF61668C61DC525DD93A924818F48DE6E536CFCECCA2CE4036E49ED043251F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932098, "uuid": "64b5596d-a27d-43c1-ad19-3d1b56525903", "value": "24:sEUSIbK5zOt+MB0hZpZmkPV1ikPV1Z1WkPVU7kPn:sEUXK5CEA0OkPSkPXZkkPwkPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932098, "uuid": "852d31b4-e78d-4df0-8905-3057e41f57c0", "value": 955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932098, "uuid": "ef41289a-9af4-44c9-b8ed-7313884cb3a6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932098, "uuid": "1510b3d9-ae0b-4572-9283-1152d02db35d", "value": "weed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b28b740-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750977997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977997, "uuid": "eec2ee78-4afa-42d8-9980-651a0ec56e50", "comment": "Malware payload (Mirai)", "value": "6321ef9f6448f994575db5f730a160a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977997, "uuid": "0fafb82c-a46e-41bb-8cc3-63b3b2989d0d", "comment": "Malware payload (Mirai)", "value": "88a9382254edc281ab1bbd2b70c49b71f90c8524631b8f9b7f86d82a1e701f51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977997, "uuid": "d10a9519-64b0-4baa-b68a-0c73d4b34dd1", "comment": "Malware payload (Mirai)", "value": "7594c52d037f4d5ca773bd70fbf8526e39776928", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977997, "uuid": "ea74abb9-e6db-4e37-97ef-3c5611001c61", "comment": "Malware payload (Mirai)", "value": "07e62888379eb664c30c53d52b35aead4ed6161e65ba3fdf839277a1745b33edf2f95efc109e8db3f24ba07b2e02e75d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977997, "uuid": "f4fd9423-0f13-494a-b337-7a750073c7fd", "value": "T13C03E186A0A6F570D072AE7B74EED45DDE4970339C0A339B02E9711F8D3A7312F29A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977997, "uuid": "d544904e-d88c-4dca-a084-9954159b2700", "value": "768:Axfs9EilvA3jEIKeM90SVgN0ezzA2byW/18HkmNmt4lsYIyx0Y+:AJs9E2MnpM90Sy0eY2Z/tosix+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977997, "uuid": "272ed71f-3903-45e6-b4fa-bffc7d610504", "value": 40092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977997, "uuid": "98e1c322-cee4-46a5-94b1-26da8703788b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977997, "uuid": "2504b782-08a6-407f-b8dc-52d97ee03499", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ec0c2f-52ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750955953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955953, "uuid": "0bb2ca84-9037-49bc-8c27-5f0197daa038", "comment": "Malware payload", "value": "ff28cfa7b545d5c311dd3ca2337fb1bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955953, "uuid": "ec858f37-649c-4e57-b52b-372b5a062918", "comment": "Malware payload", "value": "88adb745575d2f9472d9e3b2f2f1f49aca7e676f1e666a792d92d6bbd22fa76b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955953, "uuid": "e5df507e-532c-4af8-81da-fd190d356ca3", "comment": "Malware payload", "value": "a76bee6b948d5f9e2a25ea871d9a7718f9e29d67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955953, "uuid": "f140018a-de3e-432d-82a6-ba2fb52afd14", "comment": "Malware payload", "value": "2508def2464149473da414b256aece018ba22f0909be2086e3654f2f4cf928bf0a7ce037244fc4e1d438c140851732b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955953, "uuid": "7d2e8181-d230-445b-81ea-409e7cfa0130", "value": "T181E4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955953, "uuid": "62c57f1c-1029-499d-b6f7-5d2b5bd0ddaa", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955953, "uuid": "785e3032-4046-41d9-9eeb-caa261b136b8", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955953, "uuid": "232c4fe2-7481-4995-9257-ab8b9bbe255b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955953, "uuid": "58ed6a19-1d7a-4d12-91df-e6f4bb39eb11", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c239e7c-529f-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750950484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950484, "uuid": "03b137dd-b116-4632-9f4c-81cf4548415b", "comment": "Malware payload (RemcosRAT)", "value": "554b18a72839d37c51bd04a4fc6e9314", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950484, "uuid": "25c58cd2-4484-41fc-9093-50b4413f0332", "comment": "Malware payload (RemcosRAT)", "value": "88ffc367ad775989b7c9621400cc08094dced2363e9b721744e312e080738cff", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950484, "uuid": "68d92d70-4d4b-433f-8a6b-7db09a8adc84", "comment": "Malware payload (RemcosRAT)", "value": "6494bf573338ac9cc70ec1eeae06137fa1de61de", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750950484, "uuid": "4a7eedee-c1c6-4414-a443-168a41513c3f", "comment": "Malware payload (RemcosRAT)", "value": "13513c53bd0131df3e4c1725a766d5345ac674cd6fa48c41643dc914d856e3a4569c37010af55d9685d0fbf485a8f9c4", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950484, "uuid": "a290a372-aa7f-4d52-bc88-31adb2a13dd1", "value": "T11436E8B72EED16861705336F9B4BF9584B2BCC290FC26ED441CA0AD8540F35B6990EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950484, "uuid": "2bdf389e-6214-415d-b769-c3fc51bd949e", "value": "49152:BtZI5C5TZtHSEcAmYlI9nG21ulIiqUN5Q0VWtjmhySMFF4Bu1hkiykaMjIouP3P0:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750950484, "uuid": "2547d94a-c8c2-4138-9649-e02be6946fb9", "value": 5209393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750950484, "uuid": "6bf6939d-ffe1-4702-98c1-630226571327", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750950484, "uuid": "3a1766ca-02cb-457b-bbc7-1fbd4a51b355", "value": "Notifica.di.pagamento.Mediobanca.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6802b2fa-5284-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DCRat)", "timestamp": 1750938908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938908, "uuid": "6d3fe83a-37ff-491c-a92a-078ca13d9ffa", "comment": "Malware payload (DCRat)", "value": "076d282edcbb5937b10e048873f58037", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938908, "uuid": "ba4bb171-ee7a-4938-a960-cd4cf6932998", "comment": "Malware payload (DCRat)", "value": "89ebc629e46eda890d3d13dfc4905064b3af69a52e4e0564be9e50ef9267fc81", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938908, "uuid": "64ec0000-78a0-49b5-b80e-f359001dbab6", "comment": "Malware payload (DCRat)", "value": "1da18adecb12f9231be2683e74ef733409b23436", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938908, "uuid": "97f5026b-2f44-4581-aa65-7c1d7532c810", "comment": "Malware payload (DCRat)", "value": "a8bb41bea340d241d5176cadfb0b39a9c919a5b40ccd2493fe4dc9c06d98f01d63020dbde59837c667d16a0e153a921b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938908, "uuid": "bf347298-defb-4f53-9397-6ea8cedc065d", "value": "T134F5F116D5928E37C2A817758057113D82A5D736B962FB0B360F60E26D07BF4CB722BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938908, "uuid": "fafdc5e4-0bdb-40a8-a8d1-0399d6ec42eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938908, "uuid": "3189d4a8-3997-463c-9b34-45051d6e2dda", "value": "49152:3k24hWf3HGCeErx1AwM1hr+4XGxNqfewvL1InvfaevNfmaMNf3qTcJtDZz:3hXGjErkZbi4XcOen6evNMNaTcXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750938908, "uuid": "69f69f92-3d5c-44d6-abc4-60589bdbf56f", "value": 3642880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750938908, "uuid": "fc940f7f-2cec-490f-b67b-af331ff9dfa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938908, "uuid": "d46d016e-6382-445d-87ee-c32cfb2ff684", "value": "076D282EDCBB5937B10E048873F58037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbbbd2f8-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905601, "uuid": "4d432aa6-6346-48de-9bf1-5d98ca74d57a", "comment": "Malware payload (Mirai)", "value": "e98a3b7b244b8b34a79677421e3424a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905601, "uuid": "836376ea-7c2a-4c6d-b3e5-ecb26f0e17b7", "comment": "Malware payload (Mirai)", "value": "8a552d283f98a40b80e5658c8f62f928e80990e8b5662652ba36e325f88b4bee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905601, "uuid": "075f3b26-626d-4081-af19-c3ab7f7db463", "comment": "Malware payload (Mirai)", "value": "bd0edd4379d5567f8bd14c2209a7fa0071bbc2f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905601, "uuid": "fc29e64b-b911-4435-b356-fc3326e49388", "comment": "Malware payload (Mirai)", "value": "ab1eec130d1e59b2df3001eeb0c830e7342e67bebad748a222fb62cca3875046425b4ceaf5b0f7e258336bace0e7c3eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905601, "uuid": "f2527c0d-859d-4d37-9660-47ef5a265cba", "value": "T181347C2327394A27C4E0A53991E78333B3BA4BC42964820FBE90DE9C7F596D076537E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905601, "uuid": "2f853a33-66b2-46a9-95bc-943dac328d1e", "value": "3072:vXkoS3OdonGHMubrJVN+K1JQwSnZdLnJc97ILYKsvhxUFQ:PkoSgWGHBV8wTSZdLnWouvhxU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905601, "uuid": "8ddd26e2-bd87-422f-bc71-a68b6ce893a4", "value": 239042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905601, "uuid": "211fa6fb-38e7-4d8f-af16-6691e2940fb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905601, "uuid": "7b84e56b-8edd-49df-bd63-e4a4e1b324fe", "value": "SecuriteInfo.com.Linux.Siggen.9999.1996.32597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f0e51e-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975928, "uuid": "9d8d7e34-9f31-4e6c-a2e0-21a66ead2fbf", "comment": "Malware payload (Mirai)", "value": "4e8290585bc242c3490bf5f273671ba5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975928, "uuid": "3c7f10c9-eac5-406d-9742-392180f74008", "comment": "Malware payload (Mirai)", "value": "8ae84bf28f71e59d4b7be19d0ddf4b557781eaf7ac917793b5f4a6c8e68dbfde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975928, "uuid": "ed154ed2-b7eb-4a08-a594-4016f3308b63", "comment": "Malware payload (Mirai)", "value": "569f8deb0b06521ea7626a5a7a29fbbf72d6243d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975928, "uuid": "49ff4441-5cfc-4595-bf91-360624573242", "comment": "Malware payload (Mirai)", "value": "ca10d8e1d78fa00221379a59ca8414eb95819e1bc7884e048b1bfc8959a867ab11dbfeea9ff927b32571392b0e564ffc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975928, "uuid": "bd23b278-e927-4d04-ba2a-3690d1b0b1f9", "value": "T1D8B3E706BF610FF7E8ABCC3705E92B0528DD595A22B8BB367A34D418F54B24F15E3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975928, "uuid": "9bb3c5b9-7fad-4745-b2de-944c954aa02c", "value": "1536:t7jNQfvnf5wU5sw03TxP3HmbNILO8HIIXZRsvRT1SLfEf:tvefvnf5wU5HT8HIIXaKfEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975928, "uuid": "0c469529-a096-4ad1-b01e-b7c01ec1b1d9", "value": 113732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975928, "uuid": "40086110-3b08-48bf-b2be-c8ed17e375b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975928, "uuid": "ba39a35a-2d64-4034-b2a8-b8d0da412410", "value": "star.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aaaa235-5276-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750932899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932899, "uuid": "5c2649e0-edb5-4ed5-87d2-6fa085f50d55", "comment": "Malware payload", "value": "4ebe274f05061052e224851d405f1441", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932899, "uuid": "c7892d7d-69af-4ce2-a61e-2fb1f5f44aa0", "comment": "Malware payload", "value": "8aef01dfed998fdcbd5b54b6c245d44bb777faa12537fd9cbfb4b496e095bcbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932899, "uuid": "db741c52-4acb-4705-a878-ff12f1840d89", "comment": "Malware payload", "value": "35baac4f6bec2353767bad1da38d05a7af4a49b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932899, "uuid": "b313807f-2cbf-47d8-89ec-7f97d68116e3", "comment": "Malware payload", "value": "284a4b38a79d49bff48e232cee47be39935d8dc994e8f439efaef77555dfe92aeef09ba982ebd84a831b95c371e58d1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932899, "uuid": "28a6ef66-872d-4dcb-b2dd-1f4ede07319a", "value": "T1A4C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6DB42F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932899, "uuid": "361416ec-891b-4b88-948a-436eb65325eb", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932899, "uuid": "78160b68-eff7-4dfe-b34b-2b9f7b320fcb", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932899, "uuid": "753cdecd-21b6-40b0-ae04-08d4072a89dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932899, "uuid": "8e71dc15-c876-4863-8eb7-724e09840db0", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f20839-5272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750931257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931257, "uuid": "ea8ae2b7-7592-4a75-8966-55922c4b45bf", "comment": "Malware payload (Mirai)", "value": "d6f62c4e0210abb1363498d54a9df0e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931257, "uuid": "0b0f850c-572b-495a-832c-0e2a2a997234", "comment": "Malware payload (Mirai)", "value": "8b41ef363c51d4644a63b5dd73c6f54450424d86d8be619bbdbd139f1cf16c77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931257, "uuid": "73297233-6677-4bc8-8d37-4387d5a025dc", "comment": "Malware payload (Mirai)", "value": "f88b512b521c3b397b8d139f11d65c561527b7f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931257, "uuid": "aeb1c6f2-dd76-483a-952c-e31a978ae6dd", "comment": "Malware payload (Mirai)", "value": "6cdabc69b4a25825e911158bb6238437f30a181b288cb5ecdac81c3f451034f5a845768fea56159b4c10c5521cbeb0c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931257, "uuid": "de17ded1-878b-49a3-9282-12dc21e6b428", "value": "T13DC2C795ACC24E5BC1D4037ABB2E4298331267E4D1CF7713D9042F69EA4AB5F8E32E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931257, "uuid": "6fe20bc6-dbb8-4c72-8ecf-5a4c0e00cf6b", "value": "768:4mEyrAEtFAl5GoUba/GpxrcvDWb0WK3t4v0Om:4mEyrAEtN/rcLWbdK3Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931257, "uuid": "441ec963-b97b-4305-9a7a-3131dcc23449", "value": 26000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931257, "uuid": "97c0dd3b-d3e6-4e26-83e4-b2d5d6bb43fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931257, "uuid": "ac8434c3-d371-47f0-80a9-f63898dfd5d3", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecb5556-527d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750935993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935993, "uuid": "0188d30e-50cd-4dba-96ec-4fc4cba62d88", "comment": "Malware payload (RemcosRAT)", "value": "25e817c84770298f920f28c3a949ee9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935993, "uuid": "77f79687-0398-4b00-a1cc-d2e51ed71c09", "comment": "Malware payload (RemcosRAT)", "value": "8be521d630b1c7285e4e2074443ba82175636714302b975bd27da3e0cb6fc270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935993, "uuid": "966b9372-e7e9-42a9-a805-91c73ec0ee2d", "comment": "Malware payload (RemcosRAT)", "value": "b6051b726f317fa370285ae51c275dd7e8987dc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935993, "uuid": "8aebd20e-df96-42ba-bb92-84095a52d1ba", "comment": "Malware payload (RemcosRAT)", "value": "ec37cb8dce743554db3a50b035f7d96d7a775f62467930db48b4f583337fd8595634d1021dbb8150a7e5fb6200352c1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935993, "uuid": "12f69087-80e6-42f9-aade-c78e528c1acf", "value": "T1E125F1882626DA21CDA9C7F04720DEF223B07E6B9414D3160DD5FCEB7D627691CD86A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935993, "uuid": "6b1828dd-1b4a-4bc3-ae7b-02ca6b9d556e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935993, "uuid": "e76b3e3c-14aa-4009-b1fc-c929e1e292e6", "value": "24576:UFkJsY6nwU6xn365vg0BrfSOY/Apekrx5OdLwt5L3lkc:FaYbJgzSjAkkrxQxkB3lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935993, "uuid": "4fb08651-2d9a-47d7-84e1-245e761ae968", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935993, "uuid": "a7c6ed62-8ce7-4ae7-9284-0e305f6b42b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935993, "uuid": "c1ff3497-42a4-4d9e-9c6d-3e346e2e86e7", "value": "INQUIRY BOM CONTRACT NEW PURCHASE ORDER LISTED PARTS 001192982025 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2641016-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750905585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905585, "uuid": "6b73a58a-85a4-422c-b685-65a03c51e81d", "comment": "Malware payload (Mirai)", "value": "4545089eecfb78cad4de7328503d9e03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905585, "uuid": "1b71240f-7281-4871-88b3-36700712f876", "comment": "Malware payload (Mirai)", "value": "8c70cbbd673c02d94027fb82ce2efce2b209a1e0aaa23bff9e484b0f68212d20", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905585, "uuid": "f9a6c8f3-7e2a-4bb8-b49e-e1f360bcb810", "comment": "Malware payload (Mirai)", "value": "5a4a4e9e1b2f7e39641c17b412b0d03d2aedbb5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905585, "uuid": "9621b2c7-3b80-4d7d-80f5-11e6fc97fc4d", "comment": "Malware payload (Mirai)", "value": "21bae529525fddab4b1b3c6af24a01e3e2a3c7a0aa07bf15e089c59f37f243efda3f3c5a9767fa6c0491976beabd7eef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905585, "uuid": "5f5b93df-1368-49da-aa9c-2cfb2d470bb5", "value": "T16034856BAB10DB19F258973106F7AE34C35A22A72BE5E649D19FC7002E3135D1C0FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905585, "uuid": "99d3b085-aa79-4136-90e3-45cb2a12ce7e", "value": "6144:bQjiWO38crSgrUyVPDIvjTO4CFb1l9WrivKDXs4:giWO384P+j5ivKD84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905585, "uuid": "301ada35-9f03-41db-8488-4a6864e6489b", "value": 252597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905585, "uuid": "69582b5b-e4fc-4254-ada6-d2df07e68d49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905585, "uuid": "20216d44-7a9f-469b-9420-b8cbf9742ec6", "value": "SecuriteInfo.com.Linux.Siggen.9999.20775.13199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee07ef06-5257-11f0-8bd0-42010a9c0005", "comment": "Malware payload (a310Logger)", "timestamp": 1750919805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919805, "uuid": "87d0c9a3-350d-48f9-a26a-118c498353d0", "comment": "Malware payload (a310Logger)", "value": "acf3f3e112f8562516fdd99ca05b4e3f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919805, "uuid": "072b2afd-d584-40d9-8485-d5378bb68042", "comment": "Malware payload (a310Logger)", "value": "8c8cba879983d9f4d37fd6fb13d1062ce7a56b83d52d57bf54121523fb74e554", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919805, "uuid": "b694ccd8-813d-448e-9470-6f27eb9b47b5", "comment": "Malware payload (a310Logger)", "value": "75047853d94cbf537b3d41fc7fa0e47209ca1150", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919805, "uuid": "286efde3-c85a-465f-a5d0-e83c672a84c6", "comment": "Malware payload (a310Logger)", "value": "070e6dfc827a0723494f6142cb8ea20fa5455f0d435479b38dc8a8a6292b7c07de860b9f7fd3253297f00010d96a5688", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919805, "uuid": "14aa2331-4361-4646-88c1-0282019e8257", "value": "T18F1512196A939442C17A3F7889D3C2B896783FE958A3C2D37FE63C8F3D759006642365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919805, "uuid": "604383a4-6aaa-4a3f-b15d-cc6871c9909e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919805, "uuid": "0c7376a9-eb89-4715-80ed-0c0d394a64d5", "value": "12288:t3nbbloapq+HBsEUadC9EYw7aETvcC6NyowPlb/lmhuxYXK8TNmkHQyP4tXjXg:t3nbp5hjVCO97LmUPFlmYxeKspPcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750919805, "uuid": "81795785-aea6-4e62-be39-869e96bf7255", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750919805, "uuid": "e4d605ff-e46c-453d-be5e-aec1c7845b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919805, "uuid": "2663bfec-f590-4800-a685-6685ecac5fcd", "value": "FG098765678900000879.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8f7c43-525f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750923182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923182, "uuid": "f7fc4eab-90d2-429f-a707-6e4520955cdf", "comment": "Malware payload", "value": "668d0cbedde9edd87823f3ed08569a6c", "object_relation": "md5", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923182, "uuid": "9ffb2591-8076-4842-9adc-3faf7803f922", "comment": "Malware payload", "value": "8cd4324e1e764aafba4ea0394a82943cefd7deeee28a6cbd19f2ba69de6a5766", "object_relation": "sha256", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923182, "uuid": "b9646871-8c53-464a-819b-254682d55358", "comment": "Malware payload", "value": "a0deaaf90814a7247fb229b758449f9f48f8828e", "object_relation": "sha1", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923182, "uuid": "8a752b7a-ddd4-4130-9b08-d900ada99481", "comment": "Malware payload", "value": "ebab07a2547a016979457fe9c1357357dc9c8094dd0385e53f3427010ec4e32f88dab208e6c6c0864f8f0206d711ed60", "object_relation": "sha3-384", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923182, "uuid": "5dad113e-a269-4a94-9515-2a6e762bfdac", "value": "T13F348D0178C5C836D4BE1634497AD6521ABDB8611B65CBEFA7E88D3D0F711C06B32AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923182, "uuid": "875cbcef-da7e-40bc-befa-bfa949f5454a", "value": "481b9f28907ab2c13f12afa2767df9a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923182, "uuid": "b4da5aef-87af-415a-b5bf-d03cd63b6b2b", "value": "3072:7kL32jNWZJPocftqkjgvZyWItHG1ywpwkqAg0Fuj3kbxxOYVenRYElW8hyTt:7a2IFDFnjghyWNI5AOjYxW3k8wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750923182, "uuid": "6e7cc831-3637-4413-94e5-48b0a68fc10e", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750923182, "uuid": "7115acbb-ffb8-4281-aa00-5f59d91405fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923182, "uuid": "fbb4e0a3-3c86-413b-86dd-554ea2335baa", "value": "fhbjyy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddaf49e5-523e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750909040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909040, "uuid": "f8f60cd9-caa4-4fff-aacf-dbaab6cd3f82", "comment": "Malware payload", "value": "5c99b0f5fc8c81c42cccbc24880aecba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909040, "uuid": "361b48a2-7410-4a94-9f1b-2b0fe2952862", "comment": "Malware payload", "value": "8d6e7fc61dfb67c20c7e5af0b7fc8b6e45a825ddcdca2ff1492eb8944e898e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909040, "uuid": "b6680c2d-2dc8-4e3b-8780-6aa313607ef8", "comment": "Malware payload", "value": "e0f681ebcedacb25efda0ff805f54015d1d2e763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909040, "uuid": "2d21f48f-b838-4388-8c6a-7c6791018542", "comment": "Malware payload", "value": "04a6a36896d0350f53dc6a6550dae412a42297b1eac8e2b71d186c6e8dae0528014b1535d603cdee3b05cc0e3f174577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909040, "uuid": "c5c2db1f-a541-42d3-a628-996b0580b75f", "value": "T1E7360156B4E42270E4B3C370D6DB865AF392710607A64F4F06D44D421B92FA2BF5BB3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909040, "uuid": "a259511c-5e6f-4307-9700-48089c57733e", "value": "7927e1cb07cc1844b9cdbbe7dba83cb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909040, "uuid": "c069ae6c-19b6-44ea-9495-a58a8b79524e", "value": "98304:diqGCm32SG7l4kk7TmfyqCNUCp/P+ZfAV11vo5QHW46:dBGLm4b/EJ4P+hej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750909040, "uuid": "46cf5ff6-79c4-4f87-bbf2-8b3dacf56cc6", "value": 5174784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750909040, "uuid": "d6276678-938f-4f88-a817-5e0d79d7a7a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909040, "uuid": "18662556-6383-461f-8f69-f8e7b4034a58", "value": "u5x.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270ab925-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913888, "uuid": "fc64b289-07c9-4eae-827a-4d8d9607f3c2", "comment": "Malware payload (Mirai)", "value": "cc67c1db89272f070b4762fb94e82f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913888, "uuid": "e1ece728-4949-4724-b52a-ed38c02a65e7", "comment": "Malware payload (Mirai)", "value": "8d9291e86708b3266790077c9d37034f2e09d8439eae364898cdbca7eb99efa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913888, "uuid": "a26fa972-3002-4821-96d5-c1308f9160dc", "comment": "Malware payload (Mirai)", "value": "cad5a25977987ab0fc73322dfc6d3396a042f976", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913888, "uuid": "dce6e06b-765d-4a23-bf66-2ef91c92cba0", "comment": "Malware payload (Mirai)", "value": "d4fdd556c7c33490c7e273614e49b85efeec780727348e6069fa1c54cbc41daca9e41936993ef7290e39ea3965a5b729", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913888, "uuid": "7cb526f4-47f7-43f3-aabb-a1e01230850b", "value": "T175A2E11172A32D55E3EC1C3CC86A871BBD671BFCD0F5327669416620C94D24A3E39A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913888, "uuid": "944abe1c-4b60-4736-9ff7-4eec41cfee05", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjuTmhymdGUop5hC:vvQn4j+ZO5fKAlxOms3Uozc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913888, "uuid": "3bc4c96b-3918-484f-acad-6f5f7d811bb9", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913888, "uuid": "63663c9b-c9d8-4c5a-a136-12d3d14dc170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913888, "uuid": "0b64d38f-6517-4bfb-9247-f8676e88e184", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5b2d52-52a7-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750953813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953813, "uuid": "29441a87-fb2f-42f6-9d6c-17b107e4a795", "comment": "Malware payload (Mirai)", "value": "536abe4d9bd0fd84c1186fee4d1fd22b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953813, "uuid": "36036ac7-d9e1-4e85-9c2d-794f8787e27a", "comment": "Malware payload (Mirai)", "value": "8f76a5f963b9991f350d8c0f4c714253bd07a797a3476c7b6dc097a57c181641", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953813, "uuid": "a7bdf07c-500a-47e5-a9fa-1a14a5dc0b2c", "comment": "Malware payload (Mirai)", "value": "7373cb612340043cd73c304ada74bf7062c83e55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953813, "uuid": "add7e354-d8e3-47a0-a417-557cc6fe51a4", "comment": "Malware payload (Mirai)", "value": "761fb31b5f131afe90a6fea73b1f5b7d4e52e36b451f0abd9c8668770f635afa8a00b4381cdf4a84df329ef18e201a49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953813, "uuid": "75667cbc-574c-4947-834a-dc1ebbc702d9", "value": "T12D838C61F4142C92CC2219F6A0B9C6B483126EF081D61C356DAEF96544E3EDAF68F798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953813, "uuid": "cd4f7335-2366-42fe-84a7-67f02f587a33", "value": "1536:aHTNkKHVFMn0bUpoQNR4YBSHGJxJ+KjpGRBXeUQLiy3Lbr:azG0bUZr4ooY3+PBaLiy37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750953813, "uuid": "ce8c728b-46a7-437b-8fda-8883573c8364", "value": 87324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750953813, "uuid": "95e599ca-2385-483f-aac4-86fa5cf1d53f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953813, "uuid": "de6912ec-4de4-4121-aca1-7ed95953bd22", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d682b7f-52db-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750976364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976364, "uuid": "5e1b2cf4-7b8c-4d79-b55c-d8e8dc82d0a9", "comment": "Malware payload", "value": "30ffa401c6d122c94d58de762f1b12b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976364, "uuid": "d7aed0e2-8500-42ac-9953-56145a9c5cb9", "comment": "Malware payload", "value": "8f9e452d55d9b22a974901c1f11bb3ff22c5126d80c04ab3f3905eb6394ef894", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976364, "uuid": "8eda230e-4486-43f9-942e-a9710a787e9c", "comment": "Malware payload", "value": "32562f37337e9902a519c10f07e005238086eb1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976364, "uuid": "fe30c162-8a7d-41b7-af22-d71f5db7b303", "comment": "Malware payload", "value": "b68776b1bcc7c49cf96793f5a78743e371f38640d9854ead2d29ac90a86846e04f4b78490c1f560d08d7cbb644fa5bfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976364, "uuid": "ed427082-eefc-4aa2-8c7a-77119730e803", "value": "T108E4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976364, "uuid": "08364750-3ce3-4caa-94a5-2bd7d6e201bb", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976364, "uuid": "77c41556-a08e-4061-adc2-20bcba1945aa", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976364, "uuid": "9205b2bf-beec-4efd-bda9-b528c369db44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976364, "uuid": "26162c41-83ae-41b0-bde4-6f9be537051b", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228aa757-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913880, "uuid": "610841f3-4e4c-48ba-a885-50c737c41b82", "comment": "Malware payload (Mirai)", "value": "95b43cf9c643654f54f94f060648e8ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913880, "uuid": "a56f612e-c0f1-4b89-9e8e-656e8d03a37e", "comment": "Malware payload (Mirai)", "value": "9088213382505b5e9cd3e1b2b0ae7f4469695aa417cac460994b1b7c5575800c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913880, "uuid": "d5813a9b-e9b0-4829-9bc2-82f3773410a8", "comment": "Malware payload (Mirai)", "value": "98435f56daeadbc64ed35bb4423243b70e57637f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913880, "uuid": "101f3106-219d-419c-8a55-09a52aec0c38", "comment": "Malware payload (Mirai)", "value": "7a99b7d3010c7755d0f92889f4fb03c0b2469d945da38d9f63222dfc8bfd0e335192bf3d61c017fd8f68c1cced0e44ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913880, "uuid": "0077f153-b52f-4c83-a454-418933bac4e6", "value": "T15AB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913880, "uuid": "bedcc832-135a-4a45-b76c-a27b2a6f65e3", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1g/LWy:c9sSyzz36YaWWgg1gq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913880, "uuid": "e6d0c262-d92d-4203-be9c-60c889bb3e1b", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913880, "uuid": "6cf26da3-6416-4d59-963a-64ee8cdb6f22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913880, "uuid": "d6e47a7c-a198-402e-997b-cd3cf7888fae", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099a072b-523a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750906967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906967, "uuid": "1b52a32b-c9cf-49ca-bfb0-726ffe63d2e0", "comment": "Malware payload", "value": "5e0e4a4cc82414d9e716ad448e056865", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906967, "uuid": "62598fe4-8d7b-4c19-8c7b-3f0573d73044", "comment": "Malware payload", "value": "90c2a3b0e9bd83330810ccab0ca295d705054084eb8800930ea7b47fd4dca2b9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906967, "uuid": "33f23b56-47b9-4e2d-9805-b4967bca1ca9", "comment": "Malware payload", "value": "2999957a26c00c99c6a7af16b8d0c7233191f340", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906967, "uuid": "ddd083fb-b4ee-484a-b202-d47456919430", "comment": "Malware payload", "value": "78156d77631a7c705d3472ff2ea3e4a836d5e1202997ba5c97454514d26fcffbab67a4bc468d0c08933c003a1d833cae", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906967, "uuid": "82a6038e-6f25-49f8-9bc7-220fb9401d4a", "value": "T1CC73F56EE34F0965DF5596BB035A4E4A05FCB33DB38100B539AC977437AD82E4A2287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906967, "uuid": "1576bb54-062f-4fdb-bb19-8e14ed82a431", "value": "1536:KPwEDi8iQOWkgWe8xW41fGh0eDFhhuwxqUqPH3fWWON+xuOn7vm8aqGVQv2:4i/QOWkgWe8xW41fWfZhhuwwUqPH3fWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750906967, "uuid": "85ff6411-f979-4e2b-ab0c-f19385457668", "value": 77956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750906967, "uuid": "7f46b47f-2591-4fe9-bf67-989d285ad27f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906967, "uuid": "695bc110-096f-4c7c-a427-2f6e84425ae1", "value": "payload_1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75eb2c5b-52c0-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750964701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750964701, "uuid": "36089158-1263-4c49-8f90-1cf8a331090f", "comment": "Malware payload", "value": "d9f0aed606713e14264adb9a1fd96050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750964701, "uuid": "77bd5046-47a8-4f63-94df-86e63267a157", "comment": "Malware payload", "value": "9137185e8f72c20aa75a54554a30ba0f8ab15696e57d4abad6d566df83dd9e89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750964701, "uuid": "84b45fff-bae6-4934-bb3f-36e4ab06e024", "comment": "Malware payload", "value": "cf332dc66671b3b802f7f0ff6c33936e66adf8a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750964701, "uuid": "73174962-52bd-48ae-8feb-0cb43d376a7b", "comment": "Malware payload", "value": "e8ea0fd87eae244e4ee3a7c6c15819b4575d241bd930aa79e6fcf99a5be6008668411f354bc88c6ce890a71b3e84ded3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750964701, "uuid": "3289fb24-af8c-46cb-8c55-8d98ec3f6d4e", "value": "T1976533518070D490DD5506B175E9E8373896EE418CA06FB293EDFFA733B7C821AAD292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750964701, "uuid": "a2c2abf3-efb7-4b7d-b9d8-4e9f7b8d7cdb", "value": "bf95d1fc1d10de18b32654b123ad5e1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750964701, "uuid": "0c0a78c9-0d81-40b9-a0f9-153b0c8c5d51", "value": "24576:E0avn/g0l4Rj0WNO4oVtmXoZkfsbW56qeESDgZ1ZCB:EBp0j02O4ofhOOWSET12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750964701, "uuid": "e138ceb6-b0e9-45d5-8d89-c12483cec12d", "value": 1439978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750964701, "uuid": "de367853-e62b-4fb2-882d-9cd2856592f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750964701, "uuid": "3c56e865-d31a-4049-b80e-b44043b487f3", "value": "Nexora.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d52722b-5289-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AteraAgent)", "timestamp": 1750941010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941010, "uuid": "c0ca6584-d681-4a35-9f55-e0ded499a0da", "comment": "Malware payload (AteraAgent)", "value": "3fc7aa82ad873ad1eb085ed364da6bd6", "object_relation": "md5", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941010, "uuid": "29b53d26-adea-4864-b4e0-f48973d52beb", "comment": "Malware payload (AteraAgent)", "value": "92163d0c8d397d458709ef49590a110c1eefe1af22a8598b712ab7006319a4b9", "object_relation": "sha256", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941010, "uuid": "36c22be4-9da0-43bd-b9dd-148b9d35b0e2", "comment": "Malware payload (AteraAgent)", "value": "5f599c349b7e7e1dbdd134c0e9fdc726b00b81a2", "object_relation": "sha1", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941010, "uuid": "b769218f-839f-42ee-9573-6c6cbf272912", "comment": "Malware payload (AteraAgent)", "value": "277a834ce1d3f9251d6facbb3412387a5bf43d9712aed3ead3befff4cc6aa30e263d0714423c1f376179c4f95205d329", "object_relation": "sha3-384", "Tag": [ { "name": "AteraAgent", "colour": "#3FEF2B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941010, "uuid": "361424fd-1568-479f-a5ff-25266bb3cc5f", "value": "T1D1D523117584483AE3BB0A358D7AD6A05E7DFE605B70CA8E9308741E2D705C1AB76FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941010, "uuid": "ff9ea5ae-8d25-492a-b012-0d936a41d3d4", "value": "49152:E+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:E+lUlz9FKbsodq0YaH7ZPxMb8tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750941010, "uuid": "963a5c6e-2707-4f4d-80b0-00cc1d769b34", "value": 2994176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750941010, "uuid": "dc781a83-1184-4da3-9471-b71884882e4a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941010, "uuid": "a980b4c6-7f14-4f93-a429-b30263ff9f03", "value": "rFactura.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d43cfa-527a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750934852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934852, "uuid": "12cac3bb-f029-480b-ac7d-513b883cf4fa", "comment": "Malware payload", "value": "d2973a64ee5dfaea38ec8d095641b2f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934852, "uuid": "90723812-6390-4147-b17c-a131fd5caf24", "comment": "Malware payload", "value": "922667940c5e7df424c6925157056ff9a5e5c8071dba7fd3fba5bded3a90e2f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934852, "uuid": "8dbd0c5f-610e-4054-b4e1-540e1610a253", "comment": "Malware payload", "value": "31b3744dbceeb6625d5d0724c574f2b95db20d06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750934852, "uuid": "81ad263c-ae3a-4455-9c3d-55bd1176ae43", "comment": "Malware payload", "value": "82e9523301ed38cd53faaae6c919a5d68f0e259ce03b8845a0afbb7e49797a80339af0eacbf5e6c5d4083a40595caec3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934852, "uuid": "a2bbbef3-f503-4f86-a078-925217503d35", "value": "T1FDE412017F152032C9D21AF0A8B747B4EB914CD610B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934852, "uuid": "1a76b45d-7b39-4703-bef3-cd2bdc217138", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750934852, "uuid": "764b4652-53cd-4f6e-8104-f8bc68b23b0b", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750934852, "uuid": "48fdc392-803d-440d-9a67-ea80865ffaf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750934852, "uuid": "b1482607-ccf2-42ea-8f5b-1ee0d22f0ab1", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1b0f43-524b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750914571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914571, "uuid": "26c79850-ca3e-4f61-b56d-44316299f94f", "comment": "Malware payload (Mirai)", "value": "d3f1204c4880cbd73eedf127c217846b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914571, "uuid": "d6aaa095-6467-47d9-919f-b6c886fd38ca", "comment": "Malware payload (Mirai)", "value": "92374a76268722c65d9989cb58b2a5558d1f600fe63e26620dbfb2831427acf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914571, "uuid": "38f5d685-dcef-4f10-accd-f38c7c052559", "comment": "Malware payload (Mirai)", "value": "27b4b084485d0c6ce60771a67e73c5342ac4dfb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914571, "uuid": "afe7e6e7-8829-461c-894c-f55f38ee685c", "comment": "Malware payload (Mirai)", "value": "c740beccca075b8fee00b3bafc1c6b5e9d6f862bfe88be49a3c2873edf97235b8b01fb962599a110762ae5909f24482a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914571, "uuid": "ad835c99-3a3c-413e-a5b3-ce7121b95a1d", "value": "T1E2141A46EB418B13C0972BB9FA9F424573239754D7EB73059928AFB43F8679A4F22102", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914571, "uuid": "ba473609-af5f-414d-b592-1a4a2825ddd9", "value": "6144:umr8VGDkoBcRETL5GoIz2bGc9lMX0aaiHaCp8wN7vlli9TDq7V/BqlMMf:u28VGDjBcq37IwlMX0arHaCp/Nj3i96G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914571, "uuid": "41bf26ac-54fc-42e1-a35d-3997811c87e6", "value": 201625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914571, "uuid": "14f5eccc-a79d-458c-8888-7ec293f110a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914571, "uuid": "48bab0cd-6b79-491c-8213-a70ed51b0d9b", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b4e7b4-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750976002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976002, "uuid": "bebdbeba-aa21-46f1-a4a5-bb86c5168386", "comment": "Malware payload (Mirai)", "value": "250831e0a1c029e9b87dfd1aadd4b3c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976002, "uuid": "b677e20c-9f8d-47f9-b6e0-df2c79e01714", "comment": "Malware payload (Mirai)", "value": "9238454c66e7eb2c5c76dd8d6025672998a8c8c54bb89bc4af7a25bf9e630ab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976002, "uuid": "892004a9-dcdb-4238-b3a3-4d6f3af548ce", "comment": "Malware payload (Mirai)", "value": "69649809890e1451ca3a3ac5cf4cc45ed74021de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976002, "uuid": "f2a2a726-151f-4efe-a7cd-efbbe825b82b", "comment": "Malware payload (Mirai)", "value": "c5149f0c834420c117ba45d7976787ca80a0faba730d212702c73bda2177ec3cb85216e03dd8e7818f888b4dbedf61cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976002, "uuid": "863dc075-c82b-498f-9553-ebfdaa7f6a80", "value": "T17F130891B8C25B2BC2E017BEA66F618D3361A3E8D2CF7327D8215B017B8951F4D67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976002, "uuid": "1dc48476-c17f-413d-918e-821b643e1e01", "value": "768:1Ipa486XLOoJMq4Q+H6CTM2b7GpA9891cS4KAaya4e3AaMUSwwJ:4a2XtJMlQS7G7J/LyDe3Auw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976002, "uuid": "93efcd00-5d83-4dd4-90c3-48df315fe09f", "value": 42504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976002, "uuid": "8de988ff-6a31-47bd-9a03-2e68cf292f9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976002, "uuid": "645b2a68-f0ae-40cb-b92b-2138088e32c4", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ada380-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750914157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914157, "uuid": "a1c25630-851b-4bf2-bf88-b35264261b5a", "comment": "Malware payload (Mirai)", "value": "0070331f92bd13796050fe3240c8028d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914157, "uuid": "1b2d636c-8d4f-4cd5-a04d-8590924919ca", "comment": "Malware payload (Mirai)", "value": "93abb27fd30f1b19c4f9d64027b09ee3c5df52f9a189f3b628e9e70065ca863b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914157, "uuid": "844ea69e-b02b-40c1-be34-9adab89aaa5a", "comment": "Malware payload (Mirai)", "value": "e71f45596119532f8de078a8b482d2fe881dd409", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914157, "uuid": "ef42006c-dd5f-485e-afbe-d7023c783572", "comment": "Malware payload (Mirai)", "value": "a33c71ee5261776ee1b7fb5e42cb3fcbcd29ab0f8ba92e1d17c8d6403d4cb70111536cbc8e7172d9e7afbcac546324c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914157, "uuid": "2cbfd345-04e6-49df-9cd5-576e54d5cd81", "value": "T162D30849F8818F13C5C552BBFB5E438C372A1B6CD2EE32029D256F61379B95B0E3A146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914157, "uuid": "5c4343ab-cc6a-4628-a26a-d85fbd500c4d", "value": "3072:d4KxIXdL2HHQQWCBkaUvBrbtRF1l/e6/qDBK1HjJ+TUKk5a:ML2HwQWQUvBrDl/X/qNk3HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914157, "uuid": "32172a0b-abb6-4649-a414-b65aaa5d9602", "value": 137084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914157, "uuid": "8df2fd8c-4ec8-4538-91ae-d4a792aa83ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914157, "uuid": "c7f51e0b-0e8f-453a-b9c6-a7ba8faf0c1c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d7d9df-525f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750923222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923222, "uuid": "7137df60-8299-41b9-bf26-5feb421f74a6", "comment": "Malware payload", "value": "5d88adf862e6944b995ac6dd5151588d", "object_relation": "md5", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923222, "uuid": "cf02513d-6bef-445b-b5dc-5ae6e02950c6", "comment": "Malware payload", "value": "93f1fd31e197a58b03c6f5f774c1384ffd03516ab1172d9b26ef5a4a32831637", "object_relation": "sha256", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923222, "uuid": "291b7b16-58ab-4409-b0a6-93cbef867a0f", "comment": "Malware payload", "value": "4250d54738e5726246d6a7895f3e9a390fc99a25", "object_relation": "sha1", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923222, "uuid": "4d5e2712-38af-4757-bf85-080ba2bae55c", "comment": "Malware payload", "value": "2e029deced8380dfe7cf133bcc21a04446856db76efe6475a712cdd55bd3e907ddd71ea29aa0eada93b81075536cda01", "object_relation": "sha3-384", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923222, "uuid": "25018177-aa59-4ccf-84c0-de9eb950cd37", "value": "T167348E017841C432E4BF163845BA96624ABC79631B70CEEFA7E84D3E0F755D06A326B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923222, "uuid": "a5d14ace-0564-45f9-9e3c-38c334babc11", "value": "481b9f28907ab2c13f12afa2767df9a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923222, "uuid": "a29cf8bb-f956-49da-9eda-a1c5df1d2109", "value": "3072:5jUFXK1jnQ4c3vAPv5IVWnmE/lUVtscF7IUGDmAg0Fuj3KOicVunxJoOijN:5QU15gI6V4mEss5UbAOjTwOOSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750923222, "uuid": "7b61ab5e-2742-4174-8e28-f1a8f543cc9e", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750923222, "uuid": "3d8afbc8-e1ae-4da5-a117-bdd12bc6cfcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923222, "uuid": "6d80341d-fb68-4567-ac5a-b682a0e82afc", "value": "helper_process.Game Center.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcabbcb-529d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (OffLoader)", "timestamp": 1750949732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949732, "uuid": "fe3cfc75-5c94-4c75-bd40-f9b393e7b920", "comment": "Malware payload (OffLoader)", "value": "40817ba68988be32ff824c731779d5a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949732, "uuid": "a0c7d32b-c0b4-4f07-aed6-5c93ff7caab6", "comment": "Malware payload (OffLoader)", "value": "9499bdcf5a7edb1a7530e985a1698db10c72caf516e5c0091cdfcd2c8c4af70b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949732, "uuid": "1643c3de-33b7-44c4-a186-ae976cdc9c60", "comment": "Malware payload (OffLoader)", "value": "dfede6d42dce5a4767fd3f940d0db1ec6cc2a437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949732, "uuid": "04d18082-4b76-4aaa-9895-c4196c0f0d1c", "comment": "Malware payload (OffLoader)", "value": "5a15d5700737f149815559a1a15773ab9ddcdacb3661114a627b8ed2093aeb0ad623a445f920a29d5b56275d734d3a67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949732, "uuid": "cdcb99be-2918-46f2-aeeb-ca8a58382190", "value": "T13B95CF23F2CBE03EE05E0B3705B2A15494FBAA256523AD5786ECB49CCF751601E3E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949732, "uuid": "641bb549-872b-4920-94a6-78923041594b", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949732, "uuid": "f1b6797d-f648-4524-aeb8-bc418ee9c878", "value": "24576:waE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH1bNf+zH5JaFMWHIta3+8Fk86Y1oli:0+MRvHru4Ju+ekQoEct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750949732, "uuid": "09e2316d-a4c0-49ae-a9b0-c0abeffce5f4", "value": 1914295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750949732, "uuid": "9406f497-1ca7-456b-b263-63535d80bb98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949732, "uuid": "b42e990a-66fe-475c-aabe-e9312237bfe3", "value": "40817ba68988be32ff824c731779d5a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5505a48-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900866, "uuid": "868136aa-a284-4d21-968b-2cc798919c59", "comment": "Malware payload (Mirai)", "value": "a78d4a79502d172bc298dbab11d9b455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900866, "uuid": "c1406c86-b3a5-42d6-9b29-a40d9b90aecc", "comment": "Malware payload (Mirai)", "value": "9524f813f0cba24cd07dbed091d971bb8bf32c31ecf8a7398689b24ffb21899e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900866, "uuid": "f60b566b-10e8-46e7-9fe9-57c0abf187bc", "comment": "Malware payload (Mirai)", "value": "c520589c05e29b5b9a0322e8f513f9fea3bdc0ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900866, "uuid": "964aa137-1d4e-457d-8998-5082e7743761", "comment": "Malware payload (Mirai)", "value": "ec2cb3e5bf9a345ac178b8ae1017c1fd70be85679e7d84f02fd8482f23b0941c0579ab60c6943701a9815c5819cb6f24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900866, "uuid": "a0040348-391b-43b3-9120-d986a411bdbc", "value": "T189347B2327394A27C4E16539A1D78333B3BA4BC42924820FBE90DEDC6F59AD076537E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900866, "uuid": "1133e8fe-e17f-4e05-b3fc-1ca3922be28d", "value": "3072:okDzp9S3OdonGHMubrJVN+eFJQPS3ZJfj98nnrKKsGAUFQ:o+p9SgWGHBV8U0SJJrYrwjU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900866, "uuid": "bf5f994b-d2b2-4b25-a891-dddb2598da52", "value": 239022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900866, "uuid": "a9d76dcf-604a-4e37-b0cb-efda8b5df17e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900866, "uuid": "c5c33452-04e0-45de-a84b-edd8e5eeca73", "value": "SecuriteInfo.com.Linux.Siggen.9999.1464.22763", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c765687-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750955236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955236, "uuid": "f98f93d4-ed95-4c28-8021-412393a3455c", "comment": "Malware payload", "value": "da950be9deac041ddf7d4bfeb73baffd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955236, "uuid": "dfd85101-fcbe-4410-a7e2-0c719228d5f9", "comment": "Malware payload", "value": "95585f1cc38a913c6bc46007c8511e0bcc7d0455496e1866e8699683acf525ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955236, "uuid": "aed6d054-91a6-4fb8-9609-bd6990f3af9a", "comment": "Malware payload", "value": "4aa4d4313e7d29574d13cbeb7a246fb6755be7b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955236, "uuid": "cece85fe-60a0-4a4a-a517-5119db41853b", "comment": "Malware payload", "value": "1874e88d315c1fc130ffaa0672a85fe9894c1195889f4f9d98423b609c52bde305f9c22486dfb8569f99d3d8e17e8533", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955236, "uuid": "b46b687a-893c-4331-a4b9-6452a38604df", "value": "T1ABA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955236, "uuid": "9a621ff4-5bc5-43a3-b1cf-673b4f217fd1", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955236, "uuid": "6878c77d-8648-4932-aea8-e40c243026be", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955236, "uuid": "035f4e2a-1a45-4974-89de-c704b51402ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955236, "uuid": "a809b492-b582-400d-a940-f9291622c071", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffda04d-5299-11f0-8bd0-42010a9c0005", "comment": "Malware payload (ValleyRAT)", "timestamp": 1750947914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947914, "uuid": "c00e5d29-bf1a-4bca-96f8-bf1b7a4d7656", "comment": "Malware payload (ValleyRAT)", "value": "4fb3c8bd5373ca31f1f8b37e64c31ef0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947914, "uuid": "a93b1cbf-c4ef-485d-8025-fcee0556ff8a", "comment": "Malware payload (ValleyRAT)", "value": "96042249d20ca53e1238e6d27af7e8d8ce61d7ccde6fb17ea83f2b43420df758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947914, "uuid": "5a02de12-529e-40ab-be1c-5506d850e08f", "comment": "Malware payload (ValleyRAT)", "value": "2d5a7f39c71771f6a4bf477e987b5f6a912bc335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750947914, "uuid": "3bf46a5e-eeba-428b-95bf-4616683d1fb1", "comment": "Malware payload (ValleyRAT)", "value": "daeb077c514296b6a4ec1deb810005a6d1c26e589c3a50b6a53ed9db6c0bbbd6198ac90141f77cd94bc6478ede7a9ad1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947914, "uuid": "0f876f57-71f8-4956-86c9-ce3216a72900", "value": "T1367523D27380D1EBE8BD517274734E506A727C16C9A6567F64A8F1283CFB243186BC2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947914, "uuid": "d62e6e00-29b6-4450-83e5-dfc00a8847d2", "value": "e8b388432bfe035dd21ce2777c00f383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947914, "uuid": "6be9a116-a826-4891-a661-d64fd5fa0852", "value": "49152:AlqfbJrl5/y11BmxPINNTanedFPvA5le3H7:AlqfbJ7ywgTbfPvA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750947914, "uuid": "a2d7bf37-0c1b-4d5b-82f8-0498271034ce", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750947914, "uuid": "5b9eb2fd-dd94-4fe9-bd7a-a72d41b49ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750947914, "uuid": "f092b482-e4e8-438a-9bc4-7dbc40c3488f", "value": "4fb3c8bd5373ca31f1f8b37e64c31ef0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc13c6af-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955370, "uuid": "252a516a-a4a9-4116-aaf6-a06985cd74c8", "comment": "Malware payload (Mirai)", "value": "e69e1d6b0e64e7e48ba5ba7d9979c74e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955370, "uuid": "bfc93fe6-fb6d-45cc-8643-781a589acaa8", "comment": "Malware payload (Mirai)", "value": "97fd8c0cee39c47bf41495668fa696eb30d8e684761317f5a14606b231a584d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955370, "uuid": "5d9b27f9-84b9-4abc-b170-74f2c10fe8e2", "comment": "Malware payload (Mirai)", "value": "791e56495ec1a6bed6d066744b646fd8b14f4e3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955370, "uuid": "525d53fd-3326-4cd3-8252-59f0522a8963", "comment": "Malware payload (Mirai)", "value": "ce024c7f824f9dfef0cfb115849a3c7f155b7a7b06eea3304d3cf6630c525eba4e82cff437dfba27384789e7d78a0258", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955370, "uuid": "a28b9be1-032f-41d6-9a98-b46e8dbc4e25", "value": "T19BA2E01572932D56F3ED1C3DC9AD835BFDA70BFC90F6327669416620C90D20A2E38B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955370, "uuid": "69786df5-5ca9-4c55-9a54-cd14b8ba99ad", "value": "384:YvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjeBwhymdGUop5hx:YvQn4j+ZO5fKAlxWws3Uozr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955370, "uuid": "e2829887-47d4-42ef-bd61-27ee652125ee", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955370, "uuid": "61ebf14e-9fda-400d-a198-e7b335f438ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955370, "uuid": "c5b63119-0a60-4859-9065-7b25056bfac2", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265479bf-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913887, "uuid": "a1e9bf0c-c7e3-4f0a-9319-005c17e9fdcd", "comment": "Malware payload (Mirai)", "value": "98636cad970249ed929886b5a66e99aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913887, "uuid": "cc6b9f27-b5cc-4e5e-88eb-44afbc3d3a60", "comment": "Malware payload (Mirai)", "value": "9907fad0916c4e4596ada58f90433d751505c01f57a52f8ea7651acfe6589ddb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913887, "uuid": "d35d2a10-65b6-4620-b5ab-9e9aafbdc1e0", "comment": "Malware payload (Mirai)", "value": "5f560765ecdd3dbc37e15494cdf857a0978f60ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913887, "uuid": "04e94b9f-8a52-463c-acfd-c1a74b51cb6a", "comment": "Malware payload (Mirai)", "value": "8258881453aa67e358090082b180748d603be909bbe532acc4a5c18f5eeea3ae7f08f5e1afb7bb73832ae0c78c4d7171", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913887, "uuid": "2c92a8cc-c5bb-449c-86a9-8722fcb91878", "value": "T14EA2D029D3456EF4DFAF9D9093C1C3C276A546C72786C8E340FDAF026506056BB89C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913887, "uuid": "a135a751-f245-4a91-b757-5d54dfc71791", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5dEx/M4uVcqgw05VxJL:MRxsSVsMD6xiJJE5zRWNrEW4uVcqgw0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913887, "uuid": "f5aeae3d-2c1c-419a-8414-15e1a8e8b6e0", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913887, "uuid": "331d9eff-7474-4510-8944-1aca7abd03d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913887, "uuid": "e6a22b30-c216-46aa-bc0a-895641b43f06", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e34aaa-5245-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750911687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911687, "uuid": "7c582393-cb04-4b42-aa76-56b46611120e", "comment": "Malware payload", "value": "e111e3bf318b80fae46b7b02ecb05c6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911687, "uuid": "ac4e4fc8-0163-48e2-9b27-06117a2d20fb", "comment": "Malware payload", "value": "99580649ed03c0659863ce59231975bd7e339758fd088ed41e73393ed053f1c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911687, "uuid": "6f48ab28-ed82-4da9-993f-e0ae47e4cb4c", "comment": "Malware payload", "value": "107d2f71b57ff15bd5dd244b21f8ab4de909fb7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911687, "uuid": "3bb7b586-df64-4b8c-b3a7-c877bf5a7bba", "comment": "Malware payload", "value": "569cf0543858b8ce0dbf597d0cd9366501ab1dd3c01ffb592c99e887a8fa62cb035725987a58c9a739aab51718f31632", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911687, "uuid": "4cddb1e0-93d6-4597-b8c6-9b5dfc0b30ac", "value": "T1B6E412017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911687, "uuid": "d32623c7-715b-4344-ab62-41411b5f225f", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750911687, "uuid": "f8779a48-f29e-4ae5-812b-0ccf1ec29c5e", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750911687, "uuid": "4f4e19f5-6f74-416a-8827-fc909c9c3c82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911687, "uuid": "802b6292-94c7-4d46-b1f8-203e59807e8c", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d555c2c-5272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750931266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931266, "uuid": "2d208bf3-6a88-4ea1-848d-946601277335", "comment": "Malware payload (Mirai)", "value": "0aab9ff82151915e455978354ebbfb53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931266, "uuid": "1210f739-959d-4783-a5c0-5d883fe7d5a4", "comment": "Malware payload (Mirai)", "value": "99d4785b6efc62c1475e017b58a2cc3e8e7f18026950ad0d80aa907846b1a39b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931266, "uuid": "2185acf4-e64f-47c9-9a6f-84e85b544204", "comment": "Malware payload (Mirai)", "value": "4708d676754d50d02c61a702fcc20ddaef2e66f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931266, "uuid": "5a03b4cb-628d-464d-bf1c-0889e291ae70", "comment": "Malware payload (Mirai)", "value": "d6a8dbbcd4f5c65539f1f5d8ceca2e97e7367ae713e510c744ec5b03b1959d1a3f2453ddd961fca3ac2a9dab618c315e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931266, "uuid": "b34d7523-e313-4eff-a0ae-7563db0b709f", "value": "T1D5A37D8AD283DCF2E81604B1513793779B72D43B603AEE86C329DD75E896900D63B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931266, "uuid": "002d751e-0088-4605-9606-b5399c8c726c", "value": "1536:zlp3ZUevQgEHBpoHGp0BjWNKiJBjFX9TYIt50Sgfnve1i+X:zlp3ZUYQgEToHGp0F1iJJFtTXhRM+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931266, "uuid": "2502aeaf-3ab6-461c-9658-b44fc7083029", "value": 104396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931266, "uuid": "5b5a40fd-7723-4149-b3e2-3bd4ae342dae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931266, "uuid": "69d770c7-4329-454c-ad24-ed797e3ce4fa", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab201152-5239-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750906808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906808, "uuid": "f024f64d-6f1d-4ed6-9632-ed05eccf6865", "comment": "Malware payload (RemcosRAT)", "value": "5acc41cc5526f6095528d0f8a13d0f3e", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906808, "uuid": "123f0113-6314-4f17-87b5-fac6764259f9", "comment": "Malware payload (RemcosRAT)", "value": "9a0940bea3371875026216848d15cfd3480b5b01cf932ab6a72b35a08a284908", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906808, "uuid": "69002e63-f1ec-4feb-b90f-d4b02e5dec78", "comment": "Malware payload (RemcosRAT)", "value": "d6a2e6165aaa0184c54f8ce1f737d124436dece6", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906808, "uuid": "f5e40e86-7e6f-4b48-8821-b94ba1e4091e", "comment": "Malware payload (RemcosRAT)", "value": "a5f55f45601ab90e4eae221d90ac5032a2d0084c8e51f4370b800fb804ea6c299a2d2cbd1ee549231906e4ef7e77009c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906808, "uuid": "c8346fcd-0de3-4d5e-97cb-fdc1519700c1", "value": "T1B3153372FBF66C4E85055C321056DFBAD08464DC62753BCD06A3980BDF62BECD22A8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906808, "uuid": "4ba74d68-ffa0-4649-a3e1-73186ca33312", "value": "24576:ep39xFmU9EaaruxFE08Zu+TaA/YHpFe1QT:k39mUCtuxF230e1QT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750906808, "uuid": "afe4b76c-ae2a-4310-b2ea-548e4a8cc8b2", "value": 892749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750906808, "uuid": "3c5c9191-174b-4302-9867-3a03f38f2db0", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906808, "uuid": "76c39346-e1b9-4f0e-aa18-0c2e0e341e5d", "value": "nOrder.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9a39a9-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975960, "uuid": "c48e90b3-a729-47df-830f-1f69d76b8252", "comment": "Malware payload", "value": "875d22c835938186932a527e6d99052f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975960, "uuid": "e8fab378-dd02-43b3-9fac-2f346134a4f4", "comment": "Malware payload", "value": "9b4b34676f4bb8448cfc0d1b9b0576d26170fbecba70628a0f58f6c50da99c45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975960, "uuid": "eb0a4216-9017-4db1-a381-b8612a53a0a2", "comment": "Malware payload", "value": "5f9b5e0bdf397c0fed87bfd242711ad0f4e5456f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975960, "uuid": "f6883f2f-1c6c-40ed-8f01-1eacbc1297cb", "comment": "Malware payload", "value": "c75d357e4d4363a1d55d9ac7f16879b79b7d757f4e40ad900dbae87e32a54ffbb104ef264f4bfa5a2508116cff557ddc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975960, "uuid": "5b741166-0acd-4a21-ad19-34d8c26e1a74", "value": "T1DDB401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975960, "uuid": "2af9be89-d3eb-4b71-a404-5cdb4bab4101", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975960, "uuid": "fe4e73a2-8179-4b68-98f1-536534116651", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975960, "uuid": "67f279b3-a9ae-4a79-8173-45ee611d930f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975960, "uuid": "e9364041-1649-4c10-b4c4-7ba51d10f106", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c47c65-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913889, "uuid": "7dad064f-814d-4cba-adb4-9676a47221d9", "comment": "Malware payload (Mirai)", "value": "a2a9c4d5483a9854be799b0234a541c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913889, "uuid": "f69fcf02-56a3-4928-bf9d-e703af63531b", "comment": "Malware payload (Mirai)", "value": "9bfda84e88d6a406231f8475229ea09a90078ab265ad3ea6e60d13bbd77f9f06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913889, "uuid": "14ba2724-2573-4966-b409-fda62078383b", "comment": "Malware payload (Mirai)", "value": "714626435398c8273f33e0b3dab7b36c83101494", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913889, "uuid": "310d138c-56fe-4008-bd2f-251ab835a87c", "comment": "Malware payload (Mirai)", "value": "806c87c65fa972a8674fa6715b28513808d5390a7eb432d9afaa8988761a0c4a142a713d654415e4e6cc01a7097e4ba1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913889, "uuid": "7bc6f831-0836-44fa-a92b-bc8cb5758b19", "value": "T1BCB3628A7FA13FFFE81ECD3341949B0A129C891952957F7A6A28D408F74720E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913889, "uuid": "cdf1f645-eb95-42bb-bc0e-0e50233de4dd", "value": "1536:ZO3X5eIeAvxkoHMINY3YtZGmV278JjM6k4vGEwbDr5dfsElk:mpebAvxkoHxfZZVkjAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913889, "uuid": "cb0cac98-e439-4bad-bf30-854372da3093", "value": 108176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913889, "uuid": "a5f2008f-5643-48bb-9035-a9ba81e9a028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913889, "uuid": "4d16c2a2-d1cf-45db-8e82-bd45cd50e932", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e37de4-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750914156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914156, "uuid": "487a56d3-0dc1-413d-a0d2-107511798d36", "comment": "Malware payload", "value": "2ec409fa72bf0d3182560f1aae9779b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914156, "uuid": "f8cccd84-59e5-4ccc-9c1d-bc52995567f3", "comment": "Malware payload", "value": "9bfe3610ace54c87195cc702e46037e855e5b61c88589cca467037564a55454a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914156, "uuid": "c0cbe464-caa1-4158-964b-186c445e495e", "comment": "Malware payload", "value": "39ece8787f4565f4e7bca4dcfda7a99a572a643e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914156, "uuid": "d3906c79-3bd9-4e03-911a-f15000759d74", "comment": "Malware payload", "value": "c1b2e8b54abf5a600df8e29eb2ccb6701c834c803aa114358307483d96b93008003f1d6fa2bb159e0af399399528fb7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914156, "uuid": "0858a2a6-2f72-4c5c-b44f-b2866bf8ab81", "value": "T1A5A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914156, "uuid": "73826abf-37ba-4f98-8384-467f70d17b6d", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914156, "uuid": "612811ae-f980-4973-b6a3-a262e069b126", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914156, "uuid": "aba8217c-0649-4e94-91fc-8c4376e8858e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914156, "uuid": "00b4b475-f4ad-4280-a9d3-d3b0f612dba2", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6542cbb-5269-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Nitol)", "timestamp": 1750927496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750927496, "uuid": "07f0c870-1026-4801-bea6-61c2f96b7a41", "comment": "Malware payload (Nitol)", "value": "bc26dd2541abe8a8e9808d12d4d3a251", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750927496, "uuid": "99f8830e-0955-4b0f-a72f-e3d163bde5a1", "comment": "Malware payload (Nitol)", "value": "9c68e52c2dd28c9810878202e7ff7bc38119f56cfaa95936a8b68310a6c74a80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750927496, "uuid": "e3c8611c-cca4-4a71-8bb1-2c9cb52ed4f9", "comment": "Malware payload (Nitol)", "value": "7fd6b5c73933a831a00a28a5cba156378e671ba8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750927496, "uuid": "60cc83c0-e322-4fd9-aa15-73c4905e4863", "comment": "Malware payload (Nitol)", "value": "f8a4676ef9e5efcbe068ee926c09280005993261db14d3e47de8fd359d6a7abf37ad614a57a0aa0d1c7d58b3935b4342", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750927496, "uuid": "7bea0110-feea-469a-8c12-6208514952a4", "value": "T159535A02AF85C4F1E54A03B4385677B7943F68E462D86B939F2BFDA5487B121F12D207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750927496, "uuid": "4ccc913d-0677-47eb-b963-1ddec139d39c", "value": "55cc24a9cf98c16eeef7d7030b8008b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750927496, "uuid": "490bb347-62cf-42fc-9e27-ca8ea05813cd", "value": "1536:+1cDOfyakpKYgystfHwceV71yot+ZKL3:MyavYgyEPwceVxyVZKL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750927496, "uuid": "eabb0d79-1ec1-4b50-8977-f4ab25098703", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750927496, "uuid": "6dbb86c4-ebd9-48c6-a0b8-765eea613b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750927496, "uuid": "ba88efc0-1301-4e12-8068-ab05f7c36ed1", "value": "dhl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0687f89-523e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750909018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909018, "uuid": "00884c31-4367-4e8b-8ce4-8b4d3036cb99", "comment": "Malware payload", "value": "9bc31feb53012a745f97ed42bc432e21", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909018, "uuid": "df3cab58-fe84-4117-90a9-1f4ae8d0ae62", "comment": "Malware payload", "value": "9e98ffaad055c8e768ed8b3498a74c47230758997424d3feedb2006b4c5df14f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909018, "uuid": "2cb5ea68-3766-4358-815a-c33bd4ff9ae6", "comment": "Malware payload", "value": "cff13301cfaa20dd866b6303323c3f358dd1516b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909018, "uuid": "f6964387-9363-4d8d-9dd3-affa2349bc96", "comment": "Malware payload", "value": "d9f9a8e5b0137608ed1917e3d0882aa2901736551b3459365a126aed2e1e59afbc835a1402122180542084f58c0fa614", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909018, "uuid": "459394ea-9195-4061-b51f-046e452ce35e", "value": "T11FF47D107A80C031E66E1031496D9EB6467CA8380B35AAEBB3C9767D5F746C2BF3751B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909018, "uuid": "5cdb6c1d-3b45-4cd9-a358-6ba73407d4ee", "value": "598c7304b433b2775b735f254b94529a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909018, "uuid": "29effc10-4879-44ee-aa22-2c544dc006c4", "value": "12288:bJtUVo3q5PTbUFMVtAUUNqGD45MI/mXzp31/jM/S5NBJg22Cg1Whoepu/SKz04av:bH9q5PTbUFMVtAdT31/o/ENBJbWWiecW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750909018, "uuid": "5a77cc6f-df95-4687-bd92-397143fcae45", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750909018, "uuid": "d56147b7-ff89-4676-bd36-fb30319a3608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909018, "uuid": "3a3a81eb-9757-4401-9cce-c5d98aa4ecfa", "value": "fsk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9675b17b-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975922, "uuid": "516164f7-f64e-4320-81c1-1eecd7933f16", "comment": "Malware payload (Mirai)", "value": "8010fd9726c6a98d3c37465de19ad513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975922, "uuid": "8342fcc9-9eae-4bc1-8db9-2f54400a35cd", "comment": "Malware payload (Mirai)", "value": "9ef9567d6eade39af9e004eef75b7a4879a91db01c22c8ec12e8eea038d1abed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975922, "uuid": "578d4204-f6b6-4332-9e3b-fa20b8ae8d26", "comment": "Malware payload (Mirai)", "value": "63a69763f4fabfa5eca539c2263ba402c4a5c638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975922, "uuid": "45e5ffd3-3f04-4927-84f5-b3053449daa1", "comment": "Malware payload (Mirai)", "value": "b2585cbe888a04e4ec97ce5a72992ed968db14624a7f6a1fa9ffba4a9f6446383db96a1e50e0eb918effe97bdf654726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975922, "uuid": "20d66c07-66af-4aeb-b71d-e7abedceb584", "value": "T132A2E01472A32D56E3ED1C3CC9AA835BF9A71BFC90F532757D411620C94D20A3E39A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975922, "uuid": "826f307a-d3d8-47de-a176-74c6313a80eb", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjqA2whymdGUop5hp:TvQn4j+ZO5fKAlxD2ws3UozX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975922, "uuid": "03a8545d-c1f1-450f-81f9-c7e4f459597c", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975922, "uuid": "97d4246c-4750-4a26-9e49-66b6321e2752", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975922, "uuid": "adefa640-1544-47b9-8ed1-92a95c428d23", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3322685e-528d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750942685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942685, "uuid": "d46a4a02-c923-44aa-8723-7dfb0337fff8", "comment": "Malware payload", "value": "a02795056f7070408a3ba3523611897a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SRB", "colour": "#E9C68B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942685, "uuid": "b9b7a67f-7516-447a-a349-e2247c45e7e2", "comment": "Malware payload", "value": "9f68329271bbea3de177daed034b1bf328a6c158ddbff7c47e0a3ef3490eb7ad", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SRB", "colour": "#E9C68B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942685, "uuid": "de9675bb-3eab-4f0b-9ede-13f6100ab942", "comment": "Malware payload", "value": "6badacdbf8b97e5f37d3ed2ab783b0ec276fbe2e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SRB", "colour": "#E9C68B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942685, "uuid": "468ea3c1-2484-4595-bca2-9ed23b6e6569", "comment": "Malware payload", "value": "2d8c22682ce5a443120ed1e63c5f346dbf52c8306c772e0d54bc6969641391c6752bd22ec14210dde5f02ea0e3b604fc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "SRB", "colour": "#E9C68B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942685, "uuid": "e55fcf82-3ebc-426c-9948-08bbc09e79bf", "value": "T16E34227A47A42808E74040FA4877C349EBE3AAD19B71703E76AD0764CD9E5DB7BD00D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942685, "uuid": "7d1cdb03-2b77-45d5-a1e0-7145f482f8df", "value": "6144:GBL4a4KU10fHWcdzY82LQooYTKk6beKXE/Yo2KLy2Ue:qL4nKw0fxixLQWekW4Ao2GJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750942685, "uuid": "35a3c967-5a60-47fb-b538-4c9499f2f694", "value": 243479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750942685, "uuid": "f6aafeac-2c7a-4708-b42f-0f5734a63d06", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942685, "uuid": "e6283e91-ef34-4daa-8a0f-43be7e75ddd8", "value": "PWMLE250909000009.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe7e3d3-523b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750907487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907487, "uuid": "d8638871-9043-4ec7-b9e4-d2145ba23926", "comment": "Malware payload", "value": "22a17c84432e04fd78c9b03dde06ef96", "object_relation": "md5", "Tag": [ { "name": "dllinjection", "colour": "#4DA85A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907487, "uuid": "04c68c6f-a5bf-4637-a7cc-d956cf9ffe17", "comment": "Malware payload", "value": "9f9045aa8fdf4e9dfab4c343d420577beb6a9f7620742fb44bf2e340f22ccfc3", "object_relation": "sha256", "Tag": [ { "name": "dllinjection", "colour": "#4DA85A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907487, "uuid": "63faf3b5-79bf-4469-8fb4-1fb8a6e31816", "comment": "Malware payload", "value": "06fcee5aac6bb1f993ae045b709d82f292abf6c7", "object_relation": "sha1", "Tag": [ { "name": "dllinjection", "colour": "#4DA85A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907487, "uuid": "9d705bee-5466-401c-94dd-b477ef8b3296", "comment": "Malware payload", "value": "542c56752974213b367cb57a48e727c27d17a66f8441a64626fa7612dc7d6e5b0807f46bc6ff5ba5f246a1cf7e30c288", "object_relation": "sha3-384", "Tag": [ { "name": "dllinjection", "colour": "#4DA85A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907487, "uuid": "337dfacc-6ff6-432d-8724-4d497d5e1741", "value": "T1CE658C32B416A165E434927BD74B67C5C7AA6E3543E046EB9FCF0BDC0A12DBA0278137", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907487, "uuid": "a46584c7-3778-4f02-b34b-5d5e5b4d9bed", "value": "940e7be79600515b4738832b085d6967", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907487, "uuid": "4d04ac3c-41ed-49a3-a771-33617bb8fc2d", "value": "24576:x360GdfLCdgjEvhN4is+fER1sPDN5mW358fYDZd3UnsozsH8ma29NU1lI:h60GBqgjEvoi7cQuQUZ29Nqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750907487, "uuid": "5ea46cae-3e78-4b84-97e9-e4c9a1713875", "value": 1437984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750907487, "uuid": "53c74234-590b-40c4-8a75-11a6f3152c6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907487, "uuid": "2d77721f-3098-432a-889c-94f2f6ef16d7", "value": "libssl-3-x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a783ea-524b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750914307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914307, "uuid": "1e9fb102-e0dc-485a-81e1-56cef3f9aa49", "comment": "Malware payload (Mirai)", "value": "566415abb22b972312030be1d161fa3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914307, "uuid": "0f2812a3-0be4-40aa-866b-272b6b3c8267", "comment": "Malware payload (Mirai)", "value": "a0887472787e39486f478a5753f74c07cec908c2c269e69f98591a5ad829b580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914307, "uuid": "72a132ab-8ed2-413c-a9fb-82b428905142", "comment": "Malware payload (Mirai)", "value": "cd5d4d6719a3eea8bc37e1c3d5529ea29a75d3fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914307, "uuid": "02647eed-b9c2-4eae-a169-140effde83e9", "comment": "Malware payload (Mirai)", "value": "aee875a47bce376672555c9f667da6e5b02b7ee9744061303d1117b16172580ef09260a837bcb8a93db32b2ed4df843d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914307, "uuid": "09660bf4-7dc7-441c-bcd2-6156a5f6b345", "value": "T1FDD33A17B6D190FDC8D9C1B44FAEE13ADA33B42D1134B25F2BC4AA232E59E205F2D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914307, "uuid": "ffa2a22a-9433-4de9-8b67-479088359e87", "value": "3072:Qny+b8Y3d7A3hgCVcveRwt4i9H+34G90yNTWDf:Qny+4Y3Smt+nNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914307, "uuid": "f3f889ef-cfff-45a1-88c7-2e6aa96e9a6e", "value": 138920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914307, "uuid": "00792b9d-d9f4-4ddf-b01a-b6dbfc266448", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914307, "uuid": "ef9dfcc2-774c-4bd4-88f2-1f1bca594365", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd3b97e-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955371, "uuid": "11b6ba2d-5a33-4705-823c-b022dce296ba", "comment": "Malware payload (Mirai)", "value": "f3f231c7c6cd158286f0661fe2161dbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955371, "uuid": "fb71fcd4-a15c-4ad5-b3b0-21c8da143b82", "comment": "Malware payload (Mirai)", "value": "a0fd07bd0bc13df28189ef29398287355fa4b1d76bd37aec969947d964d29145", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955371, "uuid": "6ee8ffd3-5702-4671-9368-165f57465c07", "comment": "Malware payload (Mirai)", "value": "23119272682b56435b258f8d5425c4def27233f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955371, "uuid": "8a4900e2-c956-42a1-985b-31db2da0f3c2", "comment": "Malware payload (Mirai)", "value": "af9585b02aba95bbc6277fed2a80363051fa9b5202047e268d10118492ef88ebdae98f5ecceddec8a355cf8900123937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955371, "uuid": "f75cc87d-a765-4880-b077-afe1bd528ae0", "value": "T1E6C2D1E0B726FD31C420AC3DE52A4D8A3A510A7C91FF393664258D398FC165B66B84F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955371, "uuid": "967195c3-58b0-4de6-90ce-f6c6d3ae0efc", "value": "768:7MKyhegCCMqfizjoNpd2vJdX6vwrx9q3UELue:QKy4qfqoeJdXWgkLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955371, "uuid": "24f07885-76ce-4938-8c42-624f737b33dd", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955371, "uuid": "7a40a4c8-c76e-49a0-8a05-e9b3bcb07202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955371, "uuid": "fc36abd2-d50c-4a1a-90ab-dd58419b1018", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fd1ec3-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900867, "uuid": "e360d22c-54fd-4332-b077-423473ec78c1", "comment": "Malware payload (Mirai)", "value": "fd1ae8707dcad93c21100073c3c13ce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900867, "uuid": "fa88d3bb-ad2d-4e82-9a38-dd3495042050", "comment": "Malware payload (Mirai)", "value": "a0ff7c6f652f6d3742d702d5cc7fda8d272f2e17b9be7bba48574ede000b6be0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900867, "uuid": "02d42d6a-6f37-4726-bd52-31ccef997555", "comment": "Malware payload (Mirai)", "value": "7ed0e4505ad7bf3f0a45c54b318564c140ede5a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900867, "uuid": "e59d4f7d-5eea-4b52-9b5b-b7c5eab52ddf", "comment": "Malware payload (Mirai)", "value": "b22af7002c80b72c2653c7d6a1d67439d5c206d0d3701f6ab0085656622e2faa98dc8c3c4da6e3b5e1baf5622fe67917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900867, "uuid": "26beeac5-158c-4042-af89-d35b9814231c", "value": "T1F5B32903F6A28CEAC083DA715BDFC1718533FCB50722255A5398FFA52E29AD06F5C295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900867, "uuid": "2c172b0b-fa92-419c-a45f-b5e715f93f1b", "value": "1536:q6com/PuhYBvu6NQhOjh4pjNweWUMdA2le+kGWmklyzIJAgoEQ1It3R+yd5+qWa2:qOSCSyJlWUMXjRISCUI0hpIm2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900867, "uuid": "f99382ca-64f6-4590-90a6-0b9ef4e9c681", "value": 113558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900867, "uuid": "60135c60-403c-419a-bf1b-d0bc6be13340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900867, "uuid": "84626649-84c4-49b3-9cb9-774a45bce9e0", "value": "SecuriteInfo.com.Linux.Siggen.9999.22624.26024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4692bc0a-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913941, "uuid": "4835f727-5946-4696-ad02-ac255e749577", "comment": "Malware payload (Mirai)", "value": "6271b190b9dceae24da12808a3dbfd06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913941, "uuid": "ec524aed-e684-4929-a390-84e462d35cd1", "comment": "Malware payload (Mirai)", "value": "a1295dfce66fafca9b182a316fab97cb2d61da257b31b4067dae872186dffdab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913941, "uuid": "809d6c5d-e848-4831-a311-269e27388d78", "comment": "Malware payload (Mirai)", "value": "a1004cb9fdff3b3491e9e9a0049153c659ebba9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913941, "uuid": "4fffab1d-a1a1-47d2-9f81-758592f12f1d", "comment": "Malware payload (Mirai)", "value": "77982e96e87999e7044db801991979803a529ba1f0ef145f934ac798354a9ba34bd0cf072e22463e6bcb4a1f2e9a826a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913941, "uuid": "ea476f57-336c-4233-8dd9-36edb676ee94", "value": "T11873A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913941, "uuid": "4394709e-17bc-4fd5-b977-8c98c3dc49f5", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerESt3:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913941, "uuid": "839a84f9-1e3c-48e7-a003-d68ba188d820", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913941, "uuid": "cbdc1963-e141-4080-aa5a-204f1163d63b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913941, "uuid": "d9854653-e440-4cd0-8d06-187caee3c4b6", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f8c7e1-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750914160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914160, "uuid": "984cf751-98fe-4274-ba52-3b31b13b09cf", "comment": "Malware payload (Mirai)", "value": "1210666ff9bb4c21194172658ffff22f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914160, "uuid": "ce073589-a259-40dd-a633-b0b68b3e15ca", "comment": "Malware payload (Mirai)", "value": "a15d3b74e5e955eb1cb04474d3e0ccc9095dfc33bfc217c10d05c23cb9b39fe7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914160, "uuid": "52c4cdfb-5e2c-407f-97f2-9157e05898f6", "comment": "Malware payload (Mirai)", "value": "ce2db9c9cae920a22eeb00b8fd5f799f019e33fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914160, "uuid": "c7269d72-e68a-416d-b381-f976a87af2ed", "comment": "Malware payload (Mirai)", "value": "d765c06a84bc59d2254e8b9b70f9c4b6ba3d2fcb48244f0dfe4a7c7f615a6a43729d9a7d927bed4d8d2e4ab0d58cefa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914160, "uuid": "6185e2f1-6ddc-41d5-b777-dc4e296f0c09", "value": "T1FC230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914160, "uuid": "83d6d042-bf56-4f53-bdfd-eb1205f5d82a", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THk:5DmKF7Gxyk8cqoHAmWurAufsG5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914160, "uuid": "e4883375-2aea-4d98-b7a8-c63ceb0fafac", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914160, "uuid": "0a861392-88f3-4048-8e24-d6af3f70be72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914160, "uuid": "d1ea4bae-8d04-42b0-bbae-a91bb7b19394", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e20b972-5290-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750943911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750943911, "uuid": "5a877485-d7c4-4a99-af20-99833b4d80ef", "comment": "Malware payload (Formbook)", "value": "c9a09e5ff1f3a079e97b83dff5cbdbbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750943911, "uuid": "a31b56e1-ca20-4613-9897-92344e311cba", "comment": "Malware payload (Formbook)", "value": "a17117280214fe71571039b3863859bce0282d686f7cb2f0082c533170dc79a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750943911, "uuid": "97605d4c-6f31-47b4-8bff-4b3939b8d768", "comment": "Malware payload (Formbook)", "value": "a7916fd4dd9d1190181ffbb016ac4fcec5a13a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750943911, "uuid": "627cf6dd-50fc-4b1d-80cf-09d6f396e0a1", "comment": "Malware payload (Formbook)", "value": "470da5fd7bcc0b770d70e9614290ebbc862ed21b4bc8a601230400d9e92dc92b4d03b6b5777ee2a46b2544a8f0ea16d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750943911, "uuid": "de10a5f7-a4d2-4ac8-babc-5977a2eb168f", "value": "T14355CF027391C062FFAB92334B5AF6115BBC79260123A61F13981D7AFE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750943911, "uuid": "f46d888f-f2e9-4dea-bdf0-eb5ea5955718", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750943911, "uuid": "f67ab91f-3669-4956-ab1f-5abd32ad0821", "value": "24576:h5EmXFtKaL4/oFe5T9yyXYfP1ijXdakXnvsERFarsSNh/Hd3:hPVt/LZeJbInQRakXvsTbH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750943911, "uuid": "7cda40eb-bba4-4b3b-a036-a32a34178762", "value": 1299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750943911, "uuid": "dc6140ae-f438-4d55-a9aa-e616f751c4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750943911, "uuid": "079b54f7-d5d2-4603-8d80-5b192900372b", "value": "SWIFT COY_MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fcb069-529b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Numando)", "timestamp": 1750948976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948976, "uuid": "165062a6-ccf9-4d62-8ff9-8250777dfdc5", "comment": "Malware payload (Numando)", "value": "949034b67757ecdbe7640598fb5b4d77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948976, "uuid": "8954b7a4-face-4eda-81cf-7edef5d3f188", "comment": "Malware payload (Numando)", "value": "a219bc86b8a24eeda123133d5a8d3d7c886807f75bd82fd42c318059fa0f1c2b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948976, "uuid": "eb5fb9d5-5431-41b0-831f-9674796c7249", "comment": "Malware payload (Numando)", "value": "6f30a0273738217b99b884f1f815e3c9f6b6406f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750948976, "uuid": "ec0a0c13-e7c2-400f-ad9b-d13968ecce80", "comment": "Malware payload (Numando)", "value": "f634a5486ba5edaed1bd13947b46da581360a745c6edce18a04b26c1b8a5032f64a6b9f145b4046cab8428df8e308c7f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948976, "uuid": "46cbf32a-ff4f-420c-aa1b-441126b118e7", "value": "T1317612860A6F9C3BE143B772C9A080D62F256E39F291F1D60CA1E1A763241D767D067F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948976, "uuid": "dec990aa-f5e8-4843-b4ea-7ffa07b759dd", "value": "196608:ohrWt4/Oak+e5XjTqRYlS8AZPfFAAl9hltkhqI:mri+mjNlS8AJFAAl9hltaqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750948976, "uuid": "52d4f20b-9bc9-494f-a9a8-26f6f97305d4", "value": 7280640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750948976, "uuid": "4cd6a476-065b-42f9-a792-8aa0af197807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750948976, "uuid": "1448b96e-d652-44e1-bc01-ad3e50c3f3e2", "value": "tdh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c04ade9c-52a8-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750954518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954518, "uuid": "1713eaee-5926-4b79-855d-1562db17a97a", "comment": "Malware payload (Mirai)", "value": "a06e54fa47c165988d90efe53fcd3cf4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954518, "uuid": "d545c105-f84d-4cc5-88f8-8e7e3a39d72b", "comment": "Malware payload (Mirai)", "value": "a24f2ed9c57a01a8caa5ed25c9d0a979a64df8502b0f2b41eba54939a590bf6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954518, "uuid": "429bdf7d-e13e-4ae3-bc96-1aa740c51fb9", "comment": "Malware payload (Mirai)", "value": "e3d46199daee22b64d6d13ba6793fce5cef0a85d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954518, "uuid": "5931d539-05ea-4574-b500-605122d90186", "comment": "Malware payload (Mirai)", "value": "39030dba3dae2ab1886499d61e6b941f93a340e8b77e46f65354dd317473efbd3b5f707c074d2c44b02ada7f635826c1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954518, "uuid": "093ebcb6-f1f3-4fa9-a616-f224573c2061", "value": "T1D91150AA286139E64E395E47F4334364B02E96CDEA318F04AD8F58BECCD67003914B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954518, "uuid": "400678b4-bc10-4bff-add1-5193fcaf7359", "value": "24:4URUKJUSNI7PUqKOUSBU9U0qU4tJUAU41oSUNozUIYogUIGoVU6KvGUuQtU6:jm5qiElg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954518, "uuid": "329a13f0-ed16-4b01-a674-bfab123c0d28", "value": 1051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954518, "uuid": "19ebc672-a412-4790-b877-77e7ff254891", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954518, "uuid": "de5fa88f-3c48-413e-a822-05e292cae9a7", "value": "wget1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fdb052-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978064, "uuid": "86eea730-a96d-4098-aab8-204a16aa5cd7", "comment": "Malware payload (Mirai)", "value": "18912ff8d9942cd4613d2e357ccabe43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978064, "uuid": "24f59757-f181-4f58-aec5-d468efd1b71e", "comment": "Malware payload (Mirai)", "value": "a2d0fff559766e35086d8cb7641b96f1d47681fd33bcced49c3d5c6f7c9abdb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978064, "uuid": "6b86e544-7561-4b35-8ecf-838833612f0d", "comment": "Malware payload (Mirai)", "value": "c2b830b31513c2246cac55003af729831cb0d372", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978064, "uuid": "969e95c7-aaf2-48a1-a98a-b70570343239", "comment": "Malware payload (Mirai)", "value": "8ef2c6f017b67fdacd100bf25889232cfac3f96f3b377c294faf1a02ec18cdcfe0853e7f60d32e5b3de25356d07c0c8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978064, "uuid": "eb253b39-2582-4ec7-ba70-a2028bbab96d", "value": "T1C1832A85FC819A12C6C5167BFB2E028E37266798E2DE3207DE15AF2233C761B0D7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978064, "uuid": "184969f8-d49c-4bce-983d-50f5beb130d1", "value": "1536:UWZ3Ty4FBs7qnUOkY9RlsBS4N7smZYAXjP2Bk+TavRDN:UWZjy4mqU29/4N7sMTDRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978064, "uuid": "ffbaa189-d49f-4135-b988-3114149a4448", "value": 87528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978064, "uuid": "3674ff26-d2b9-40f7-a5b9-89a0d88f7cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978064, "uuid": "81710eac-dac0-4a95-9581-0e57061d7860", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bce13e-5235-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Expiro)", "timestamp": 1750905007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905007, "uuid": "be398ecc-2b12-4bfd-a591-2ad6d32649f7", "comment": "Malware payload (Expiro)", "value": "b66e1459c22283ec971e550285993bf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905007, "uuid": "b461ad72-75cd-4e02-9dd4-aad3ca8c60db", "comment": "Malware payload (Expiro)", "value": "a351e0211912bd7edeb74053a2b27ef04e3189a80780171d8a426818cecf0b0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905007, "uuid": "f770cadf-105e-4696-b33b-98bc39b636dd", "comment": "Malware payload (Expiro)", "value": "bc4bb3e45b02a01406db650059c28e1cbc13acf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905007, "uuid": "2e41ba1a-ace3-44ab-9bb9-e0a697a1ce84", "comment": "Malware payload (Expiro)", "value": "a5761f1ac7f5628cd35725c8ce18ed1e6f602b7f895eed765e3a407846a5da3d773b4385332386c4ae82548e8ac3bc98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905007, "uuid": "2bf0bb1f-f33b-4eec-9218-16282a43c4ae", "value": "T1BB95E00273C1D062FFAB91334F5AE6115ABC79264123AA2F13981D79FA705B1473E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905007, "uuid": "993038f1-53f9-4c2c-b4ca-ce563cab140a", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905007, "uuid": "c8bb228b-7266-4457-9ef8-9cee1c438772", "value": "49152:MPVtHLZeJbInQRaKN8mQSpTLNiXicJFFRGNzj3:yLYbInQxQSpT7wRGpj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905007, "uuid": "41b73e3a-6f74-4c92-a2ac-e095494b3457", "value": 1877504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905007, "uuid": "a8306d7d-5b97-4f83-814c-53a8ee25c71c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905007, "uuid": "6f715f5c-2045-4ef1-82fa-1a0abb26a7f6", "value": "rDHLSHIPMENTSNOTIFICATIONDocument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223e3511-524b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750914309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914309, "uuid": "0dcf6130-eb61-4398-8630-67959dbe998e", "comment": "Malware payload (Mirai)", "value": "a5e334ea8b8e832b852318bcb3c3df0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914309, "uuid": "3975b2fc-ec7c-4458-9f82-ee79d27ccd29", "comment": "Malware payload (Mirai)", "value": "a35f0c080e75ba08b862d9ba7e343f834e45fe738832207c382938e289485f61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914309, "uuid": "ec7d06d6-9bed-4a2a-b32e-8179a0721750", "comment": "Malware payload (Mirai)", "value": "1ac2f681fb1b4e2591f5931c614dee7f7ea8b91e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914309, "uuid": "88c01c94-7793-4030-bc36-507bbd367796", "comment": "Malware payload (Mirai)", "value": "dd85c9b0b23188dd09d9a6bdc7de2afbed74f9b8a4219961c56d1e639ddf097983dce38c170c39b1aa13334d58a716e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914309, "uuid": "d84423ce-93b6-473b-b822-8b448803f948", "value": "T167549D67BB0A8C6AC1560AF94ECB075C5733C0004F1BDBDB7A2C26386E576DE9D5AB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914309, "uuid": "3d261ffa-bd98-4e84-b45f-c89b006726b5", "value": "6144:RBFoZa6vYgrT4r4S6aK41GD7C3htDinqh/0svfqfBYpmRf+:RBmRvYyT4ML48iLink3pmRf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914309, "uuid": "0794bf74-a7b6-4104-b284-837a39e31bcf", "value": 289848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914309, "uuid": "76907d87-abcd-4e92-8196-5d161cbc5a25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914309, "uuid": "31b91770-8cd5-4c4f-a64d-17785e08a08e", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972f949c-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975924, "uuid": "ff633d79-237d-4ced-b0ba-91ae8de2b9cd", "comment": "Malware payload (Mirai)", "value": "f877d3beb12171e06ed7ee34adaf7044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975924, "uuid": "b2cba738-911d-4331-b963-bc2df7ad037f", "comment": "Malware payload (Mirai)", "value": "a3866b2508480b021856e4ceaac7fc0e597ae478cf22919926700454fa8cc3b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975924, "uuid": "6ef364f6-a7ec-4f47-92d4-b5334b219b30", "comment": "Malware payload (Mirai)", "value": "d18f838274b4ab44b18d374a18a1c9a0ed90f6e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975924, "uuid": "01f9e346-5b10-40a1-9f9f-e5ae41d5b9e1", "comment": "Malware payload (Mirai)", "value": "42cd4db55517199dfdcab052956794c1aff9795f82c192d1cb17cc8e65680ec9874f1d59252fc39b9aa488653c677f48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975924, "uuid": "046dca4d-1a46-4b6b-97b0-515ba9a383c9", "value": "T14F932A81B8816A22C2D113BBFA6F01CE371967E8D2DA73078D251F6077CA91F0D67B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975924, "uuid": "a41ff9e7-4aee-4d98-a186-c0cabd9f6688", "value": "1536:8dNdrR+WG0DWvoARDP9a4bb1xW6eIjCZoKeZW155Vxgrl3fWCIAvgP4:8dNdFJkZJCZLwYjnghukgP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975924, "uuid": "15765f33-d4a9-422c-9b42-d7c9e4975d0f", "value": 93336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975924, "uuid": "e169e737-b83f-4e5a-b1fb-5e670bf2c7c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975924, "uuid": "e0791120-ffc8-4b16-8024-34c0944c0086", "value": "star.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950f7da9-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975920, "uuid": "80c88c74-9415-4a72-b304-b640e9afc4ce", "comment": "Malware payload (Mirai)", "value": "b2dd5cb8a8be7251cfae6bee55066b41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975920, "uuid": "9d2f5aec-1d1e-4ffe-805f-88e8f1b1ccd7", "comment": "Malware payload (Mirai)", "value": "a3cc71689e847026fe2e950ad758e82ef02f2b74a24fa669df0e1a0ceb26a893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975920, "uuid": "2b00fc0d-8957-4a4a-9f70-e49038671ec2", "comment": "Malware payload (Mirai)", "value": "e57e112a85a105764d59d8d2c354a9e510e0e620", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975920, "uuid": "7e6a9d3e-41f1-422c-b0af-2b6f052d4e14", "comment": "Malware payload (Mirai)", "value": "2f9075db3d3b698e9472633858e6ee07abf34c1c192e8cc190049573a0c4b798c73804f56249e5678c61bc6aabb78e14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975920, "uuid": "cdefe432-5387-43ae-9847-5c6c152f16b8", "value": "T106833AD7F800DDBDF80AD7BB4453050AB6B1B7A106831B36675BBA57FC321A55822EC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975920, "uuid": "ffde43c4-169c-4be5-bdea-cf9777ada1f4", "value": "1536:ilvzHnW1xuqcANjT+i08ByyMFj+kgPa4J+zV6NPnIVAiYpeWcC4Bk:ilvzHEKQjT+iTyyMFb/44zVKoYpeFC4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975920, "uuid": "53041e5a-f14f-4f79-8aa1-893291fea620", "value": 84848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975920, "uuid": "caa4e847-00f2-468e-9c34-31fc731842a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975920, "uuid": "8d4eb8a3-e544-4833-8e2e-317e2c7033fc", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a545dd27-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975947, "uuid": "b89b8a7a-719c-4d4a-bc57-83a9d4bb971e", "comment": "Malware payload (Mirai)", "value": "5d0f96397098e2285f5b5f19de785511", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975947, "uuid": "677910c0-10c1-4253-a2a6-1fee243131bb", "comment": "Malware payload (Mirai)", "value": "a4dd1be688215334d50a21ab8e66778d6369ad79c667e1f5e822945fd772c704", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975947, "uuid": "c52a5381-16b5-4df1-9bb0-15e2ace346fe", "comment": "Malware payload (Mirai)", "value": "ddaae8c72be158c48dd18878e146eeb72b1f6ad6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975947, "uuid": "8d04b993-6540-4f03-91ac-83994a34f5e0", "comment": "Malware payload (Mirai)", "value": "c42d2315b4a5c00d4c2baa63c5d73eb563fb218436bb82eca59aa7a658197c822c06274df82a122acb9bec8ed7156fad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975947, "uuid": "3928b71c-60a4-4b49-9d91-90723af98c8c", "value": "T1C4432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975947, "uuid": "f4a30489-981c-423a-af45-683219c58726", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAw3:RqtmZPuutfbltZFBSJsBcfDSTFI+BE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975947, "uuid": "95d81ef6-d09f-4596-918b-4053aa470567", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975947, "uuid": "7c7e2918-ca72-4c00-adad-fa4b6a279a60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975947, "uuid": "f44f0c23-641e-4ac4-a0af-bea3f37957b3", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171ddadf-52ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955952, "uuid": "29eb9538-d76c-4ee4-aea9-e61cc8bd279b", "comment": "Malware payload (Mirai)", "value": "7ee4c27ec2b72963c5279fa9107a391d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955952, "uuid": "29f255bb-5554-4e9a-adad-0a36c1d68887", "comment": "Malware payload (Mirai)", "value": "a72ee92a97daf5ef9cc221ec5863be80e1ba89bfe8d037ef9da3e51aa7457b7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955952, "uuid": "c4cd3420-6348-4801-b36f-9297aab86254", "comment": "Malware payload (Mirai)", "value": "22706a633beafcaba1c6ada5820ed34190b104a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955952, "uuid": "89149870-1677-4a8e-a81f-e4eebcf0bbaa", "comment": "Malware payload (Mirai)", "value": "fe60d92f269368d24e80be2e254d4238390424ed146f4f63eae85f53112a15e1c837289886aeb2c12615c38a0d178b7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955952, "uuid": "7d2335a7-7759-48e2-82c8-d9e8fa0c1809", "value": "T10F836C03F1E264FDC483D5708ADF8176D932FAA91324396B1381FE712E39E226B1D695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955952, "uuid": "ddddc605-0536-4eb2-9a06-f884c2c41fb2", "value": "1536:KRcTOLYXFlBvcHHumw4VjWSe+oMYrcxwQkXWmklyzIJAPoEQ1It3R+yd5+kWaT0+:KSxnKCn+oMZ6aInUnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955952, "uuid": "cd24e99a-3b32-4d57-9c37-45f6008e769e", "value": 85720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955952, "uuid": "b339c1df-6630-461b-ade2-fdd2917fbcc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955952, "uuid": "c4f5f972-6643-400d-98cf-b9993a9bc1dd", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233fde9a-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913882, "uuid": "dda17570-34a8-446b-959f-cc632042421a", "comment": "Malware payload (Mirai)", "value": "ee83f42af1800a87fe92b8d1bd07e12e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913882, "uuid": "9ef46cc7-588e-41ad-9f7b-a09fbf6919ea", "comment": "Malware payload (Mirai)", "value": "a8df7a6f8fa6146d30c20e0ca7f8ac849e0ba8596a5b01e3a3c6cb720c736420", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913882, "uuid": "7a5f1703-d27f-449c-9a1d-72ff0b51b012", "comment": "Malware payload (Mirai)", "value": "2b294fe8b48e92a34650264a06cf83dcd06723ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913882, "uuid": "f6a6b023-7a6a-481f-81c3-21f44630814f", "comment": "Malware payload (Mirai)", "value": "6bca851d1ecf3445062bb148c4500ce3918bc468f291ed0682aaeeafb26d3a727d0e1cba817b1532daa4622b3dbeb2ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913882, "uuid": "11a18632-82d6-4a2b-a7bd-de33fa3b857a", "value": "T11AB2CF3C1B151B98DA1EC0BD83AC1B603CB41B359182AD4B7216EDD7AF968B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913882, "uuid": "84209eb0-9846-434a-b958-99602e78b954", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiD1dmdzJgGlzDpH7uNj1JW:neD8ZSWvZHZbs1row697qohQvg9D1dit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913882, "uuid": "fd53990e-b16e-4a0f-808d-51c3f19ae1db", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913882, "uuid": "6d024e1a-91d0-4476-9587-7728eccde256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913882, "uuid": "10d7dbca-3631-4fe0-866d-af70943bf21e", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05e58e1-5275-11f0-8bd0-42010a9c0005", "comment": "Malware payload (KoiLoader)", "timestamp": 1750932614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932614, "uuid": "f9f05c48-fa19-4c08-8aa2-b28779e9a94f", "comment": "Malware payload (KoiLoader)", "value": "5efafed007cc07b950f5d928c96c2bb0", "object_relation": "md5", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932614, "uuid": "92ef0d05-c990-4fe3-9b29-4263300f0a9b", "comment": "Malware payload (KoiLoader)", "value": "a98ee0ab10df4ef87d008738ba9ec6106ea423f20258d8fe878926275961e7e4", "object_relation": "sha256", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932614, "uuid": "0cc9b19e-07a9-470b-8cc5-eff99f227750", "comment": "Malware payload (KoiLoader)", "value": "16bf036299ccb2f5c28df04696f91b288e5bd3cb", "object_relation": "sha1", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932614, "uuid": "582fe2ae-8908-446c-a3ab-142515f2677c", "comment": "Malware payload (KoiLoader)", "value": "6fec2eb348508329c1988d654170cb0da07158d7f4a92099490428abb5dea6547094b1dc03ad58e657f20223b6cc97c4", "object_relation": "sha3-384", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932614, "uuid": "a7492121-b230-47af-b2d2-e5563a39f7f4", "value": "T127A464EE676E1C9B0D873B7CD3415A92EE8B15A1026180DFF5DD592AF4CF11AC0A0D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932614, "uuid": "c4f2c9f9-7830-4173-b8be-c2f41dcc9a4b", "value": "6144:S4MQ8/9J3u3BiCb0ZoWe24QbTAHd+FN4VeAGqOh0OHS7fz4QjXIPe0GdcN6R33pm:S4MQa3VKcFKhHYxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932614, "uuid": "f194c3f1-bf05-40d6-abfc-8a06a67a39b7", "value": 478111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932614, "uuid": "db45896f-757c-4914-a10b-d735d39618ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932614, "uuid": "b5c29fbf-a642-4f4d-814d-8005068481af", "value": "sd2.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb96d230-5248-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750913305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913305, "uuid": "c9bb7ab8-c185-44bb-80ca-b8bcad0d4ad7", "comment": "Malware payload", "value": "7013868b267b5a0639f55c52b2d5cb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913305, "uuid": "fa21432b-392f-4982-9448-79df21372d10", "comment": "Malware payload", "value": "aa2834448a445d123ee91d132627227b4c1940c0300cc285ced323221de2d0e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913305, "uuid": "a0483084-0ab4-4942-bbfe-1699bc062007", "comment": "Malware payload", "value": "80d6d0d5634aa13c81343e51ebca98f34f62d0a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913305, "uuid": "61dd8a2c-e2c4-4d0f-ad84-1c2d7a13955c", "comment": "Malware payload", "value": "b93466eb0e56f33e81b1b77c09751dae0e4dd0938876db8b9af08d8e36d316fc7b73d3c5648e8d58c381ff4d44739eca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913305, "uuid": "a0a19e67-07a7-4046-adfe-19ace1e83581", "value": "T13356CF92A58392F3E941127422EEEB3B0E208E26935599D3F3D03D733D702D17A7E659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913305, "uuid": "d507b90d-ca48-403f-ad88-f3bc3dd3f74c", "value": "eca0b1c8739a014a6689db4f17d7e95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913305, "uuid": "d233ad82-4d0b-41d0-a881-4ed6d87a6eb6", "value": "98304:OV2r+E6gzteoiUe6P1BCHnrT5zhZfEa1qxKDwCVLDCGBqg+1LjHjrDZ:1QUxipV1qxqwCVLWGBq71LjHjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913305, "uuid": "56ab1414-d664-4838-a1d3-ea7a468e2372", "value": 5963264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913305, "uuid": "c64aae1b-528a-4a1c-ad41-474d12707e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913305, "uuid": "c7b058e8-1a40-44dc-9440-06901aad727a", "value": "SecuriteInfo.com.Win32.Malware-gen.8328.20809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c840f8e6-5240-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750909863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909863, "uuid": "5ae32ea7-b764-4383-9117-979cbf1f6a91", "comment": "Malware payload", "value": "4f8aaf74541b2d03a28ba1bd262dfb77", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909863, "uuid": "778fa272-9274-4428-9ff5-330d69b21ce7", "comment": "Malware payload", "value": "ab07a7e2f4d5337f647fa85fedb4f4ba18984971bc5c4a36e8ad4934726f5d8a", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909863, "uuid": "e1acc335-701e-4811-9b59-af3b136fce75", "comment": "Malware payload", "value": "e01e9c301c7eb18d2159bf9ed039d88dfee8355b", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750909863, "uuid": "379bf872-9b00-4ef1-b4e0-abc5cf63ff72", "comment": "Malware payload", "value": "db3bb8b5ba729f4c5cdd640eb7e644c8b2e76adf07d4caa835f618c9202eacacf4347203371a9a0e3357aeb31937cb93", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909863, "uuid": "1a704145-9239-4e22-8430-435453dc5313", "value": "T108E2BE06DC910498FA46D916A1BA356E81FEFB1F96C03886387D8F967F00C518F9698B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909863, "uuid": "d94dfe2b-745b-46c4-b473-ef426656cde6", "value": "768:jVGZfEldP6GmSF13VLrtaLYV+csgO0djwvTPcPndebzuM2YZ7b4:jepSF3rqYV+cD9dsYFebyQ7b4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750909863, "uuid": "e70029c1-04ca-4aca-9b79-0a0171fd9a27", "value": 32899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750909863, "uuid": "a73db0fd-c4a5-4a48-a800-cdb1659b5208", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750909863, "uuid": "e24d8bc7-f1df-454f-85b4-3d2e413ca628", "value": "mugoxusojiw.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69badd32-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750977995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977995, "uuid": "54a4e188-5a9b-4e30-b34c-d8d598a0dba0", "comment": "Malware payload (Mirai)", "value": "d1096c02b76a1fda23f95a2c3aeb5c67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977995, "uuid": "68cd301e-8d10-4a28-af53-41090bc4e9ba", "comment": "Malware payload (Mirai)", "value": "abbe5d105b12ac96a3e908cabfd14ce3e163517cfd23d63c0a4796c82a7797b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977995, "uuid": "e8a8ad20-3907-402a-896a-801cf7dd7d4e", "comment": "Malware payload (Mirai)", "value": "2219fbbf7af692b2f26bcfd8782605f24ece792b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977995, "uuid": "0b720e77-b7ed-46fc-9e8d-415571d79c29", "comment": "Malware payload (Mirai)", "value": "34118848702553c9091a0bba07d4f21b09c07dbdbd1c85684c2a89d20a6364c604d14d23b61d4ec4b7e555cbd9e9f786", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977995, "uuid": "0b196c13-4935-4a42-8365-26317b0ce3af", "value": "T1A8030134E17D0709F02A507C0A7F6B6B4275C65E515482B3DDD4543AA7FAB229D28383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977995, "uuid": "dd335ec9-1724-4ddd-89b6-a1a6d24bcd7c", "value": "768:UGFcwcCljgDTLs1QPjInIIad2CiFYCKn11FvUJcc/3NnbcuyD7UHQRjE:rFNcCRgreGjKIthiFYCKE/vNnouy8HyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977995, "uuid": "739d12ab-01f8-4918-90c4-94e549d0620a", "value": 37852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977995, "uuid": "3e7c9ecd-2356-4b91-9bab-e76dc717e862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977995, "uuid": "bfa5779f-92b9-43d5-a801-9cfc521aa78e", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247e4205-5243-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910877, "uuid": "09d72830-f57f-4c18-afd7-caa304209f3b", "comment": "Malware payload (Mirai)", "value": "4360ce4a77ce403f67e5479cc5eae889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910877, "uuid": "556ec68b-5fa1-4169-a44e-848d3711f37c", "comment": "Malware payload (Mirai)", "value": "abc7cd9d84ae7e2871291a23072e6a73dd2a8e641395a50ad516a068cb9f19e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910877, "uuid": "74ddd3d4-5ef6-4a58-9bd0-30b76090c9ba", "comment": "Malware payload (Mirai)", "value": "745f8da5e4b9c991857a1112d7988307e610892a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910877, "uuid": "60b446eb-02e9-4b21-93fe-abc7406e51f0", "comment": "Malware payload (Mirai)", "value": "4e9d6e659040c1bae94092d56f4db559ac3214a6323216ffb05d1b57d654a0c5fc579524a17c82e72a437e7a2da0dfd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910877, "uuid": "57edd5d4-26ee-4660-99bc-f6cad69d0484", "value": "T1D1331841F8D299AAC6C4137AE63E258F3351B3A4E1CF3617CD596F2173CA60F4DA6A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910877, "uuid": "06372ee3-1161-46e7-9f5d-7eee11273782", "value": "768:RZyplITJkFxEIqNAV5dtr65sKwmw0ampi5A2arMo9kiELaeMqBNLnsKmz:RWKOEjqcsKwmw0wTarFELR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910877, "uuid": "cd0d09bb-aa0c-4045-a305-5b09c8f9826b", "value": 50616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910877, "uuid": "26b5754f-5b56-460c-9621-20046986429c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910877, "uuid": "4e9002d0-f3d2-4858-9b8f-deb3f9c01915", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da56f924-527b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750935234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935234, "uuid": "2226c8ec-879b-4e96-90d2-6fcbbee27ed3", "comment": "Malware payload", "value": "2c24bf7dfc92e7bbd79d5984507de25a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935234, "uuid": "19656236-a213-458a-9ac4-8e5431bf3e5d", "comment": "Malware payload", "value": "abd6e107b1bd7246f5adfbd21185fce8ffc40476640152ea54aad1392c662615", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935234, "uuid": "e39462f1-a1e5-4299-ad82-293989d670b1", "comment": "Malware payload", "value": "922c0793ec058eca47c30c2f7b943aa92cb4aeb2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935234, "uuid": "e98c2907-5b89-49c2-a633-b66c1ca4c133", "comment": "Malware payload", "value": "cdb49f545c69f19bf477ce2a4ed5c2155e7db5d817d47c3963312c010ce1ec72373e0731cad20d1f70476c94cf1a3d71", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935234, "uuid": "9eb3ba9b-03e7-4b11-96ff-c6a15f359b16", "value": "T12F1138CF6662CC60DC615EE936924828E48DDAD436CF8ECCB1CD4066E89DD0430A1F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935234, "uuid": "438dc19e-3e68-4997-bbfd-926deec5ea8b", "value": "24:sEUSIbK5zOt+MB0hZpZmkRn1ikRn1Z1WkRnU7kR5:sEUXK5CEA0OkRYkR1ZkkRGkR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935234, "uuid": "bf600e6f-4922-46b5-8de9-3dc4aeb0a366", "value": 951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935234, "uuid": "eea5448f-974f-42a7-91ac-93ccd10321e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935234, "uuid": "9030fec2-01fc-4c4f-9db3-f7f8987aacb6", "value": "vc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c64e73-5249-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750913639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913639, "uuid": "8ddadbfd-445d-496d-9d77-46c4252e24c3", "comment": "Malware payload", "value": "8a6bbc05fabf61a9d75e27960339b4dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913639, "uuid": "3f8bd7cc-3100-43f3-aa1b-c5d36d28a542", "comment": "Malware payload", "value": "ac178f1980664b01d06bb4155df9eacf6f29c3fd0ab09de06a3489b42403fc89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913639, "uuid": "53a33f1e-3cd8-4dc3-92d4-8d5c7b521579", "comment": "Malware payload", "value": "f07395250ac27661f2deca3d70738c82dfb7f9c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913639, "uuid": "aed9be29-c70d-4bf1-b39a-eea33d6a6104", "comment": "Malware payload", "value": "58f87afe713465a7e104a19afd41ef94327022ea6d0d3c293acbf84a295bf8902abadb5c4aa8afc97b9fa4a87df9bca5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913639, "uuid": "e13e68b9-1437-43a9-8933-038be238f183", "value": "T106B401CE9520D295C4B02D33C57BA2F282AB6D3609596E1CDDD8FF6B2CF67450638B12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913639, "uuid": "f469fbcd-747d-47bc-badf-9b3343f0166a", "value": "12288:NbX5mTA3bZNKiG01B7crv+SF7GW5a65jx:tX5m83bZNKi3B7AZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913639, "uuid": "ecf40bac-5811-4deb-9035-e26598fc031a", "value": 502120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913639, "uuid": "dc6690a5-0572-4d1a-b437-743beb7eb9d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913639, "uuid": "85c9fd2b-e453-4015-8721-2644a9ab8635", "value": "s390x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9fe256-524b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750914568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914568, "uuid": "401539c9-5e32-42c5-b946-7c509286b8c3", "comment": "Malware payload (Mirai)", "value": "ccd1ed00c1f01c398be622740533badb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914568, "uuid": "a26190dd-c7b9-4a8e-9626-3c7373b292b3", "comment": "Malware payload (Mirai)", "value": "ac59770df12c2ed4c93cfc5386b7d38560859f46bf2e7318e62131b9148c125d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914568, "uuid": "2f228db7-91cb-4d06-801a-e94af35800be", "comment": "Malware payload (Mirai)", "value": "ba8610ee0c1d57273a6644b8873fc45356dcc0db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914568, "uuid": "027b8685-bfbd-43fd-ac85-067fb6c6b3f9", "comment": "Malware payload (Mirai)", "value": "bd62d8f291a28eb620cb24ff0c05aabf9998da3e2eefcf2b2785b8314840ee99ee6d7b204a7eace337d9bb4dbb768fb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914568, "uuid": "0684b4df-dd40-4b69-a626-66306b101006", "value": "T1B5A37D89D283DCF2E81604B1513793779B72D43B603AEE86C32DDD75E896900963B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914568, "uuid": "44407c66-4a58-4732-ab1e-72d1c4b2ff6b", "value": "1536:zlp3ZUevQgEHBpGLKp+BjWt2+po+jFX9TYIt50Sgfnve1ijX:zlp3ZUYQgETGLKp+FR+posFtTXhRMjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914568, "uuid": "8574c396-837f-44b9-96fa-781877a95e17", "value": 104396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914568, "uuid": "c5da5e41-c1c1-406f-9a47-bbe29f14f1fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914568, "uuid": "614276a8-64c4-4120-8f95-2a528452e6a2", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6ae52b-527b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750935073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935073, "uuid": "ced187ce-2cb1-42e4-823b-1b857714059b", "comment": "Malware payload", "value": "e804376d6089c80923ea83e6bf9ce9bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935073, "uuid": "db41e516-fc0c-4e0e-82ce-85cf13020982", "comment": "Malware payload", "value": "ac8482945dfd2c60aaa7a79897288ec6fe1fae3a3d68057b982427f202e4eb6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935073, "uuid": "b51c51c5-e634-4d34-ba7e-2dff4ec9aaa6", "comment": "Malware payload", "value": "40d02fce13fc463747e27ffadbe90b40fb07b2b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935073, "uuid": "af08194c-7b88-405f-b757-64c5dce79143", "comment": "Malware payload", "value": "d119bcc0298dd04c34370770ec4cab6d909a69618b7f7bf66f80726688164c9b0a78aa37d5973112bbd3f288775d0c9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935073, "uuid": "540dec81-23f0-44a2-aaa2-a85756d9a274", "value": "T135E4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935073, "uuid": "a997bcdf-fbf0-44f3-b381-a8079bda2a42", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935073, "uuid": "fae9be0c-9f5f-4163-a438-48c250f16908", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935073, "uuid": "740bd094-d3e6-4931-839d-adb88d2322e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935073, "uuid": "eab83798-cc5a-4a31-ac8c-ff714dfb00bb", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c937a7-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975792, "uuid": "0043fc6a-a8a6-4887-91d7-43f2835f60c1", "comment": "Malware payload", "value": "3576340db97edec4f81b35539dffd27a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975792, "uuid": "eac99170-36e0-432f-b20e-68795a55d58f", "comment": "Malware payload", "value": "ad2f9a32822b6a1679a44a6e8c0240ec4f062bcfdb77aa58bec051df6a493204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975792, "uuid": "9fc41165-7717-4a74-9f22-8859f2639815", "comment": "Malware payload", "value": "262e4215bc1747543f88c0f18af7307b31ccb151", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975792, "uuid": "cc62cf48-29e5-447e-a395-852315cae360", "comment": "Malware payload", "value": "4dfa3b83e040b3da945b807944f359e15ed815647e83b91de8b32a7bfcb6d02157edc751ae1d8633fcbcb45f341e0d47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975792, "uuid": "4c5a3b81-7380-43a8-bbb8-a28cd7187763", "value": "T146923A528DA85E14E65CB5B4E0310B35A723FA26E7075FBE1D2645948083F8CFA9837F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975792, "uuid": "a0c20bd6-4569-4ba9-b29f-f9b1481479bc", "value": "384:c/tgCbSJPQOQDEMWFXg7r+Efnxdv0hnjoA+I/sqBQIm3zV:Wtg8SJUmyvpJyoA+wsTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975792, "uuid": "7a9d81da-9df0-494a-9bae-e0e3359b0a14", "value": 20772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975792, "uuid": "c7179da3-c614-4b2c-b69c-879aeed9cddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975792, "uuid": "2bf847ce-fe8a-4ab4-9edb-352fc3365333", "value": "violetsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5f180a-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975956, "uuid": "851016c3-62f8-4a5a-a52c-f53384c555a5", "comment": "Malware payload (Mirai)", "value": "de074295165bba23047c24703da54b20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975956, "uuid": "a82cdda2-7557-419b-b3b1-c46a3416e518", "comment": "Malware payload (Mirai)", "value": "aee3b9fdfb2963f7f87f612c08f36dbb227055db0cfa46ad06f5b6b1c83e6eff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975956, "uuid": "feaaf55b-e870-4af5-9f49-fa22ef717402", "comment": "Malware payload (Mirai)", "value": "3c03261813657ec49169e3ae3dd009c765938a2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975956, "uuid": "3d24f5c1-0eba-488c-b1f8-dc917f571b45", "comment": "Malware payload (Mirai)", "value": "8654eaff422d422351e0a264afa169949749be771edbcea5272459c6c94917d32a720302a2bb77b1a1c09fb3a14aa499", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975956, "uuid": "a33f5ddf-3b58-4930-91d8-b18c29b26461", "value": "T14FB2D03C1B151BA8DA1EC0BD439C0B503CB42B7591829D4B7216EDD7AF968B47453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975956, "uuid": "7369d7ab-3a20-4923-8729-7a2d5027af37", "value": "384:YeD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiEqmdtJgGlzDpH7uNj1JAu:YeD8ZSWvZHZbs1row697qohQvg9XitJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975956, "uuid": "786e2894-947a-42c5-b30b-ce3ec241fa96", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975956, "uuid": "42083d90-8770-46ea-ae06-9556aa7fbfb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975956, "uuid": "8d95f6ae-014f-438a-82ed-84a37b257be0", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb0912d-5248-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750913307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913307, "uuid": "678feb9f-351e-4bd1-b6b8-4b94f0b33b74", "comment": "Malware payload", "value": "f5353572130d43a00e5db6a00045b388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913307, "uuid": "48b7fa9a-7566-4f47-9f16-13b0cb29cb27", "comment": "Malware payload", "value": "af0a7aa49cac9fd7fffe23243b0cfcacc506c84f07449dc1e3702a587e4f2f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913307, "uuid": "811f4b21-b22c-44a3-bc07-79e4bca08175", "comment": "Malware payload", "value": "ba043189793903acceb8e01d3f472b8871546f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913307, "uuid": "448c2535-adcf-4795-bff7-e4aadd9daa2d", "comment": "Malware payload", "value": "39c5938e695a78d5e428ceca5f279a28ddb0c598017173b33dd7ce0ab0059a3a768d18708e18fff75bcd1bce1651f76e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913307, "uuid": "9608992f-9ee0-44a8-ba0a-0ae4916e2237", "value": "T1A655E029D291A1EAFC7A00758551A1A5B466B52786383FFF8390EB734F0BBC48F2D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913307, "uuid": "b12d4f25-f924-42c9-8d78-49c10a3c7252", "value": "f1f4088bde79fbcfaa711f90bc2bbed4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913307, "uuid": "cc3290d8-58c0-4c83-a54e-648364fbe9bb", "value": "24576:gavuxytTiH9b2zpYfN38jalKVn9JtbwIAcZfN38jalKVn9JtbwIAc:gavuxaiHCpYf9+IKntbjf9+IKntb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913307, "uuid": "6c2e147b-3e91-4ffa-b51e-03ef64b75c34", "value": 1291264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913307, "uuid": "0594adfc-ef8f-45ae-b462-d78d198bf518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913307, "uuid": "b55a1ff8-4625-491c-bf38-c02122d21d2e", "value": "SecuriteInfo.com.Win64.MalwareX-gen.16675.30547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd55a1d-524d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750915292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915292, "uuid": "63aa4d3a-2fa1-4423-943b-7818b52d64e8", "comment": "Malware payload (Mirai)", "value": "719109fbc1d21675356cd7c06614ce1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915292, "uuid": "9f8c7b89-b4ef-4426-9c47-7c3f21766b4c", "comment": "Malware payload (Mirai)", "value": "af8c3a9558e5e0b3ec35d231bcff2007b5f8f07942828bbbab235724876e3d5d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915292, "uuid": "3356d1d8-19ca-4013-a300-03cc43a6eec8", "comment": "Malware payload (Mirai)", "value": "8cc6ae1780bdba45c03b7df9de0c6d1244d6174d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915292, "uuid": "d2a4c96c-ac65-4053-9654-7cf8a1d7ed65", "comment": "Malware payload (Mirai)", "value": "3b865b610d9e7683582991ea6eebca4db7d1d2a4f759528e984ca1ffc0c1b9d6f31a3823e1796bbd8318c71947c93409", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915292, "uuid": "0b3bf086-5c8d-45e9-a58f-77fd5e2c0c33", "value": "T14F012CAE287174E64A399E56B0738754702C96CDFA748F08A54F58BF8DD7B00341CF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915292, "uuid": "586c709c-c6c8-4b47-a5a9-7090a6d1cf1d", "value": "12:4URUKJUSNIl5PUf0LKOUSBU9U014U4tVR9UQBXU4BU:4URUKJUSNI7PUqKOUSBU9U0qU4tJUAU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750915292, "uuid": "e0e3447b-4c9c-42f0-8500-3762a2f54c3f", "value": 657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750915292, "uuid": "36687340-c0aa-42ad-8954-79bba86e9569", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915292, "uuid": "b5f33e11-e406-4bd8-9d19-9ecb3965ec5b", "value": "li", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26991c27-5272-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750931067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931067, "uuid": "a20a1ae3-408a-4d01-b3f2-1cf648e565c9", "comment": "Malware payload (RemcosRAT)", "value": "96ed7d7fe0a803659949543a569355e1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931067, "uuid": "76958ffc-c3f5-4a27-a8b4-5e1ea4061deb", "comment": "Malware payload (RemcosRAT)", "value": "afaa94f74bc92314092321e200a3f455545b47035ca44d10800e646d752509e6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931067, "uuid": "036536e0-9763-431d-833f-7709338a9eb4", "comment": "Malware payload (RemcosRAT)", "value": "de24aa6602b4a7449eac4d7d7834736a46fa6cd0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931067, "uuid": "b6743fca-1b7a-4c00-bec0-0f7fd0c03a79", "comment": "Malware payload (RemcosRAT)", "value": "2f90f2ce2265486f44302e7c32bf0f8dce4186d0e93d89b78752e5921ad4c673034562bc803afd5c6fdbc49c4b54ecc1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931067, "uuid": "613bad3c-917a-4761-8015-d6369eda4039", "value": "T10BE533527CAA3A7E07FC436421621B4D6FE65FD0485C659F276270C221DFB52AF3B828", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931067, "uuid": "9a43de58-9166-4bab-9947-a1df7cf4c8cf", "value": "49152:6DKgYFyVPNGKX2NE1paJspGarXpemeYvDCsGy8Vreq73:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931067, "uuid": "11d1fa86-166d-436d-8882-f025df993fd3", "value": 3255485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931067, "uuid": "b90d14f3-394e-4196-a027-238d374cff70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931067, "uuid": "b867f183-187e-49f1-b641-3d756fbdffd7", "value": "HSBC BANK_Payment Swift MT103 Copy.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d91ba00-52b0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750957708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957708, "uuid": "4e59209e-9718-4d64-aa15-bfde73992a5d", "comment": "Malware payload (Mirai)", "value": "f1785a6302184c24fa495dd7b4adb75e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957708, "uuid": "daa5c8d9-5ce6-4d60-ac7c-923ec98862fc", "comment": "Malware payload (Mirai)", "value": "afbedf07e67976de1305ad7cac2cab0db1eab33ad9a790c7158cd82b44bbe3c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957708, "uuid": "362b5d28-6e2a-42a2-be17-31f00a65520d", "comment": "Malware payload (Mirai)", "value": "f205f18b3f35a486d1024f8b252abfcd735b29d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957708, "uuid": "91fe37a8-e6a2-4bf7-bc81-a93e3b7a7d36", "comment": "Malware payload (Mirai)", "value": "ad55d799203c0d4a564316263e863ba94c4ca5055dd8f56dc56c92202ff4f58757857cc472bffccfab9896e77c6301d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957708, "uuid": "c43e6a75-1404-48de-b7d6-342304569bf8", "value": "T172833ACAF753E0F0DD5606B1116FF77A8235EE125420CE6AEB98FD71A932642A11B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957708, "uuid": "b93230fe-7944-47e1-a44e-1e1daab5d659", "value": "1536:6zmGrH6qxBAV9lo3EKJEtTimoMwd6rCfGUG31gDZ+Lkp3uUaAr:YaqxB89lo3EK6tm3dGFK4y+UaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957708, "uuid": "c1153cc6-3961-4327-8ff9-e97341c81691", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957708, "uuid": "37787090-c58f-4e28-83e2-b31b5a898a77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957708, "uuid": "41ae7fa9-2961-48ab-a1ee-83aeb450058d", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc73058-5235-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750905044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905044, "uuid": "9825e583-bfbd-4e84-a253-d119f12cf1f7", "comment": "Malware payload", "value": "2fa934b5758fb5078c21d1614a4b3771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905044, "uuid": "5ccc793e-916a-4ba4-8a87-ef63bd433762", "comment": "Malware payload", "value": "b04a953a252cf24db6458b9fa3148e3ea60ee3f047dfa49e6bc987aaa81dc222", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905044, "uuid": "f2db7694-e246-4fe6-9205-199f7b76eb86", "comment": "Malware payload", "value": "36965e3586ab51f91c9636a8f46632ce3f03f782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905044, "uuid": "7606a61f-eabd-4d6e-ba18-841b206bef9f", "comment": "Malware payload", "value": "050c724518753843dd03b4f43b6669ca04960660f706ebab2273d1bc4070f267e049256c9f5f8769f18eca7eea03799b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905044, "uuid": "7894b30e-c30b-42fc-94a0-17687056175a", "value": "T1451833C05814E442DE7CEABEA50882EEE29DA33CC6B2D74A75DE0121F039D54FA5F857", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905044, "uuid": "f57f8783-c187-487f-a4e9-3a7c8604e94b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905044, "uuid": "397b3340-9dbb-46e1-8e1b-d38f4f9be4e6", "value": "1572864:abAPbLwDUEJYGNfGT9+TGZTVHXi5vVKuuGevDkBPwxbomyxYYMa7ww+e8SJ:abADLwDUEJYEGT8mFySFGcDkNwNpfw+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905044, "uuid": "cd2aee33-988c-4e67-8297-a0db0e567dde", "value": 92170239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905044, "uuid": "84f5842a-39a7-4714-95af-c78fea55f15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905044, "uuid": "b670c506-fb63-42d9-9556-482163b38049", "value": "MSTeamsSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428b6628-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913934, "uuid": "09d9b328-d9ef-434b-adf6-ca03d40e0f0a", "comment": "Malware payload (Mirai)", "value": "a09c153474a866a1d44d292d0099903b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913934, "uuid": "559b7caf-11d8-4e52-8c05-844c3a97ad42", "comment": "Malware payload (Mirai)", "value": "b04d7c4b186ab3b2f1e506b5a4ad5071488d2cf6df9040e85e37da0067f9e327", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913934, "uuid": "78a382b6-c537-48c5-a581-fe3f3c805741", "comment": "Malware payload (Mirai)", "value": "2bf2d4e941d6010561cae2ab477a3c1a4d663a16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913934, "uuid": "25bc73f4-aa71-4f8a-8985-56bfdd9707d3", "comment": "Malware payload (Mirai)", "value": "aaaaab364e8b77fbcc81a564bcda444cbe4f5cd5db1580daa557dce6a2eb7f0c3eb66b2c9f101e547fb28a8f7111d5e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913934, "uuid": "a36304c9-b305-4825-8291-94d61956fa07", "value": "T111431891BC819A23C5D4137AF56E56CD372133E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913934, "uuid": "f5e66e9e-3766-4ac8-ad7f-1dce75cee278", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913934, "uuid": "d9258174-5fbc-49b8-b6b4-4853801046ac", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913934, "uuid": "9508c838-e77c-4143-a109-a7ac589ee4de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913934, "uuid": "dadd7a88-0fdb-41ca-be09-8720597bced1", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95a2bb4-5236-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1750905597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905597, "uuid": "55e938cc-3aaa-4b4a-bac1-c796a4342375", "comment": "Malware payload (Gafgyt)", "value": "086bb2fca5a26d146d4b96078569b786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905597, "uuid": "24051ae2-52a7-4d0a-b40c-d72f82b81d89", "comment": "Malware payload (Gafgyt)", "value": "b0c11d40c9239d2d78d0dd0e5a95e016ac019a8ab87139e477b7a1d975feabdc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905597, "uuid": "63ec8a9f-e5e5-48d3-bf52-d5ebf65040e0", "comment": "Malware payload (Gafgyt)", "value": "65244f9439fb518b83be6ec90d2f999311e81dd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750905597, "uuid": "160c18b1-4bfc-4e8a-a8a7-e4c21a498fc1", "comment": "Malware payload (Gafgyt)", "value": "9a92d051d2dd1f4d7a7f240c98ca656ddd4c373daccd4778a5925620e58e981df05fb5546b07c9fd35b53eb201cf7567", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905597, "uuid": "b82a6378-3b7c-4cca-b9b6-140fbd53633c", "value": "T106240802A5558A53C1C31FBBBBDB435937336B5493EB33059A28BFF43F866991E2A101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905597, "uuid": "33eec38c-4f9d-4471-8f0f-712d9410e9db", "value": "6144:zOPoKGR6e8j5EE3QkFyhXFvvNpwTIZMSVFicHiH3kq45ImxAdkZGfwYOt35u:aPoKGR6e8juEAkFyhXFvvYkMQicK4ymY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750905597, "uuid": "d18e76e7-ff88-400d-ab7f-9a56daea6f2c", "value": 218120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750905597, "uuid": "2670f019-be01-4e47-94b8-47ecced44fc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750905597, "uuid": "6c8f53dc-32a0-4be6-a29b-437fa1ea2316", "value": "SecuriteInfo.com.Linux.Siggen.9999.23116.18193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a604f28-5285-11f0-8bd0-42010a9c0005", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1750939207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750939207, "uuid": "ac6a2554-dd08-44fc-b57a-0b18779da03c", "comment": "Malware payload (VIPKeylogger)", "value": "7dd513548dcffba21dd4be06eca0a278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750939207, "uuid": "3e2847a0-6387-4c6e-8c16-eb83a1faa2b7", "comment": "Malware payload (VIPKeylogger)", "value": "b1cd3a6f70f6b776be9a823bdaab800991bf34aea11cb642574da80b066ad9b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750939207, "uuid": "9eb860bf-cb66-4f34-8733-5f267a053cf2", "comment": "Malware payload (VIPKeylogger)", "value": "40dcede49148cdc23f1eb1695798d6dccb63245f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750939207, "uuid": "c6e0afca-4d3a-44ea-968c-398250439be3", "comment": "Malware payload (VIPKeylogger)", "value": "520dcb7e81fa268328bbf992446c122c20ad7fdcc748e65f5983a7a36cbdac7f71d4ecad2f82347842a2dfeaa03b2feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750939207, "uuid": "6e38bdc9-ac6f-44b2-a1eb-90e4f4ff00a1", "value": "T1FB8523E07558D183C98D19722FA7C6F667603C22CCA6CAE373846FCFAD35251884B75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750939207, "uuid": "b0c259cc-7400-495d-84d1-82ae25621317", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750939207, "uuid": "b5df9ec2-b902-4e2a-8e40-faff547a2e77", "value": "49152:PR2XPlili64S/TmN6M4wm4WWfrQsYqZInV:PR2XPlilLmLLWWyq2nV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750939207, "uuid": "0ab9e8d0-1c08-40f6-8f30-335d9a82b173", "value": 1716264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750939207, "uuid": "26abae5c-e3a7-4e39-946c-04de9b20d625", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750939207, "uuid": "4c24610f-7b89-499b-a60a-3650fcf439ab", "value": "rFACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef36626-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975990, "uuid": "7820f44e-9924-430f-a0c7-b10a21f1b166", "comment": "Malware payload", "value": "99b525f2f71cb52b91489ff085f716c8", "object_relation": "md5", "Tag": [ { "name": "45-88-91-119", "colour": "#3C5145", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975990, "uuid": "5be0cf8c-37c2-4910-a402-5ac090b2bb81", "comment": "Malware payload", "value": "b1e49abd9b0d7c411ff72b94e6c75ba7da1d3fefdce3777ffa64e93734621509", "object_relation": "sha256", "Tag": [ { "name": "45-88-91-119", "colour": "#3C5145", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975990, "uuid": "1bac1563-73a6-405d-9187-b0e0c8000990", "comment": "Malware payload", "value": "67a6556721dbba5c21ac8fbc082900e573826384", "object_relation": "sha1", "Tag": [ { "name": "45-88-91-119", "colour": "#3C5145", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975990, "uuid": "e2189ebd-3e4c-4f33-8bf4-60952e3d365c", "comment": "Malware payload", "value": "24fa8f8d4af7fa778b76f6e758a67d9e2bb18fb57852825f24a635b5bcb606640993502ab1d8b09700c15d3d74e04373", "object_relation": "sha3-384", "Tag": [ { "name": "45-88-91-119", "colour": "#3C5145", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975990, "uuid": "ed45e28b-c852-441e-87d0-dafa0394fe40", "value": "T11095E043EFD5E4AEC5F393378A76027641075C6A8783D6834AD9B23C09B79C09E95EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975990, "uuid": "1b68be7f-3de9-4824-8bc5-7ae9db79279f", "value": "49152:mgC7r929yN9dWudKYUJf6L6CMs1BsYn23MIYuhPCCn:xyNa9YUBqZpsW2cIYICW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975990, "uuid": "a429078d-c61a-4906-a2c9-d8a20e37212e", "value": 2010919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975990, "uuid": "3e52ff79-fdc3-4c2e-862c-0aa5edb067f0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975990, "uuid": "83340884-8fa4-437a-b7c1-264df34c8f2c", "value": "b1e49abd9b0d7c411ff72b94e6c75ba7da1d3fefdce3777ffa64e93734621509.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161a4325-526e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750929321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929321, "uuid": "1d2c69d7-71be-4bd3-b658-f31308f76028", "comment": "Malware payload", "value": "7cacf7a5ca1f78467c9e2c0773549cee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929321, "uuid": "f96fdf16-d420-4ed8-a358-6e793f1c68a0", "comment": "Malware payload", "value": "b30bce4f30fa2443adcfe0586e95cdb420791dfea941b544389b52b588a4c7f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929321, "uuid": "dc3df168-dbc4-49a6-b77e-7e624ce2171f", "comment": "Malware payload", "value": "20359f49d1074d7bb62c50139e4d93e1cf4acd0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929321, "uuid": "d24db4a0-8a19-499d-ab1d-760d59ffd265", "comment": "Malware payload", "value": "3a5378d78efbc023f56f1ac2d101ad38f08ddcace9f110e7d7e0ad2f9d8da300ea3cee710a5566367a5bff4199afea38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929321, "uuid": "a43d0121-9cab-4963-b370-a633616bef0a", "value": "T10DC4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929321, "uuid": "055226a1-bdbe-4ae4-81e1-7ba1a719d6b9", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zK:W7v+mrY2xzf03yvZ/YIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750929321, "uuid": "78f28c60-5fff-44ec-852e-d281ac084a7b", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750929321, "uuid": "6985c233-6823-403b-8dac-f64fb3e82830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929321, "uuid": "c7d08d42-794b-4c92-8b24-2ccd575da4fa", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc0af96-5272-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750931348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931348, "uuid": "35684381-d9cd-4da1-b88e-84b34cc27cce", "comment": "Malware payload", "value": "b9b34bc678fcfdaf3cfd400af15dfcd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931348, "uuid": "4485bbce-d4f9-4d4b-9a1d-fa137f2331b2", "comment": "Malware payload", "value": "b338710ebabe547abeb55ba0507d2fc1161a3944947c40138ed98312721c9a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931348, "uuid": "f507ba41-0b92-43c6-ad62-e04c5d437c3c", "comment": "Malware payload", "value": "6d7edade3e9090ea7083c22025a7a11ad772d7e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931348, "uuid": "72309981-2ffe-4058-95fa-7a1cc8e6312a", "comment": "Malware payload", "value": "20d79a2197573352bfefd62ad9d210f3ad45bb5fa09c510eec8ed5a85c8ca114d0a1e095d51de8d84e1a24ec4cb77b92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931348, "uuid": "d7519703-b7cf-46a5-bede-5b81aae355a7", "value": "T1CE16D0CEA733E3BCCFB910F64D4A1990900D85EBDED9C8D1DA998530E6EDE24580F295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931348, "uuid": "ad6f7048-d8d6-4e57-bd65-cc59b7f963c0", "value": "49152:WJjNsL9I+cVKYJ1RMZ7V57g7I0DywdVKBo6cF8AHAnG2+17SrwDq1lNF+N:6eC/KYJLMpsDy3BcsTS7SEeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931348, "uuid": "4afb64e9-a428-4ee0-9d73-09ae1530509b", "value": 4341144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931348, "uuid": "f897cf73-b5b5-49e3-a05a-b217ac952b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931348, "uuid": "66014c2c-fff0-4481-97b6-4112c82deb96", "value": "filerino.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f5dd1c-52db-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750976101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976101, "uuid": "1ed19d2e-7e55-4bba-9910-fca0abc7819d", "comment": "Malware payload (Mirai)", "value": "53358e5a368fe98926f66eef5c4ad8e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976101, "uuid": "03c7514f-f595-4d3c-9a7b-acf2c3ef90f9", "comment": "Malware payload (Mirai)", "value": "b3c64b16f1945410390767e4d3e59a32c996457cf477293b39447763364fbfb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976101, "uuid": "2c172d21-9f67-4181-b921-65ce0f88898c", "comment": "Malware payload (Mirai)", "value": "246f6da8fafbe634e0874b681ca1468f66a3d926", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976101, "uuid": "db016601-a001-4e2f-9680-6778c5934335", "comment": "Malware payload (Mirai)", "value": "6fb39541fd300044012437edf99cd9a42c913f34dcd2f486c913ffb08b7c444984f98680f832e17f0db0f512b0244e63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976101, "uuid": "e72fe776-2f97-4a19-bff3-5ec3856eab42", "value": "T19463951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976101, "uuid": "1fdf87ad-197b-4613-b489-fb1371cba9d2", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatAL:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzoL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976101, "uuid": "dada0c32-a0db-4dd3-9b91-8f12be2b46ed", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976101, "uuid": "3d5f4379-10fb-4741-a7a6-7bba038c5866", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976101, "uuid": "2a435c4c-6b87-4721-be0c-8e501e39fdb6", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab90e86-52a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (BlankGrabber)", "timestamp": 1750954911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954911, "uuid": "4ca2743a-c676-4be9-bf03-1d576a0e09d8", "comment": "Malware payload (BlankGrabber)", "value": "447f446d3d1fa4ea57581e06bb162c45", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954911, "uuid": "cce7c2c3-ef64-4875-acee-f0070683e83c", "comment": "Malware payload (BlankGrabber)", "value": "b54b9cc66b0311ca5fb2f33d30d9c096e27d509967e65d118f117844ccdb5635", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954911, "uuid": "64c20ab1-193f-40b1-8554-07279e7aef7a", "comment": "Malware payload (BlankGrabber)", "value": "72fcd40b4907ef40d5db43d50e181105ae15df2f", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954911, "uuid": "b936c47d-3650-4948-a401-f3d56caff6de", "comment": "Malware payload (BlankGrabber)", "value": "e322c6b596dd48d1d481590f322358dbd17611b50a26f4400fb719dc9c75f3ea119a57d8b650481525fed56ddf24b036", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954911, "uuid": "3fe5513d-fbb7-4bfe-81be-d2f386f425ae", "value": "T166B633086FD625F6F5F6453C8C52C83AD772BAA21F74C2DF01A942681E17EE1197B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954911, "uuid": "7d69a85e-2719-40d8-a550-76a7cc4f0af0", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954911, "uuid": "636ec711-871c-454e-afed-9385f8e18c19", "value": "196608:fSpNcvR1YRj9fZwQRCgjmpXHIEGn7jdfPjRMsqeXL2yrjAnDky/:6pmIw8ERIEgfPjSDNWCky/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954911, "uuid": "18b1cca5-8557-49fd-a123-0c9059392ff0", "value": 10626628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954911, "uuid": "025e16f9-c550-4769-94c9-f04dece9b4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954911, "uuid": "51116cd6-f521-453f-8e26-ef04816c56dd", "value": "builder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c6f8d38-5249-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913521, "uuid": "53cb514a-f0ef-4df0-853d-277457c8d07b", "comment": "Malware payload (Mirai)", "value": "b394a28adb2b8b6bcb9474e53021f09e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913521, "uuid": "3ea1da00-d2e1-4fac-aca3-6c1f0bfbfb9f", "comment": "Malware payload (Mirai)", "value": "b5cc8a675fa5be0085eb699db2ea696b8e27557577e96b08b57c2dbdc8bfb134", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913521, "uuid": "58a9eac2-d8ed-469e-98b8-1e6eac584ea5", "comment": "Malware payload (Mirai)", "value": "ec83c9e327ca12ed2b5eea01efb71d09128cb32a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913521, "uuid": "18d50252-fd09-438a-8c93-517c710e7113", "comment": "Malware payload (Mirai)", "value": "406678365d441631f9e311bbb06972bc39329e89d337bfed2ee924c7e0214706ba14cbe08c3eca4bec3f3bbb69768dd9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913521, "uuid": "44763239-ac68-4408-a71e-cd63e6502d15", "value": "T1C4342C93F515D9F7F40AE73308D34B257172FBA10A531A32A3277B799A3A2C4245AF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913521, "uuid": "472cd3bd-5692-4aee-9737-2e9f24a6f9cf", "value": "6144:xEOT8mNNQekacWVcW0JcWcBsenKp0pbLfkTUp+4imDFAUZAgwQyjOCTj:iOKeMUp3imDFAUZAgwQyjOCTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913521, "uuid": "d115d21d-7a68-4239-b543-ed308df1b7ca", "value": 232471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913521, "uuid": "0b0cf7d3-b7d7-473e-86f3-ccebca3bec70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913521, "uuid": "114b86b0-2da4-4310-998d-9f152dc00354", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6acfa42-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Gafgyt)", "timestamp": 1750900868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900868, "uuid": "81c7f4c2-f9e2-463e-b25d-6ad8b3752778", "comment": "Malware payload (Gafgyt)", "value": "5e9068789509d9ee46fa714526119605", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900868, "uuid": "1d4751a7-2b0b-4486-b276-a71f0d410848", "comment": "Malware payload (Gafgyt)", "value": "b692522a6619621e9751b853077228828c4ef634f77ee2d31b1d08d8a76ddf35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900868, "uuid": "7ea1f9fd-119d-4569-8607-e2294aa24ff3", "comment": "Malware payload (Gafgyt)", "value": "11df48c356eda00cee7fc236d74eceee1f2132b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900868, "uuid": "1558665e-4888-4fd9-87f7-376e430c1508", "comment": "Malware payload (Gafgyt)", "value": "c3740c6604df7cf92f8a81bbbf1b61800eefb98c6b4ca77524d101850201b1a9076b47c2ccedace12970138186a9da03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900868, "uuid": "c3abb79a-2703-4d2f-a8c6-904b8469217e", "value": "T111240901A5158A53C1C31FBBBB9B439937336B6493EB33059A28BFF43F466991E3A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900868, "uuid": "80a4efa9-1992-44f7-a51d-d0ec92e173f0", "value": "6144:uu0xFNyVhvHJqnT8y2QBvaBGPKYGhChiX/ipKCdcImxAdkZGfwYOt35u:/0xFNyVhvHJqnT8y2QBva8fGwiXAJmxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900868, "uuid": "92e9bf23-d113-4278-a850-e46530c8fd38", "value": 218148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900868, "uuid": "131c4bf7-5a31-4017-828a-21fe6984b81d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900868, "uuid": "11e0213a-fe8c-4440-b60c-c4cfa885f0da", "value": "SecuriteInfo.com.Linux.Siggen.9999.10197.14005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f6895b-5277-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750933529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933529, "uuid": "3505e2c3-e039-49b0-a45a-ee1297b71f91", "comment": "Malware payload (Mirai)", "value": "92016e727876865aca80fc444d1ad2df", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933529, "uuid": "aafb07f8-1256-4a19-9986-17bf99c2fa71", "comment": "Malware payload (Mirai)", "value": "b8b56e04900f2211192256eab1316486aee1248094eb8e9af4f74f9d3f85bd60", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933529, "uuid": "255ac00c-1d65-4ec9-856d-4fc26a73b105", "comment": "Malware payload (Mirai)", "value": "4516c9f7ba4719c71d1842a35632ef89c5cc1712", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933529, "uuid": "df00f051-d0ad-4f58-9e7d-a9b0ec566ce2", "comment": "Malware payload (Mirai)", "value": "ba2717473e05c0f5ab1e126754ad08797d5de940ff16c7e6a49467544ea4908532e9c130e533bf334d5c53dfb8a6339b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933529, "uuid": "890082c9-4d86-45fc-b6f0-e105a1678cfb", "value": "T12B0170CE61A1DC719C920CEA7552491DF4CED5D926CF8EC8A1CD0076E49DD047192F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933529, "uuid": "4490cb1a-7dcb-4a1b-b19f-a1fddeb88950", "value": "12:NLGEULnWKDbnPZw5ZMoOF7+MB05L73Nvx73NMDNknq73WyTx73WygDNkI:sEUSIbK5zOt+MB0hZpZmknq1ikI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933529, "uuid": "3ad46cdd-94d1-442f-813a-a91bd3230468", "value": 709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933529, "uuid": "1f88d76c-79df-4eac-80b3-de3e04e20c77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933529, "uuid": "e629c5b2-b64d-4ea7-90df-b8d1cf43a0ce", "value": "tvt.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb90bcc-52de-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750977441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977441, "uuid": "69c70d84-a8d1-4e39-b07f-6067018d0eb6", "comment": "Malware payload", "value": "6d817173761764da16faf8d41112930c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977441, "uuid": "237c3760-da38-4f73-831d-046cf44ef856", "comment": "Malware payload", "value": "b93d585eeb28f0ee8416f0528dea08f023b1bcf1a30f14d8178bdd93b658f840", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977441, "uuid": "72c4fe3a-9ad6-4b59-814c-c0de4a5bb795", "comment": "Malware payload", "value": "5505e4535743c0ac90841e4bbce5f232288d379e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977441, "uuid": "2b2fd93b-1e7c-4573-9d8f-01149a2dd309", "comment": "Malware payload", "value": "6aa5f115d63d1fff67057c039ae5eb261388f72f30a4980340afed05d1313ef0b045e050338448e2081a3f7edee1a976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977441, "uuid": "6ee3af5a-770f-4989-826b-b7bc517bfa33", "value": "T137B402118F881F8BC5BFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D096783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977441, "uuid": "c9650884-ff1e-4858-af77-80fb78cdb275", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977441, "uuid": "17327abd-db2a-4b17-b2cf-fd877f82fd95", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977441, "uuid": "e4c203ee-dce8-44fd-adf0-84b46a62be18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977441, "uuid": "cb5fcf62-c05d-4682-bab2-7f8793f51d13", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28765ece-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913890, "uuid": "21e84ecc-10f9-4e0c-93c8-e57113951f1c", "comment": "Malware payload (Mirai)", "value": "8072ba60b54d74db91522166adaaaa2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913890, "uuid": "0e9425e5-c0b9-4ae6-9afb-21a705353b45", "comment": "Malware payload (Mirai)", "value": "ba4f23715fb6e98a3b8223786be0bb01e7c15187bb0ce0f95c222b45803bda1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913890, "uuid": "e314ed3e-3e9b-450e-b325-deb074fba932", "comment": "Malware payload (Mirai)", "value": "31eff934ecd6e7484f53c552568bbf79d0f1d53e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913890, "uuid": "732edf0a-86ed-4263-93c4-b9eacee52468", "comment": "Malware payload (Mirai)", "value": "0a4a9e6f9d0f5f71272f4e95b18942c17719bdb530ab13a60982b3c77d9179bd3b8dce022574cffb06471b37aeb9292d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913890, "uuid": "fd276751-0189-40fb-bcf8-3033bc56b44e", "value": "T16B633DD6F401DDBEF84AD67B4C134E08B272B2510E670F36A767FE6BAD35158281AC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913890, "uuid": "230c997c-b997-4053-8198-ff68721d1273", "value": "1536:JZPIA6Rc5ET0g8Fn2rUz6QeuacWjcW0JcWcBqnfDO+BPn6f8ur8K:nPR6Rc5ET0gEh6QeuacWjcW0JcWcB0fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913890, "uuid": "7367dca0-0fe2-4d99-92de-0ab11fade6f2", "value": 72072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913890, "uuid": "a1a66796-5a45-4726-9c73-be8f958239d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913890, "uuid": "ae699bf5-e154-4b18-b267-af38050124fa", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92037386-5249-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913638, "uuid": "fe8dac04-4744-48d8-b13c-f5fa39294855", "comment": "Malware payload (Mirai)", "value": "516c1f72e25c1a56792b756ea6fccfac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913638, "uuid": "fe3440e8-d8b0-415e-9784-bcdb32dbc5b4", "comment": "Malware payload (Mirai)", "value": "bc3678e56bcd7efc3f95299a38cdeb422806c7f07fbcce6c711dcaea845a042e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913638, "uuid": "fee23ae4-167a-4c4c-9d78-54d7b30acb98", "comment": "Malware payload (Mirai)", "value": "f1d2262f2d669f085f48cbf8373ab30091cb2306", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913638, "uuid": "de2d0fe9-fcb1-4c74-9f1f-86b435c14cc0", "comment": "Malware payload (Mirai)", "value": "d1399e45beb7b902c568412ca4b6383111fa1cca3cb2c4ce60825a2137e8e9c08c0946729de160caf0551b552d9a033d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913638, "uuid": "8ad884ca-2e59-45b5-89f9-7fbfb6f2287f", "value": "T12C04E90AAF620FBBDC6FDD3702E9061135CC945721A93B393678D928F54A54B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913638, "uuid": "bc63a75b-700d-4f94-9d3c-1e68a550187e", "value": "1536:RcmG/TsacyZW7ozKbgjiYFwKJFfcT/N49AiG6nujKcmuonNtZT8QHBhlbD5xxvtR:RcmG/Tsac5oeW9dtZ7hvtNsmxS3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913638, "uuid": "52298a90-e7fc-4d9f-86a6-5aea3f58b784", "value": 186004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913638, "uuid": "a17c4fea-8ec0-4e71-9337-587d33617e18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913638, "uuid": "90372869-62ef-4902-9a17-40b618e1c200", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68eecf38-52ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750956089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956089, "uuid": "989666ef-67d7-4a9f-8046-538788c60303", "comment": "Malware payload (Mirai)", "value": "90b90f52622e77ab3657a68e249b4904", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956089, "uuid": "147d06d6-ec93-4d2d-a198-52106fd0622d", "comment": "Malware payload (Mirai)", "value": "bcd3426c205ea35b61022c37dc72ef8261c65c1914ae90d4b66a20e2c9dde76a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956089, "uuid": "5f8a7a17-955a-4e0d-bdf4-40b91d620681", "comment": "Malware payload (Mirai)", "value": "ae1f8c0ace9aa0d41e5f5f2cfce8dd6a46406d08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956089, "uuid": "fea4f82f-b410-4095-90a2-de87d824c759", "comment": "Malware payload (Mirai)", "value": "51746a1c43c9f368d3234521cbdf8f5b2898654256e746c471e4a7aa5f54c979ce4c1568a54bf28696aad31e86a2e5c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956089, "uuid": "82b3c6af-916e-4840-88a0-d045961e4d09", "value": "T1C2B31996BC419B26C6D026BBFE1E41CD33231F78E2EE31029D156F60A7DB95A0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956089, "uuid": "04d22cf6-a373-436a-9052-30f97db670bf", "value": "3072:5YPEUSFcymdWWkxWqeVGZoV7holPFuUkhBxl13jis01:5Y8USFcymdWWkxnG0GholtuUu1zin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750956089, "uuid": "47e22c77-7109-42ec-a1fa-24005e47ca81", "value": 107808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750956089, "uuid": "2088ab0a-4b89-4537-824a-bd210b7ac49f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956089, "uuid": "b4361f55-d70a-4624-b6c5-92723138f1ee", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e0fc8c-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750978148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978148, "uuid": "6e68672c-116e-4c29-9377-6df1d260d703", "comment": "Malware payload", "value": "cb0ba97de24250c2a64d4929f6075cb3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978148, "uuid": "f03d82ff-199b-4962-bf5c-bf1fbddc7a7b", "comment": "Malware payload", "value": "bd4e4438cfc58d7680bc9f5d3283b3bec930f97347f1efd685ccdf07ccc78b31", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978148, "uuid": "c02e5dbc-3708-4490-9537-ff1cb5c38a8d", "comment": "Malware payload", "value": "4aa691aca65e2cc4c3273f16fd8dc43e0b82f868", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978148, "uuid": "077b6dfd-f88a-4889-9635-613a1998b499", "comment": "Malware payload", "value": "f65cd37ccb9a0e71a46889f6473600ccf9aaee22c8b433cd6dcd5b910f8df98eb0a0092b4d32f397e1d63b9c91aeca1b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978148, "uuid": "8a6aa536-9bee-49f7-a836-7c4bdd29d7ee", "value": "T17021A4CF836D4D0104988F01B016CAAC9904CAD868FAD7E5FC98D7B35E87534B300F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978148, "uuid": "ee5c6d5c-da01-415a-8b31-059bab33c907", "value": "24:7h33ILbhwSIObhxNIejIXbhKLK/Igbh19I5bhysI4bhft9I5bhmwIsbhiAfIklb5:7h34LbhwHObhDkXbhKLJgbh1y5bhy14I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978148, "uuid": "2d6a58a6-5acb-465d-b11c-2639250cce81", "value": 1264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978148, "uuid": "c23d5c02-705e-48f9-b913-dae2d9dd7234", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978148, "uuid": "6eed7c54-6cd3-4a84-9d3d-cbabec7cbcd8", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b560453-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975931, "uuid": "f89e8078-fe3d-468c-896d-98da95a82158", "comment": "Malware payload (Mirai)", "value": "dd72d9e9975a59867e95849e443ae510", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975931, "uuid": "5a70bc5d-afbc-4824-a75e-d9ace687472e", "comment": "Malware payload (Mirai)", "value": "bd6d1a6bcb682a87443f5b3481246e5f82b2d2a244f519935e1bfb3aeb6cbb97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975931, "uuid": "98304b5d-5e67-4dda-bc12-2b813f80c156", "comment": "Malware payload (Mirai)", "value": "fbcb22a495cfe0c277e00d8492e2c5ff7a17cacb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975931, "uuid": "43615498-b997-4921-89b4-99fb74188b5a", "comment": "Malware payload (Mirai)", "value": "bab9049977381729bb795b4d78a9430c4eedac946da2c6f4f351afee113da6c4c8ced56719d50555e5c9b98b7cfe2e18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975931, "uuid": "aaa52c9e-032d-4e02-abb5-dcf168768af9", "value": "T17B834A02B3180E4BF4E31AB0253F1BE187BEE9D021E4B689691FD7564671E33558AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975931, "uuid": "4e3dc3bf-d971-434d-bc46-47e7635b86e3", "value": "1536:ZFKc7JTi6SEY+eSG14pDaO7OJw3FktnS/PHN6SXZJxQPkF:ZFLjHpDaOOw3FmQN6OJSPkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975931, "uuid": "9bb97db8-9f5a-4b45-8f88-08d5abf7a462", "value": 83924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975931, "uuid": "074aada7-a6af-4a1a-9b95-b63a5b79b819", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975931, "uuid": "28b68cbc-fc60-49e0-bf8d-8215516b0cd4", "value": "star.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b5bb50-529c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Numando)", "timestamp": 1750949368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949368, "uuid": "11c13fcb-f2e0-4de7-9640-c489dd513450", "comment": "Malware payload (Numando)", "value": "37819bc3fef600c43af4aab46ae9e952", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949368, "uuid": "42fd41f4-6355-45b7-bbf0-ab0229d16bb3", "comment": "Malware payload (Numando)", "value": "bdc89b757b6a5ba082ce8673f5b5c94f2abe4a189f861d7eeaa61ff64d376da7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949368, "uuid": "877d5876-e818-4298-b093-43665ec37c1c", "comment": "Malware payload (Numando)", "value": "ded625eebb020139f232cd7785db4b649e9f9908", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949368, "uuid": "8244bf56-cb64-4a6f-9148-85f6701257ae", "comment": "Malware payload (Numando)", "value": "c87cb1e1c4a2fc2479da2402362308640487a8249eca68c06a2cbb6df5c2a77a68d8dd8f86a7f6b741af0be675d4a088", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949368, "uuid": "fc831ffe-c606-4b84-987b-812a204e9775", "value": "T18AB56D22BA84963FC05F06356527A665983FB77177128C5BA7E00E9CDF350812EBA70F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949368, "uuid": "8ebb0bf8-3251-4b39-bb94-2f1092b02cd1", "value": "181df15e6b3df011817a3055a587ed99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949368, "uuid": "08fbaca1-0376-4cae-9863-a547be712998", "value": "49152:f7p3+Dg5fq2t1gSU/K6E2p9lTjTtAFcdR:jw04+2p9lTdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750949368, "uuid": "ca89e694-be8e-4e0c-946f-f43fee88759d", "value": 2469888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750949368, "uuid": "441bbe93-d200-4568-a3d0-3b8f5491561a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949368, "uuid": "2fec7f21-d4b2-4fab-87a1-f6876402e13e", "value": "4d10000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e03b2b-5241-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910096, "uuid": "36c61f89-083c-4cc1-a948-1dff824e5350", "comment": "Malware payload (Mirai)", "value": "c2bf0fd734102fc29bd3435eef39da38", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910096, "uuid": "8600069a-3c7c-4ebb-aa48-f69b9e15c5ed", "comment": "Malware payload (Mirai)", "value": "bdf3491d7a83bc1f9c42a8ca1927952b99dc904212919a6a9ca6a25e7b8662c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910096, "uuid": "d05f5a0b-47c5-4915-be3f-2444731efb0b", "comment": "Malware payload (Mirai)", "value": "c2fb92a6d26d097faba1c7f2e0dcb109c9e92662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910096, "uuid": "5cab22b6-2b59-420a-b803-46d70637741b", "comment": "Malware payload (Mirai)", "value": "c8c0e15b56b4134e6f458c4cc40fabdc0633d414993afca607279a280c511fd302ef8231dac4f75caa777b98602c9a14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910096, "uuid": "9a423648-1d18-418e-9b68-37b42d4b324b", "value": "T15A03F16B2157F5B0E0B1137F1C75C7E0CD651042EA13BBAA1AFB25FA4E736892734A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910096, "uuid": "9756a2d3-6334-4f72-8612-369a1d8f585a", "value": "768:xxfs9EilvA3jEIKJiyVoLFqiWl7RP6B7uPK7+qzxyx0YK:xJs9E2MnQvCLs316t97+qzYxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910096, "uuid": "26419396-f28d-43e0-812e-6d56c7fb3052", "value": 40084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910096, "uuid": "d0e5ab71-dda2-424b-baa8-69aed48a5804", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910096, "uuid": "efcd63ca-1ab0-4e77-ae46-b509826c57a4", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5a0245-52c1-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750965114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965114, "uuid": "fa9f48ab-4d76-4d36-a92e-442e3fe9b68c", "comment": "Malware payload", "value": "1d429038678ce357d251f5ec8438cb27", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965114, "uuid": "8608f7cc-59d6-48fe-8d02-2c7a2b1c2842", "comment": "Malware payload", "value": "be3217a9a4bf1e6168f310899a5144112961a1d8f0cd7853156b661b676eccf8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965114, "uuid": "6bcbce60-9c43-4214-8e10-222d2e9016fc", "comment": "Malware payload", "value": "320d4bb52ac8fb39e724bdf6aa3a71e0364d45ad", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965114, "uuid": "a31b2ce4-1e94-4c84-82a3-06007e771a26", "comment": "Malware payload", "value": "d36900f5fe4cd30f9609dd20e3e76b658bd0c49e4e5b7d6c72ed6dded1e3b5b96d047cd9cb31c8f4040bf7a529de3f58", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965114, "uuid": "da05a939-4fd2-4a02-af9f-aab2add299c3", "value": "T1CBF2C9887550E57583F32A50051F2905FD7998275CB8B0B4F2EDC6D23BB06628AB6F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965114, "uuid": "779a7ba6-22af-4059-899a-b3f5471e77e9", "value": "384:DcO4CpQDP3qp4wvk9f6RUJ2Dmtkuxf2FaS3yzLEacHbs+TC0ym00BdYY8FfBySoJ:DcO4eQrqp4wv4zQ5sV1Y8VIl522KK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750965114, "uuid": "85b44af8-907b-4e5c-8ca7-c8e0485a46ee", "value": 35668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750965114, "uuid": "9d7d0876-48f2-444a-94f5-41deea9cce34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965114, "uuid": "bde56cb7-e882-49ef-9639-6ad40c9dd911", "value": "FACTURA33678623894782396ELECTRONICA238965723784732DDIAN745738743298RESOLUCION 23689736587387320001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b73c1b6-52cb-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750969408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750969408, "uuid": "edab58c4-8279-4aa8-abf7-b301fd23b533", "comment": "Malware payload", "value": "1d00c1b69f888463515d43e9d7018bcc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750969408, "uuid": "b10db3e6-d1be-4d44-b03d-e2ecfb20f1c8", "comment": "Malware payload", "value": "bff3c05d768803973fd44ad85b7cd765f369534510faa721b726c0f37441f5de", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750969408, "uuid": "db88bdc8-b190-4a41-8085-3465f55ea2f7", "comment": "Malware payload", "value": "edcf74bf2c61485bea2bc4427bbe4ad1c0a5dc47", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750969408, "uuid": "da30b1ac-2ca7-4130-b143-ba6025187c92", "comment": "Malware payload", "value": "3b368fe206a89c15b086bd9e4e88e7a78d0de7696a0eb7c346cdf4afd98b3e75cfb2e90d303934660da0135edd15b1bc", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750969408, "uuid": "b9c3e09b-acec-432c-a15a-b33e0c44693b", "value": "T1F4C5F1227386C637C96E0570392A879B146CFDA34B7080D7A3D82D2E9DB55C06739FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750969408, "uuid": "64c7342e-4bb6-4046-9fd1-814992a62c56", "value": "49152:j7qHYjZKumZr7AcI1KFJekVmEoGiPMQL/CePQSWjlOXA:4Y1K/AcIk1VOmeojB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750969408, "uuid": "b34df798-44e3-4dea-8e4a-cda0c5827e46", "value": 2714112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750969408, "uuid": "4381e40c-9879-48ef-9288-e7f80f4473ba", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750969408, "uuid": "0219f766-30ea-4cb1-abed-340bde2aed7b", "value": "open.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f2b3b0-52c4-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750966545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966545, "uuid": "0e36dad2-eb5b-490d-8e29-defd5aaea5ff", "comment": "Malware payload", "value": "1cc7659a07315ef610f7c679dc269e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966545, "uuid": "c86d572e-7170-4c12-8ada-c76d88c94349", "comment": "Malware payload", "value": "c02278c06102c8709cdf3bc9772818ad261926827ee85f069def82b2e843653d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966545, "uuid": "50ca36ec-be98-4d2e-8211-e9c5054768d4", "comment": "Malware payload", "value": "3c1e6d2e9f8a6d440c0f1d7244efa1d65d11d34d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966545, "uuid": "04780148-11ff-4030-a2de-b5e8bc15a860", "comment": "Malware payload", "value": "3961fbe66284928d270da409a6544e4a9051134777c40574aac3d3415aa78db3ed86fb33448c2727c0e7a6becbd0295d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966545, "uuid": "2b135fec-2779-4a71-9b7d-d644f1a7d8d5", "value": "T1CFC523827EE616E9C456A6708AC7FE7F35B50A7C1E114C0EA4B0FBCBAD136D49836503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966545, "uuid": "012d0e2b-6d71-4dec-b73a-9aa684678ea8", "value": "ba2e85a08868f999406005e4fd137d90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966545, "uuid": "7581516f-b75d-4724-b4ac-54661de853fc", "value": "49152:nHUYV8zdhG5GhL7VrHMEPnQdnuEixqRZzZtXKs3qFXds5QxVTijrbDV5:n0Ym7tvVr5PniuECm9Zt1qFX9o/V5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750966545, "uuid": "b38f384c-a111-4684-b200-70121f09f74c", "value": 2631960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750966545, "uuid": "241c41b6-36a0-4404-8dbe-d1748776ad7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966545, "uuid": "e8e5eacf-8c7b-42cc-93a5-22635354328f", "value": "Galaxy Swapper v2.0.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e45591-524e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750915893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915893, "uuid": "c2a796f1-9f68-47c0-afc8-ef4838595945", "comment": "Malware payload (Mirai)", "value": "7ff92515fcde21fb0ea3607f0bcb7ace", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915893, "uuid": "318e252f-67c5-4c62-ba3c-0e01cd180f3b", "comment": "Malware payload (Mirai)", "value": "c1d8d718cc73faf4786acee4d6d7dd01424fd4505ab0a9f50a6f50377c894f7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915893, "uuid": "26e0b20c-965b-45dd-bc95-76a22d96bcdc", "comment": "Malware payload (Mirai)", "value": "bf06c564b661e00cbd8d1b09c5805deede39ad4f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915893, "uuid": "1bb5e960-eb36-4a59-8ab8-63ae2cc84a0e", "comment": "Malware payload (Mirai)", "value": "6eada2d211183c83288ae83925dd4c8c27f70610488fbe64c51d77ef096debbf9f50b6d07a42e289e635429c4a179470", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915893, "uuid": "989b4c03-e603-4efd-9f47-309e05241233", "value": "T15B51E9C543440D302D636A97EAB7C12C72C7A4679CE16BE5E9C4BAE1038FE147B407A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915893, "uuid": "303765ac-bcf7-4096-b451-964db613543e", "value": "48:vo7P7N7hoK6GogSzPo6KWoEoUo7E7o7Uof93bof9RowcgojpVoSSOoG+CoNfTo1A:vo7P7N7hoK6GogSzPo6KWoEoUo7E7o7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750915893, "uuid": "8a46aaea-6e3a-49ba-b7fe-d9d28b7833df", "value": 2910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750915893, "uuid": "42f734fc-7889-4e2c-8210-2aa913048884", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915893, "uuid": "397556f0-3864-44d5-9678-2a1e7c1c755a", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa98e6e-5265-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RemcosRAT)", "timestamp": 1750925740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925740, "uuid": "b7da36bc-7a1a-4b8d-a2df-b3bcbef982f7", "comment": "Malware payload (RemcosRAT)", "value": "ea22ebbba9f0d0248332db643bd2e6da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925740, "uuid": "47ba2efd-f3fb-4464-82b0-67e9c9012a74", "comment": "Malware payload (RemcosRAT)", "value": "c1fa6e55486b388eb064f222153d7df4580eb1c6d804ec5156411ac62254d4ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925740, "uuid": "2b531ad8-9b00-4be1-88e7-50ed1e8607dd", "comment": "Malware payload (RemcosRAT)", "value": "b77c15b2f3569b3da3af91dca1f0d66096481517", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750925740, "uuid": "6d690611-247b-4b1d-a8d2-9afc3dd7ad86", "comment": "Malware payload (RemcosRAT)", "value": "bed4abec90c23143aa848124f29c8ad4cb4576f14ee6a0806ca7581ce3069c4b2c525d93d37957ddb91d4d9b6fb4fa5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925740, "uuid": "c8f33721-3298-4235-9fdf-6ddaa1a44641", "value": "T13CE412E09339AE9AF6782BF82061AE6495596CFCB9B4141D577035CAFCF33426C3A047", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925740, "uuid": "9a34334c-9ac2-4595-a77a-5c0db9dbf71b", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925740, "uuid": "85410921-29ce-44e6-866d-cc62fa562001", "value": "12288:ORcIur/Ki0vGKNK6K8C5f9PQTYCt7hxTCV0b+LaZPMzW9du2zAZi:OR+rCjvTNK6KhhQrtNY8hZPMzWbFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750925740, "uuid": "55a0e8f2-1d13-4e72-8228-428bb5311d95", "value": 717183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750925740, "uuid": "6bdf51cf-b66d-4c93-b060-63300f023eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750925740, "uuid": "d3fe2194-e2dd-4734-a343-28dbedf41f56", "value": "Laporan Survei Karyawan.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4ced06-52a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750954649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954649, "uuid": "827adb7c-6152-4ce1-b1e2-4d62260a2a04", "comment": "Malware payload (Mirai)", "value": "950654d7de20ec726d61dde2c614b552", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954649, "uuid": "4d56199a-422a-4c9e-a47e-d1f85c0ae674", "comment": "Malware payload (Mirai)", "value": "c3606a38dc492dd447c7a12e6a56c12e93c6d8c3e31fb0a4cbeb1e7b8f662ddf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954649, "uuid": "8637e00a-44f8-4295-9ee7-fa8c342a51de", "comment": "Malware payload (Mirai)", "value": "7aaeb6e00aa0727b0ac7493f095f6099ecaaf511", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954649, "uuid": "713082e9-a477-4a00-bf6c-d4660c7ba74d", "comment": "Malware payload (Mirai)", "value": "b6c3b304079cd71444f035d966c9faa86492bde066e029e798a26311a1e2b18376b4149923d1a6e914cf24faa05c656d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954649, "uuid": "99f70443-d41c-487b-ac03-68e023bebb0a", "value": "T118331B9EE84DD883DB874338444F8EA3B13BA85C9159C0CE5328425CBACF7F995B95D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954649, "uuid": "2ce07919-db8f-4cef-a9aa-a5a54f89e95c", "value": "768:mnEFJye1O96lVvYilr6TFkwbTxjJF0G0jOoQyh6AQhqhSoeMPM5qMO77:m0JRO92YNjmOoQyh6AhhSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954649, "uuid": "dcbec5ad-f398-49ff-99b2-a6e175e0c147", "value": 52024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954649, "uuid": "1fab927f-21f6-48a8-a77c-051140bb76de", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954649, "uuid": "336bda7e-eec9-40e8-b5d4-ba3ac823ad17", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66951e24-523d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750908411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908411, "uuid": "19026f5f-ddc6-4207-b286-061261718dc9", "comment": "Malware payload (Formbook)", "value": "3f6fb2e1429a4b7a6784a785a0a01d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908411, "uuid": "fe177f19-7811-4281-b3b4-90890487fe6c", "comment": "Malware payload (Formbook)", "value": "c401d93c025614d076cdc77495da4b3e534557b4d3054ddec1321b5ed821c7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908411, "uuid": "5d69e7cd-3377-4c92-90f5-276dfcac796e", "comment": "Malware payload (Formbook)", "value": "09dde3b716d37df860689b45d797b68e2055b862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908411, "uuid": "ada4fd18-b08f-419a-9037-d73bf6abba0f", "comment": "Malware payload (Formbook)", "value": "160c24030fead8ec066538f8a36e8f7d05356ee2760b75c557123f833b7475f54d3f299be52c4384a63171d25fe56eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908411, "uuid": "569d85d3-f541-4eca-b1aa-2f671cc38bd3", "value": "T1ECF4021A29D3D4D2D1AA3FB445E3C2B94A343FEA5873C6D27BE93C8F38229117606355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908411, "uuid": "b6234f5c-deda-4b7c-8a55-31a6d87706be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908411, "uuid": "903f4b2e-0b3b-4285-bb61-a3b01842cad1", "value": "12288:rknb8eYuYSAyS8y9fULGA7lm5BwJ/O42jrqLEpdvvwtH/MQ38D46w:rknb8eYuYdDfsllSnHjOmAtH/MqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750908411, "uuid": "dce82665-c646-4d9e-81e5-1fa5b4ca15fb", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750908411, "uuid": "d01bd636-0f11-470b-ab20-3fd65357181d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908411, "uuid": "b1ca8aa3-dc2d-4d6a-a735-4835b0bf5ed9", "value": "Annual Leave Compliance Report for 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4370725f-529c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750949154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949154, "uuid": "a13ea999-e172-4640-8347-eb785ef41ac3", "comment": "Malware payload", "value": "971e5a7a19dc4a21feabca9a6a949598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949154, "uuid": "88c116c0-c163-448e-8c21-1f2f3a7cd24c", "comment": "Malware payload", "value": "c492ab62dc9c8eb5e9281a59966fe23b3a553c6ecc8afc8ee3d8848e58e005a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949154, "uuid": "0389033d-81d1-4e64-9fb1-673fd75de678", "comment": "Malware payload", "value": "5600d4b1757ff74c0633f60c4250233f849e4724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949154, "uuid": "cc8b5913-d4dd-471d-819a-bad8fd9d8641", "comment": "Malware payload", "value": "50f8137d2bc3a50d9fc8109677ac66881ce0758608d7d814060735b97f1dd208d13a0f809c40bafb68901320b2e00ffc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949154, "uuid": "1940e001-1f95-4dd3-9750-fef0497acf92", "value": "T166948E86F1A444E9D06BA078A1ABF60BF6353448075046CF73E499682FE37E07AFB751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949154, "uuid": "062e23d8-b4f2-4e09-8a16-4a8a6dda70f1", "value": "cbee336e7b514136c53a8d52694efd3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949154, "uuid": "748485e7-8951-4757-ba28-4e3110a57b98", "value": "6144:7h1TRyNSycm56XPD/jjAyME7Nim05+8ArHfr+VvGc2h6sJvJaGXBTzpgW2IZn3Bd:7hFX8C8EJh6sJvJaGXBTzaIZnpbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750949154, "uuid": "03563823-faac-408d-b618-4f87b3242370", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750949154, "uuid": "e92fe073-c184-4f89-a630-4e9881c124fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949154, "uuid": "8433ffed-d6f0-4691-9aac-04d53c9c5a37", "value": "Ud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3100d3f-527e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750936484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936484, "uuid": "5388ce9e-d718-4f84-adaf-0f08cb95edc8", "comment": "Malware payload", "value": "4de9f4fe729e167f3f74aba07592d182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936484, "uuid": "b06ccf5e-391d-422e-8d7f-76262eb717a0", "comment": "Malware payload", "value": "c4aa6f4a998a9dff2ca86f4f56615b5fc9c3f5b430cc30789feb3c9fd2f4634d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936484, "uuid": "fd04897c-d6cb-4cef-95a0-599c5da6ccbc", "comment": "Malware payload", "value": "3ec85086e28b3a5de82a136aee236711b93ae059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936484, "uuid": "f55e8766-b82f-4978-b485-aa779313b486", "comment": "Malware payload", "value": "e86665791efc7f14726e97fdcd735f32cce114f274bfee091e7f6f862d4d051188c629516eac3d945f7ec8a056479d27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936484, "uuid": "8535a946-6ddb-41a7-8e6c-b58363cba8a8", "value": "T18AB41228EE4E38D1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936484, "uuid": "d2705e65-b52e-494d-9744-ad29f5d77ed4", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750936484, "uuid": "d7ec1e7a-582c-40d1-8890-01212a55aab6", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750936484, "uuid": "14a6cef9-30d1-428f-8661-48c2cae7a367", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936484, "uuid": "841bebab-1454-44ae-9188-35c467880de7", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28d8bc2-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900861, "uuid": "ec596218-8590-4965-ab6f-c3509eb209bf", "comment": "Malware payload (Mirai)", "value": "704ba2c6dc720d9a1c4c7cf2b246f6f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900861, "uuid": "8d335ce5-eacd-4b09-b2a6-1a1f09e9a042", "comment": "Malware payload (Mirai)", "value": "c55a19745bf8b08eae574804d3b8a8e336cd56091e1033344b9ab6f05cd90bcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900861, "uuid": "88fc3dac-81c4-40cf-bc57-9c8d4f445e3a", "comment": "Malware payload (Mirai)", "value": "c538affe2e3006abc41743c568993a42d229d5a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900861, "uuid": "943e7523-cd8f-48f2-a18e-561ed21eb7f1", "comment": "Malware payload (Mirai)", "value": "839b24ccf9af2c59be417b15baba8f0ebc6813e7d539beb54be3f7b1388824b5f93672c5837c2861874317302c1db664", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900861, "uuid": "627fe9a1-c5b4-406b-b53a-d9168716850f", "value": "T1F3531A5DFD4DD883DACA4338448F4F93B33AA81CD165C58B6318415CBA8B3FD92AE684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900861, "uuid": "a3122f59-281e-4e93-bc86-9b054205795e", "value": "768:+U8FJx/hsCKi56TcbwD1JRjG/tEfn6LAl/EWxjhSoeMPM5qMOUCNkUSnfWd:RsJPsBxfj0tCn6Ml/PhSHtZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900861, "uuid": "ed78893f-71e7-488e-88e7-babf85fd0d5a", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900861, "uuid": "30e9d214-01ea-4310-9605-3a3e4e2ea3b8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900861, "uuid": "b12e081d-0817-47e3-8775-89d28687b00a", "value": "SecuriteInfo.com.Linux.Siggen.9999.9111.26635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a496d902-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975946, "uuid": "6c8bdd22-b752-4c6d-8ecd-14b7b2ac8508", "comment": "Malware payload (Mirai)", "value": "8846c0c95278925c1e9bda0fffa78a9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975946, "uuid": "6d6e371c-67bb-4b05-a591-e142f30f2587", "comment": "Malware payload (Mirai)", "value": "c55ce8db6ac47e83091a0aea954e65973d18d9bbad2d5b888c58330aaf1430eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975946, "uuid": "e1789a04-0c44-496e-aa68-3b8168673d5d", "comment": "Malware payload (Mirai)", "value": "11cc59811ed1a5f53c9f9f9077f355e07ec9dc54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975946, "uuid": "4722c592-c356-4636-8423-b70e4aa585f0", "comment": "Malware payload (Mirai)", "value": "202532af30147eb2847c54570f520aefc4e3805aeca537952cba118593db1e9715ff96fad25b156b1d3b1257cc5bbef2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975946, "uuid": "05ee769e-ca36-4d61-b35b-fa0a3152e2e1", "value": "T105B3C60E7E218F7DFBA9C23847BB8A15965837C637E1D581D25CDA012E6028E741FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975946, "uuid": "3f305153-7b56-4599-831a-7397d767c238", "value": "3072:qz1u8TfSyBFataXSdQ0YCtxGCtgWmHd7fPdt:qxu8TfSyBQ4XSdS2xGEpy3dt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975946, "uuid": "a7ea0589-03b8-48c1-b28b-a59d6f148382", "value": 113428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975946, "uuid": "b07c1212-1693-4edd-aee9-95c78794026e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975946, "uuid": "dea94c22-e92e-4c99-adab-b51be7a115c7", "value": "star.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e344829-523d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750908263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908263, "uuid": "afcbae35-ea0e-43c0-abfd-b571f37e4c08", "comment": "Malware payload", "value": "dae7aa1fd2492491f43f1dd05ce15bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908263, "uuid": "a1b96b80-d5c6-4582-b95b-7aad256396ec", "comment": "Malware payload", "value": "c5ab1d48b2971f2b7f070a88d8e308f8e2b6bc2f143f74e15016ad52049e9223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908263, "uuid": "2e4647fd-0349-4a65-85c6-c1865edeae4d", "comment": "Malware payload", "value": "b7374a66d980b23f157b907ab2d832561757d6f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908263, "uuid": "f1ae9968-2d3f-4d7d-9b6b-eb5c95277329", "comment": "Malware payload", "value": "43da6e65e52975f7920f6939b6cd08ae238696c04c5bf2d78f060d24614bcbaf0b2444ad24ab2f4fb3dcf258ae4f7d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908263, "uuid": "752758aa-e988-49fd-b0e1-30c933ed885c", "value": "T11E05235E927921EAC8B2A37C45396164F03178B013CAA6EF64C2D4BDDF036D1D9B2F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908263, "uuid": "ace9263c-9f16-4e0d-9faa-d51852afbc09", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908263, "uuid": "6f801b2a-ab09-44de-a770-17c8d495b7a5", "value": "12288:RizA5Ixkq4d4yl8tTty9lxe56fuDdyyvhO7Oqlu1C5ZBa/oRRgOE4ggPX7FRMaMh:RF4M8vz56fvNVXKOEjgPXRuaMQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750908263, "uuid": "e9027950-bdad-4600-9796-fe52af0955b3", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750908263, "uuid": "4476d161-a72b-4d39-ac88-cd739fddb826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908263, "uuid": "00ed79b2-d5f4-49bc-8a89-cedd1ae57ea3", "value": "dae7aa1fd2492491f43f1dd05ce15bc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d27625-52c2-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1750965768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965768, "uuid": "1645724d-2825-4eab-8a68-643f9bf62c36", "comment": "Malware payload (Amadey)", "value": "8c55e7f277080e016d096def7171a7ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965768, "uuid": "950692a5-f6bc-4bf5-b2a3-95ffe2f6912d", "comment": "Malware payload (Amadey)", "value": "c6b5457d0ea7da4288a3d3e052465d614d8ddd732682ebed0cd7e0619d426dee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965768, "uuid": "d5eb1fb3-6bfd-44f7-9301-492e67ff8941", "comment": "Malware payload (Amadey)", "value": "557b6c4b4fb642079fd209d872471f2c92962894", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750965768, "uuid": "bec1eedb-b4da-4baa-ac91-3c43c371ffc3", "comment": "Malware payload (Amadey)", "value": "567d02195f7dda27143e0f6a19b0cbefeba28b75ce5c139b0e8c57270fc7c4105c58c670d69d0b5f3e4cf6827acc9302", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965768, "uuid": "c90b53d7-31c2-48f9-9c91-8fe142db8be4", "value": "T15AE76A42A7EB0491F9F76E7154F652274537BD066F3184CBB20C2B2A1F732E08A72766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965768, "uuid": "b79e0631-f9a0-4283-8d1f-32ab7fed4ac9", "value": "5305619f500f3cf9c7f5cb3df5f39327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965768, "uuid": "80729770-3ae5-4132-8b67-9813d3992d6e", "value": "393216:rroS4hwfm/tBHtYl5wA/VTQl7t2iODG7qoYagUx+MLOeE3hykqLmonPG/FgQaYtO:vovhZ/qBt0oapgPVlcmKGctf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750965768, "uuid": "feef9f30-8e77-47cc-a3b0-2ec8ed4e5858", "value": 65821514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750965768, "uuid": "2fd57b81-0992-4946-ac64-34e056d16ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750965768, "uuid": "72090cdf-1850-4de0-93f3-6134b2dbb2be", "value": "PhantomStart.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69a0972a-5276-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750932898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932898, "uuid": "44a57a3e-2766-4303-ba3a-fbb731fc4d1f", "comment": "Malware payload", "value": "8b170e69cb96dac699608446fc84f40d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932898, "uuid": "d07cc09c-3226-4ad1-a94d-9003b5f6b5f1", "comment": "Malware payload", "value": "c6ef0d4da84a9198072026889c9867a97464f2a8e7cf259d1c391f34d7033e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932898, "uuid": "c2e946ef-ea61-4e92-af59-48f830618f27", "comment": "Malware payload", "value": "9e82543b5d3599ae41283d5dca3584cc4b99979f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932898, "uuid": "556a4d80-3315-4854-a520-b684b6f42d5c", "comment": "Malware payload", "value": "e604cfc021fca977a1d14d87de0bac145c522d3c23198ed8bf3b85702835e6eb8dedd9592adf23b5cfa04673505a4e9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932898, "uuid": "66633cec-b4a2-4184-a0aa-c975ab67d7ec", "value": "T1BF148485AFA13FFFD81FCD3341A59A1A129C491A52A9BF7B2E34D404F64B14A49D3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932898, "uuid": "c64f1149-6bf4-424c-b956-9500eb4bc7ea", "value": "3072:Z6Gt/p7bbSyiy0bWjA5aXBLM1psHKiIhvVH:wip7PSD66sKiav9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932898, "uuid": "a6ddebbb-a901-437a-b381-d4ba95326688", "value": 194740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932898, "uuid": "224b1fce-2cb9-467b-b336-37a024811854", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932898, "uuid": "771d22c9-5344-4234-a400-66b075a79a6c", "value": "nmipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985b948d-52ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750957028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957028, "uuid": "abd4b446-891a-460a-8fb8-c6d82953b34f", "comment": "Malware payload (Mirai)", "value": "43da4887fe9982e6878fd03906649516", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957028, "uuid": "1637b6be-9340-4696-9791-c410e422c17a", "comment": "Malware payload (Mirai)", "value": "c72013b046b2d2c5c3b96347bd3174c8a7f1e64fd72efdcbdc91c0717f2bfcf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957028, "uuid": "9ba3646f-6833-40a9-a18b-ef8d61d1495b", "comment": "Malware payload (Mirai)", "value": "7b1b12a7391520213c227fcc41d99ecfe5123d5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957028, "uuid": "4bb09830-bc88-449e-a02d-4360fde1d4be", "comment": "Malware payload (Mirai)", "value": "4740b75b952dac9f469139d839a7d55b036475e3a3d1c7b249ab48660a773cd7ca6c8fcab26976eb20aaaa4773e39ddb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957028, "uuid": "99b291f5-9661-4050-b91c-5fb006d3ccbc", "value": "T13A0419D7F901EAFAF819E7330C4348157170F7A149921A33A267363FED3A199146BE86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957028, "uuid": "831c2f2c-c51f-4e5f-bc21-7efaaf9776ee", "value": "3072:XsGzAvG2fqqYT8m9LtQekacWVcW0JcWcBRxHPCpLnL5qRfVdUjLj3BBUeQV:8G0IT8m9tQekacWVcW0JcWcBnHKpX5LA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957028, "uuid": "0c37696d-a8ea-4302-b154-61a4af797543", "value": 178452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957028, "uuid": "388886a6-c0f8-4003-bf8f-76a4002b34d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957028, "uuid": "56c7390f-6820-4e4b-80ec-539d78fffffc", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee48e14-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913955, "uuid": "f6fc9247-0e24-44d9-a537-95298d07c896", "comment": "Malware payload (Mirai)", "value": "a80739eb75d0dbfec73bf6e0c566e841", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913955, "uuid": "97e423d1-879b-460a-b7f3-f5e4087c132d", "comment": "Malware payload (Mirai)", "value": "c7f84b95a0257e4d8d739c781be22a853bc69938673b778bb388cebd8a8fcf32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913955, "uuid": "cc290660-79aa-4260-9337-049e062ef63b", "comment": "Malware payload (Mirai)", "value": "3bef2bf4ad9def633328a5294b7873b0b45ee8d6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913955, "uuid": "c2f4b252-05d0-4004-8983-ac179dd4f3a0", "comment": "Malware payload (Mirai)", "value": "531b7896c905ab3e1439277fd21ded66682ecb71dd0d7b2d1836357e742bec4d9aa244191a7df2d29a21cec4dadf51b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913955, "uuid": "5fbf26f6-72a7-4bd5-9e54-ecd500b4a575", "value": "T1AA630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913955, "uuid": "18ec1e4f-fccb-482a-8e19-2e9afa433744", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913955, "uuid": "24b60a51-329d-401b-8349-adf27f811444", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913955, "uuid": "cf8a4c8f-9977-418b-ade9-e88598a6aa8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913955, "uuid": "ac517a2c-cdd0-4f11-bc60-f93eb60b31ec", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c0ea59-5247-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750912676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912676, "uuid": "ceb40068-e4cf-44e8-b4b9-a45efcfffafe", "comment": "Malware payload", "value": "07d6318390028a32539dd2d7f8c1f032", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912676, "uuid": "a3b8234f-135f-466b-9be6-768070f747cf", "comment": "Malware payload", "value": "c7fdba99bd8315be253adb40a2b83c46bf52ef2cb7095cbe238101bd7b20291a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912676, "uuid": "5c143cb3-0942-41bf-a98c-2c643b2bac97", "comment": "Malware payload", "value": "888b8457af7d6c89232502c4fe7f2c44c621b121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912676, "uuid": "97e41011-57dc-41ca-a4ef-6c19367a9d2c", "comment": "Malware payload", "value": "905d74099b58137cb2b9977ef0bd78929c89c2850855ead7c14fa35c95d0735b2161c75761e8276c9c845ce8eac41aa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912676, "uuid": "8a1c4276-f55e-4e53-9800-ad832daf2c21", "value": "T195C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6DB42F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912676, "uuid": "3b7ba131-9913-4c7c-a48d-6f5c15051bd5", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750912676, "uuid": "39280354-c769-489d-82b4-ec1e9e829ec6", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750912676, "uuid": "195edc3f-da4b-4de6-8c77-b802eed82226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912676, "uuid": "827e302d-6c5c-4a7c-a794-a674b01c1f2a", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef40473d-525f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750923243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923243, "uuid": "f47841ae-3342-49a6-98a7-851703f9cec5", "comment": "Malware payload", "value": "2123eab51aa468d5140c3bfe2bbe7775", "object_relation": "md5", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923243, "uuid": "3be5198f-44a8-448d-9fc5-b6eef82116ef", "comment": "Malware payload", "value": "c80dfc678570bde7c19df21877a15cc7914d3ef7a3cef5f99fce26fcf696c444", "object_relation": "sha256", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923243, "uuid": "ebb4e6f2-6a18-4a66-b2a8-fe25867a1cfa", "comment": "Malware payload", "value": "ed0b8c7fea7414d2f5e429ea0d220106f10cca13", "object_relation": "sha1", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750923243, "uuid": "d6621374-7be7-4435-a30c-ed0253e53d05", "comment": "Malware payload", "value": "3bef2d9cf1c68a2af9bf01242351cfcf3bfb831009454bad7e2b2c451005b8f2fdb93b1671d598a5c0b23d53fbff20ad", "object_relation": "sha3-384", "Tag": [ { "name": "Claimloader", "colour": "#54E626", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923243, "uuid": "113af3bd-181e-4907-ae06-66f18d453748", "value": "T15C846D10A751C039F5FB21F459B9537EA92D3AE1672490CB93D52AFE8B346E0AD3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923243, "uuid": "ab324836-eb12-4b13-b618-a0f1bf6cbd21", "value": "634047d2b66d16794ca7c9cec2396301", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923243, "uuid": "d4c09941-fb90-45a7-9fa1-8b33164d75b5", "value": "12288:UEoBgJpm5W0wmin0Tfnq8UIsn9oBjbq1/0X2pO:UECqpm6ZCS8an90nqF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750923243, "uuid": "06be9454-66f9-4ab9-baa3-748be3ae7901", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750923243, "uuid": "1f9cf924-76f0-49f6-bfb3-17a7f865ed1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750923243, "uuid": "8ec6a1ee-2ee5-44de-8898-9cf0bd276975", "value": "helper_process.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc2f585-525a-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750920744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750920744, "uuid": "6f670768-3a3c-4fb7-a06b-e7d126865659", "comment": "Malware payload", "value": "456c8eb0a33da990cbde6be52191cb42", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750920744, "uuid": "e9535f30-388b-47f8-9b81-8ff96ba8d265", "comment": "Malware payload", "value": "c87959f5a821577dbe28fbde399c75037d160807ef90e0e8eb4c6ae29c072410", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750920744, "uuid": "b236e20d-e836-45cf-ae80-f60102aa2e52", "comment": "Malware payload", "value": "ae193f681c06d323e2f7115d5422b5276c34ad60", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750920744, "uuid": "cd64a086-6719-4231-837a-791f3c53242c", "comment": "Malware payload", "value": "e767ad1f82e96ccd42c7a1011cc944e0501e6bae494a7bf3713aff4f2838e378d3187d62c39eb3898d6312e497c3f2d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750920744, "uuid": "8f5c399b-8c0a-4b9b-8a96-dc0aa7ae5e4d", "value": "T14DD5F288D99C960C7669F7E80D76751CFC5427BF188F9D4738A8AEED97B4020C053CAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750920744, "uuid": "d6c8cf14-a782-4f79-a32e-0af024b1cda7", "value": "6144:AkoLuRrzCzN/M31zj2WJ9tyEd3YxQT9Hy2oRl+q5av:AkfRaN/M31zBJyEd3YxQTpy7Rj5av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750920744, "uuid": "7b33b192-6c43-4e3f-a8cf-4e184796a5f3", "value": 2987620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750920744, "uuid": "b6cd1645-def6-4d55-816d-9e19db0a4301", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750920744, "uuid": "e671fe38-e769-4618-80df-dd5eab2cac87", "value": "Project Documents (Drawings, Specifications, BOQ).JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22fdba9f-5274-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750931920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931920, "uuid": "dabe32ca-ee0b-42a7-bed6-2302bfda22aa", "comment": "Malware payload", "value": "ef5134e523fe54f2ac223f516bb9f97d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931920, "uuid": "eb3adf27-390e-485e-8354-a93438e3d62f", "comment": "Malware payload", "value": "c87e829521dea712464b55368f48411d6fc74471ff8bb2bcf777e44ea0c4148a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931920, "uuid": "0544a96f-be9c-47b6-bef9-51750e3f8191", "comment": "Malware payload", "value": "600d942b6d53b51c80304e7b9c77b876addb4e0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750931920, "uuid": "1273e42c-5844-4e2c-974a-70de4bde5507", "comment": "Malware payload", "value": "db2867b2b3947e52f90e47cc36cdc8aa36249834b5076f9728d4d1e30b4497ca59efae078d8881ecd5a0932054011d8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931920, "uuid": "a9e0ab60-0dcb-4d98-9cb4-3186b94f5e87", "value": "T1D8B41228EE4E3881F3D1E3B8DA0A4BB1B05B7DD0D166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931920, "uuid": "0e5a87d4-c91f-4b8c-a71d-e2e2c5bfba2c", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750931920, "uuid": "431251fd-51dd-4ff4-94c1-23c3e5a77640", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750931920, "uuid": "f2dbac1f-22c1-4b2a-9931-1aa85b8e6dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750931920, "uuid": "80d3d1cb-090d-4599-8d74-1b416ef29a14", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292e0e59-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913892, "uuid": "cec65b0d-35cd-4b2f-9c5a-a33f1098125d", "comment": "Malware payload (Mirai)", "value": "28f42ffbbc2e6a5b6fe95a62a1ef07b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913892, "uuid": "c796ac48-f23c-4e2f-b0b9-a8c8b5e29bb3", "comment": "Malware payload (Mirai)", "value": "c8f22977ad3af77f171902919a0344fc210bdefcc08ee2e24d266cb608dbd0d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913892, "uuid": "22e8ebcb-7d7a-42dc-943e-a417063c95b7", "comment": "Malware payload (Mirai)", "value": "0ad210f17a84ee61e0cb453532ec72fae8a538b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913892, "uuid": "f388da33-9f27-46cc-acf0-974a37b88abd", "comment": "Malware payload (Mirai)", "value": "96ad3a7f8d69f274b95e5b6d3961f51f05598a7fd73cd500a3daac313e560e4053a9e58d84b7e00c6d63c441b0028187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913892, "uuid": "8f261686-0fe0-4546-a2cf-de014b6c80a4", "value": "T15133FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913892, "uuid": "0b360074-2962-46d1-898a-3e8f5d289afa", "value": "768:gduPBFnHooqR8qOCKq2cH4/te+TK806MMUVjzkfQXObHud2oG1:r/hqaJMeteqK806MHdkfQX6HuC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913892, "uuid": "d492c429-beef-43a6-8372-273c12b3867f", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913892, "uuid": "b4886deb-61fb-43ce-b058-4073a2051633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913892, "uuid": "3a6bfc88-7d13-4812-b2e0-a75564741242", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fa3205-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900864, "uuid": "6b93e411-6339-4a74-8d7e-2431426f452c", "comment": "Malware payload (Mirai)", "value": "fd1c110db3244c3d13ddb109138dadd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900864, "uuid": "a0f430be-10e6-4dd5-b837-a3e0fe325f38", "comment": "Malware payload (Mirai)", "value": "c8f27696bfd9d6ec1de0f2fbe9cfb1fc34151e5e3b043948d7b78d9cf37cebd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900864, "uuid": "92153c03-9cbd-4b04-a330-dc7cd6f206ac", "comment": "Malware payload (Mirai)", "value": "18471093219446dacfafc85dec1bbf3d9fe43ef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900864, "uuid": "7ffb6c54-d7fd-48bd-ad25-b9144fe25eba", "comment": "Malware payload (Mirai)", "value": "dbe28109a18cbaf490a76f28cab7cb9ee034dcd060cb3e5717991488486b67f35180ff2c4cb9adef3f53cd3e08c04cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900864, "uuid": "657047fe-d97a-4929-9cdb-9ece24166f15", "value": "T1263481C6AFA13FBFC81ECE330296CA0502AD89095395AF7B6A34D514B74B14A5DD3D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900864, "uuid": "7c33807c-b9f8-4292-9ef4-0d22c5baa6fc", "value": "1536:DkTYgSnSNvkWw9b4lXDbDrJMKEupyRDWZpDNGVx/WosElLMi7a/rq27FxlSZU8:QTYgSuVwWtQDEkVx/WNi7azqAxQZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900864, "uuid": "20e4ee97-8051-46f9-bd2e-12cfb0cd6f57", "value": 240522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900864, "uuid": "d4eee402-c7b3-411d-a987-ddbdd4226bbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900864, "uuid": "7878ad09-2101-46e0-a78f-bafb51b56879", "value": "SecuriteInfo.com.Linux.Siggen.9999.7654.21100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2157982a-5277-11f0-8bd0-42010a9c0005", "comment": "Malware payload (QuasarRAT)", "timestamp": 1750933206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933206, "uuid": "856d9bcf-27b2-4bcc-aba4-00cf447653a5", "comment": "Malware payload (QuasarRAT)", "value": "2194fa51fb03fbb5ef2c6018737d5778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933206, "uuid": "0540aac2-ec81-498a-b5ef-8a146ec2b2f0", "comment": "Malware payload (QuasarRAT)", "value": "c93a7b4831732be9ed6a9b9f8ab9e3527180191a0e3b00cd3ccc40ad47bd2eda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933206, "uuid": "9776cf97-452d-4012-92b0-d18ae3d64cc8", "comment": "Malware payload (QuasarRAT)", "value": "ebf713eebb50856580495c7d250561d992655776", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933206, "uuid": "96dfd5db-c9f2-45e4-b904-be8e76af7215", "comment": "Malware payload (QuasarRAT)", "value": "59957c48a92e4082a83190eae63ff3869f2034aa78b5c25a2c745b77b51d7e0491a1d7626d7abe00d6742fb54e116421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933206, "uuid": "a4eaeb57-3cc4-443f-8239-38a0ab56f579", "value": "T19FE56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933206, "uuid": "8f0b31b7-209d-465c-aeeb-3ec492f7bc76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933206, "uuid": "b23f11c6-45d6-4dfa-b4eb-76f08996a63b", "value": "49152:DvWI22SsaNYfdPBldt698dBcjHJbRJ6+bR3LoGdofTHHB72eh2NT:Dv722SsaNYfdPBldt6+dBcjHJbRJ64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933206, "uuid": "d6d5fd3b-c513-4264-8daf-e38996cdb9cf", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933206, "uuid": "929b52ff-1bca-4537-9a88-836182e4d706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933206, "uuid": "d5e570a7-6169-4c82-800e-535ad7096fe9", "value": "2194FA51FB03FBB5EF2C6018737D5778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e415de9f-52ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750957155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957155, "uuid": "359c74f4-2c9e-430e-b4e8-f4b88679811f", "comment": "Malware payload (Mirai)", "value": "091003df67e1aff3b486f7c5331cb1ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957155, "uuid": "463602f6-4b8f-4b2f-bb33-3736ab1af5a1", "comment": "Malware payload (Mirai)", "value": "c98f4faa381d2a66e7ec28f9a2517c8e066609de26e1fa04965824feb5187eaa", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957155, "uuid": "fe68c3fb-05bc-4075-8752-68aaff67bdd5", "comment": "Malware payload (Mirai)", "value": "4350416c93c45c3970d6a276484132cf2e97f739", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957155, "uuid": "d1448464-b4ec-4b9a-8ccc-890296a08441", "comment": "Malware payload (Mirai)", "value": "b14d7ab48d46630d7784c1c7cf96e172ab103816de2eb4f31103d3db56b1f34b7e26054b33c73371f016488c4fc46911", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957155, "uuid": "4d06fc43-f07a-4815-a9c8-c0345c6e7c5b", "value": "T144F0E8AE287175E64A399E56B0738754702C9ACDFA748F08A58F58BF8DD7B00342CF45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957155, "uuid": "12379922-0be1-4fb3-9e70-5ce4363a0842", "value": "12:EURUKJUSNIl5PUf0LKOUSBU9U014U4tVR9UQBXU4BU:EURUKJUSNI7PUqKOUSBU9U0qU4tJUAU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957155, "uuid": "25222e92-a286-4fd0-bc53-6d05e986d409", "value": 648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957155, "uuid": "686d61bd-4abf-4e60-bb1b-8025c9015d4a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957155, "uuid": "d4e3d5a4-d982-4ac4-9b4c-36fbcbc9a0f8", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a064e94-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913893, "uuid": "ba6151fb-0b5c-4a9b-b1ac-d8bf180475c3", "comment": "Malware payload (Mirai)", "value": "92c1435cc3e38fe417c4b3977f3e62c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913893, "uuid": "10fd0f74-f2e9-4b3b-aa24-795d4e68c87e", "comment": "Malware payload (Mirai)", "value": "ca1336f730a2ef80e05c6804d2360c123bc1b9a58bdf2fee8a10850146522f72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913893, "uuid": "669025fc-4f1f-4945-b1de-b9f89b37aecf", "comment": "Malware payload (Mirai)", "value": "d19bed99665a7c590d29125579486ea0861ea26f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913893, "uuid": "a1092b15-ab24-49d4-aa23-536e277e9177", "comment": "Malware payload (Mirai)", "value": "3345901c4a7121a2f1f8a3eca9af92dfe998363860428c04685ab08f5085c435e2bbad35fed974b2cee1ab9875d81540", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913893, "uuid": "a6fe426e-5cf7-4786-9820-c5e155d34428", "value": "T1CA331A03A94284FCD14AC5305B6FA536DD757DAD4139B9AB2BC0FE311E22E215B2EF48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913893, "uuid": "47d77d4a-5211-4dd3-8475-f53eadc11a53", "value": "768:Yn9wUrguQINBIYR58XOLbEajEyhH4ePrsw4HrwXA/TjT3:WxrpzrIYR9ZEy5dPrwUejz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913893, "uuid": "3d79fb4c-c2d1-4b6a-8f89-3bb0cbab7be3", "value": 53488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913893, "uuid": "b3351f5a-805e-4273-af39-214e6e84bb8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913893, "uuid": "9108e485-cc83-4d3c-b954-00146f1a4f56", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561a0d12-5239-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750906665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906665, "uuid": "cf636887-ab89-4c98-982a-73ccc01495d0", "comment": "Malware payload", "value": "22e62a2092148edfa08229aaab4e62ab", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906665, "uuid": "d38934b6-c9c3-467c-a5ec-da50c1af17b5", "comment": "Malware payload", "value": "ca5de9e3900147308ebaedd92aa7d419ddb7eb8bdf27e678ed24ee8eddb60ad0", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906665, "uuid": "5308bbae-499e-413b-b1f1-85ac04310b54", "comment": "Malware payload", "value": "2dcaa6f66cec80a526696152d2ca2c9b84f78950", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906665, "uuid": "200cd5bc-2a98-49f0-980a-417cba88c2ad", "comment": "Malware payload", "value": "50595b3f74e3abff5f4ecf1f9d4abbb452159ce5b8891c4c1df13af62f0af37eeff809bca9c6beaf4b94de69113ac946", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906665, "uuid": "656a1fc9-f03a-4557-8d9e-f1b459dae06c", "value": "T1EBB3023DF8524CDCF4928A64C1B33C1C08E5F51B9AE979EB90788F16D183B599E02DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906665, "uuid": "af1c97c0-0b44-4fa8-bc0c-60cacd6b4782", "value": "3072:dkNwfpjW6GQzhO5jjoRJwg/WoE9Zik7mIStFSph+Fq:ywfN1zhWjo88E9kk7BSGP+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750906665, "uuid": "17a858c1-5d59-4052-af87-49e8aaf77eb0", "value": 118064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750906665, "uuid": "659d01e0-186e-43f6-b774-676e21f0c4f3", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906665, "uuid": "c893b890-e4da-4dba-b761-f776308ba97d", "value": "document.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba681c20-52a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750954937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954937, "uuid": "9bd3ac1d-8df9-4e93-bc0a-3a059c38dbaa", "comment": "Malware payload", "value": "c68bbcc01165d39828bd57ac0c35bd6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954937, "uuid": "42df2135-5392-4b07-bef0-ab675832d5cc", "comment": "Malware payload", "value": "ca77a50cc0dfd319780397e1aceeb51e191f85641ba1d9029975c1ca522a9442", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954937, "uuid": "a8485277-6c4c-4a16-a64d-1bd2f5139da8", "comment": "Malware payload", "value": "d15adca7bce597f7da64ae5c4be4bd5cce027aa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954937, "uuid": "bc9c91fe-01f6-42dc-886e-007d4dfb6b51", "comment": "Malware payload", "value": "2ab4157c351b9dbef778e093a56e9e0484ad5f19f28777b835e15723209871a800a55ee01877ca9683108989aac39fbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954937, "uuid": "7ee5908a-2ed6-4c8e-a3ae-c238c4d0cd08", "value": "T174E402017F152032C9D21AF0A8B747B4EB914CD650B4D6777749EB222BF36362C8BB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954937, "uuid": "2ba7abb0-0562-4f08-98be-937dc6398291", "value": "12288:XeBWVNQiXY8aap1qXG2YmzwcyxDKsFM+t9j+9+X:uQQAYLapnLmzwhtLy+t9j+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954937, "uuid": "3c5cb830-87ba-44cb-959d-4e3605a82d1d", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954937, "uuid": "c4360413-b099-427f-b838-9a38c808dbff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954937, "uuid": "4a364d8d-7ad3-4143-9e93-7d48aae3232a", "value": "ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4813ff84-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975791, "uuid": "a596d457-4ad3-4eaa-916e-ce1597cbecab", "comment": "Malware payload", "value": "ee8b3615bae3c2bea975faa935ed5426", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975791, "uuid": "0be93b6b-e3da-4f2f-9328-d26bab12dd70", "comment": "Malware payload", "value": "cac04d2c704f208c0399ddd38ee657313bd107589ba56e51ce0df997ad414307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975791, "uuid": "994c1d9c-6243-4eb8-87d8-ab1940128f88", "comment": "Malware payload", "value": "b357713affa3d68498eed02ec1d4159611944826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975791, "uuid": "a83b777d-24fd-4043-871c-39d1837c1d8d", "comment": "Malware payload", "value": "89d2a04bdf00b1096c7bbd8061a16bea8cc864ac919269a2fd63436d03ede8be2f2b080c8e1df99a6b92572c4a84aa85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975791, "uuid": "62426cba-21bb-42d4-b5e0-6ea5ad219e85", "value": "T1F4B2F7B2F44ADD78F40FF33E45564805B273B79502863A32B7732E37997928424A7E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975791, "uuid": "b79a99a5-fc0e-464a-82da-7118d241690c", "value": "384:m6BLtSWPPqDhOEX7uADXnIhUtsp1ud58HAR1f:PtSjuA8CtsPud58KJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975791, "uuid": "01b4c8ff-1354-4ddc-b666-950c6c159840", "value": 23852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975791, "uuid": "e91ee01d-c8a1-4898-80c9-7135b65e0b9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975791, "uuid": "a92b6c6b-d223-4081-b6e0-dce50971910d", "value": "violetm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cfb55d-5276-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750932896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932896, "uuid": "e9dd92d1-0094-4366-a860-6de5120c2c88", "comment": "Malware payload (Mirai)", "value": "51c372b75a7e84795055d68df13e8504", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932896, "uuid": "dad8f5e9-566e-41d8-92bb-6cd3b3c343d4", "comment": "Malware payload (Mirai)", "value": "cbaedf7d0d0ee3db5db88bb31bad3143435b91490675222d11168127d9dac6ad", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932896, "uuid": "529a8bf4-facd-4a4a-8bd0-ffccffe1d1da", "comment": "Malware payload (Mirai)", "value": "60f5f297ced434c12db8de00736a797076c645e2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932896, "uuid": "04746829-76d0-47bc-a62a-c6615f7c5b39", "comment": "Malware payload (Mirai)", "value": "8a69d7f65c392b978095cddb2abfd42df0e39513baec6bc7873922eeedace2f6786c5b4790aec9f23f28cdb7e978cc0d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932896, "uuid": "af0abf4a-6573-40c9-a84c-293f289220cb", "value": "T1D6014CCE61A2DC619C530CEA7552491DB8CED5D926CB8EC8A1CD0076E49DD087192F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932896, "uuid": "63b35b33-0bf3-45cf-a2df-456867a29b77", "value": "12:NLGEULnWKDbnPZw5ZMoOF7+MB05L73Nvx73NMDNkv73WyTx73WygDNkx:sEUSIbK5zOt+MB0hZpZmkv1ikx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932896, "uuid": "2d9b5e63-6521-4cb0-9548-4808d28320ef", "value": 715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932896, "uuid": "e8ade486-fe07-4ec3-827a-ad73c7d5957a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932896, "uuid": "08a86a9a-64f6-483d-a11b-0ce73ce79370", "value": "avtech.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3f735f-524d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750915291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915291, "uuid": "60cb5cd2-a113-4960-8125-21e8274f3839", "comment": "Malware payload (Mirai)", "value": "b7af117f5605b5eb144144e7ad9c381d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915291, "uuid": "e4e4b742-904e-4be2-b017-073e275a73c5", "comment": "Malware payload (Mirai)", "value": "ccef00e9f5eac1460debcd5b0f8d11821b391bd029b97b13da7041fec0cfaafc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915291, "uuid": "5f1d280b-d0bb-4cbb-932c-96109000bff4", "comment": "Malware payload (Mirai)", "value": "242b174714dadb6140e6cb410aaaccbebf5fd0cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750915291, "uuid": "594405a8-4543-4c1a-abfe-9cad8e2bd815", "comment": "Malware payload (Mirai)", "value": "3e93cfb81602536c766512724b3e1683a7dd8664752d28e1cf143c6f1fb224a4025eceb9c5ea5d7849a0616fb16039c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915291, "uuid": "bc9bfa68-543f-4906-8cad-b7b3bb53f1db", "value": "T1EB734C222B7A1F27C0E1747851F7872A72E66FD92974820F7E714E8CAF589E031532B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915291, "uuid": "21b3ee3c-a939-4153-bcaa-aaf4f2e33d3a", "value": "1536:jZwWp80vGZP7W5Cnc2qeBm0aQJQbcw3YeB9aPDwiliE53f:Nm0c0CTBiJcwISa0ci+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750915291, "uuid": "d3b64602-5bb9-4060-b648-df0ee3c7f4b4", "value": 79196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750915291, "uuid": "3f62d901-021e-428c-8a77-ae605c5e1416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750915291, "uuid": "49b0ffa7-db83-45df-9d55-84233e76f27a", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21716ae9-524b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750914308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914308, "uuid": "7b36343d-2361-4cfc-9391-f6d2a3a37da0", "comment": "Malware payload", "value": "a868fcb03fee74c987e073a360bbc5dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914308, "uuid": "b19b8de6-497a-4678-a7f2-6525bff749a2", "comment": "Malware payload", "value": "cd79849b34127e845e40f4ca4822f771080bc325856328c3f461582ebb953cc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914308, "uuid": "9fbd97ac-8e75-466b-b414-bf38d9373733", "comment": "Malware payload", "value": "d82f837d673eaa6c8e1086a9f8101ebdc1c07878", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914308, "uuid": "7d87fd8e-078f-4c8b-a19a-f35bca7ceea6", "comment": "Malware payload", "value": "f4a6800d89641ab8ed78eee00dc37855fa6336e7e9a5bee4c0b4b64ce11ba9087de4453c8b670f14b8be0a6eb2e76fc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914308, "uuid": "ee2f2047-3129-4c43-96da-23c9e59d24ae", "value": "T1A0A41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914308, "uuid": "2c2033a2-bd4e-4d7d-a1c8-12da829e6def", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914308, "uuid": "044842fe-579b-4487-a868-9693db57479e", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914308, "uuid": "da30a010-2262-4b3a-8263-a0f20dbd6787", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914308, "uuid": "e3360f9f-251b-44a5-89ee-25cac2c80f42", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f276691-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975803, "uuid": "5a7aec6d-e1ec-4ba9-b537-936705b2abdc", "comment": "Malware payload", "value": "4d517411f4af2dc8d33e0ddacb532a06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975803, "uuid": "a993905e-a347-4ffd-975a-7b4a0ac700ed", "comment": "Malware payload", "value": "cde5289bbdd3f50be1c6054b1555e1eff9b90fa6568fe75cebce8ea967263ef1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975803, "uuid": "a4e150e1-383b-4c71-b19e-2c8d619a96d1", "comment": "Malware payload", "value": "4e2a1a45f0587a45fd7b17bc38569153ce0fc413", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975803, "uuid": "91fec34f-843b-4359-b17a-9d3233f1a6b9", "comment": "Malware payload", "value": "819f88a750a9543ea71bc0f567eb3c01d07870d627cf2a8697b7e240c8e858e6b8fafe4545883af4bca651e2f7f21563", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975803, "uuid": "eedba1bb-59e9-430b-8f7e-589874ebb101", "value": "T1BCE4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975803, "uuid": "caeb41b7-64ab-4ce5-be61-21d8172db898", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975803, "uuid": "ebfeb10b-ea0f-405a-b170-6cb5a07298b6", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975803, "uuid": "dadda2aa-730b-42bc-b501-3d50d25be785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975803, "uuid": "d5bacd17-c8f2-40ec-976f-03679f80a509", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "527d3e53-527d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750935865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935865, "uuid": "950c9bad-965b-4eb1-97a0-0da960773004", "comment": "Malware payload", "value": "011cb1d7b470f0b17b8511aa4c84d28d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935865, "uuid": "4d77dc57-2549-4e31-bfb2-f2b9c4f0fa7a", "comment": "Malware payload", "value": "ce45894dc1ecf0e6db09e989db26730489924d881f23027aeac8c69fd4414b84", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935865, "uuid": "485ad019-a7b5-4122-ba40-48fd12b8a128", "comment": "Malware payload", "value": "a444c79e6977f90ac33b0a28a66c6f7415cd44a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935865, "uuid": "d7c978f2-249c-4e09-8093-eeb67f6e6d8f", "comment": "Malware payload", "value": "657a1021c0720d68396fd7e535e10c281b5aaa448b8e888636db0a207210e06ca7111f54a41198cc0cc1cd70a59de8d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935865, "uuid": "51321e99-861a-4022-a106-9d2db72d2ea1", "value": "T1B2C4F1A377204F90C35195B209F389335AF6199706F39982537DEE107F20A69386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935865, "uuid": "b7c67e13-7758-4f8d-9bd7-7764d9b5a1de", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7z0:W7v+mrY2xzf03yvZ/YIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935865, "uuid": "f6e7b133-3d62-4588-b3ec-b783758843a1", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935865, "uuid": "b111a732-c634-4ed3-a529-5f280ad67dcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935865, "uuid": "d7a1b8b7-a0f2-4012-a3ee-79642792ee16", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7768dfd-5283-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DRAT)", "timestamp": 1750938692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938692, "uuid": "577e6f20-2498-48a5-b5c5-f6cdd2fd2b98", "comment": "Malware payload (DRAT)", "value": "356a0f50131eb175f1cca91a1476f3a4", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DRAT", "colour": "#F11CA8", "exportable": true, "hide_tag": false }, { "name": "dratv2", "colour": "#69078E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938692, "uuid": "25a59a23-8873-47bf-a74d-7b5aa7d5e85e", "comment": "Malware payload (DRAT)", "value": "ce98542131598b7af5d8aa546efe8c33a9762fb70bff4574227ecaed7fff8802", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DRAT", "colour": "#F11CA8", "exportable": true, "hide_tag": false }, { "name": "dratv2", "colour": "#69078E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938692, "uuid": "56061b21-6c36-40e8-9943-0e56cfb83d27", "comment": "Malware payload (DRAT)", "value": "84f51de91cd61363b9722ab14444640d43ed9020", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DRAT", "colour": "#F11CA8", "exportable": true, "hide_tag": false }, { "name": "dratv2", "colour": "#69078E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938692, "uuid": "3f6786d4-eee8-4e49-b365-21a77a78cba5", "comment": "Malware payload (DRAT)", "value": "1abdd3a6f4e65348376a8cddf3637d39380982cfe5d420135b26b4c1346d709e4810ad13fd8e04254b8b15444c73f933", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DRAT", "colour": "#F11CA8", "exportable": true, "hide_tag": false }, { "name": "dratv2", "colour": "#69078E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938692, "uuid": "53e680a3-09bc-42d3-bdf9-94e44e35e735", "value": "T1CE06AF126284653ED0AB4B3A5537E65CBD3EFB103A22CC5FA7F4194CCFB59412E2960B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938692, "uuid": "a36ea0ef-1c06-419d-b7b4-28d4a1583212", "value": "5b7841c03785d6af7df4aee51258e3fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938692, "uuid": "3099c5e2-685e-4a55-93f6-340e8a33cf61", "value": "49152:A87S9xCkpC7ysTqaMbPSM1FRAtRqK52FH2FKT1w9nLvdh6pRMjOSTVhBuCdg:P7OCkpC9ai+H8vWMJT7xdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750938692, "uuid": "c7055972-c21b-483e-a62b-b639b2d50a28", "value": 3804672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750938692, "uuid": "b5526748-68cd-4f4e-a887-d0d293b96dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938692, "uuid": "dc9e1216-6288-4d7e-810e-44f3048204d5", "value": "DRatv2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa1ab03-52c5-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750966776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966776, "uuid": "0be4578c-abe9-452b-b14f-1cb79dc781eb", "comment": "Malware payload", "value": "668caca3122ab0b0c2425662ee2e700f", "object_relation": "md5", "Tag": [ { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966776, "uuid": "68762059-bbc4-48f8-9b09-bfcc8340f4bd", "comment": "Malware payload", "value": "cebc569cb64a1d15f1d66c7b0f9030657f415867f7d63fa10f2e772079828a83", "object_relation": "sha256", "Tag": [ { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966776, "uuid": "2398c231-9b81-4b57-b9b7-77a2a8cf47d2", "comment": "Malware payload", "value": "5a9d7c0526f00938c492ab2f276a8a10220df140", "object_relation": "sha1", "Tag": [ { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750966776, "uuid": "b97041ce-8dab-478a-bcf9-d78843da44f0", "comment": "Malware payload", "value": "02e3db61f8ea612719d23cd7f9c4e968d9e9752167278c00e5da1228c3a1c8fafe80e1fee41e15fb39c5b6863112466b", "object_relation": "sha3-384", "Tag": [ { "name": "xred", "colour": "#EE58FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966776, "uuid": "6483368f-8bfd-4634-8947-b522b4f49a58", "value": "T1BE0833ECB20DD790E5118637A072185E53A4A69FA62F8D338E17A3D34392B44FD2747E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966776, "uuid": "37786153-e73b-4590-9fc7-c897667633f4", "value": "1572864:rH9dEynvkFLzVmoB52xNwZtg4kFKzDbildhoggY2mEVKXbz1PzUF6Q9aua:rvEGyBIxNwcP+qHa7obzVdQ9a7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750966776, "uuid": "68df5b3a-1a8c-470a-a862-1f4161a346e8", "value": 77811831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750966776, "uuid": "0942f1d2-2f6c-48ee-975d-d8fb5a674a68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750966776, "uuid": "65616664-32b8-42f9-9d48-9bca7d6f02ed", "value": "exodus.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47625faa-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975790, "uuid": "792ee467-f232-42b2-9008-0710504c55c7", "comment": "Malware payload", "value": "ccbb3352f7d3b6a83a03431538b98d0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975790, "uuid": "c6a36b8c-0d00-40b1-bed2-11919e756e1d", "comment": "Malware payload", "value": "cf523cc855cb814fd272500d49ad7c791383904b7f89d60ef9ead77a51978d24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975790, "uuid": "50ff572b-4645-449f-9634-b642b9e6c87e", "comment": "Malware payload", "value": "aee9318271b228f2a9906fc6f90c9c43cbafd330", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975790, "uuid": "b8f29ff7-9586-44ae-8801-3e071d232080", "comment": "Malware payload", "value": "f4a95971bd3e25d18fd0be9bcdf6d4cf7bba2a5abaa97a4b0dde2820c568c2aac37a7c2c2090391897fb1959e773cf96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975790, "uuid": "1554aec4-2e7e-454a-b4d3-1394cf562b75", "value": "T15EB2E640B982D91BC4C55172BA8F51ECBB17532CE3FB3303DA265FC9265FAA64B79840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975790, "uuid": "d5f8b6da-6e9a-413b-ab48-ec5d53e71366", "value": "384:557STDcl7APBx0nh31bVPjDJOL3zD5xIkoA9B/yc9GLVbFx4ed4:5574cl7GBi31bVP+3zroe/b9Gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975790, "uuid": "a6172589-f5d5-4e95-acde-e07589ab04f0", "value": 23392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975790, "uuid": "f61d832a-36d7-4e69-863b-300e389b3627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975790, "uuid": "f7ae70f0-b28b-447f-afb8-d49d5017b9ce", "value": "violetarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927dd1ae-5275-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750932537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932537, "uuid": "a907335e-01ca-4c91-b14a-5825a451c704", "comment": "Malware payload (Mirai)", "value": "7547fa723220757831b318136abc2035", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932537, "uuid": "3d8262aa-aa1c-44b6-9a1f-e9c965d2db42", "comment": "Malware payload (Mirai)", "value": "cf60d99140ca4dd4ebea02896e8983a6f15b709f6102df86309a32098d0fb1d8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932537, "uuid": "cb837238-0d00-41b4-9207-3becb8c01636", "comment": "Malware payload (Mirai)", "value": "de4838e3e48498ed23cb24ba91aaa8840fcd4c5f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932537, "uuid": "129b89de-36d4-46fc-98ca-6e037372faa0", "comment": "Malware payload (Mirai)", "value": "400663b953d36cf1e3b7b464581b80109d1c14f8b2df2b811ff3aebb9cf7a6df40e429a9c2ef422f516f28e06751f071", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932537, "uuid": "51d27cec-a0f9-4649-a13d-8a3b9e6f2b29", "value": "T100019EDD64B557710548CD08E16FCA6C640A8EC022808FED6D8C1A7A79DEF207126B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932537, "uuid": "2a7bf9b5-280a-4f36-97a5-2f8da55b399d", "value": "12:euDbL4mxNIl5Zif0LKcSgOxVHoagkSZFtfUfHa1Djv:X/L5NI73KPgKIafqt8P+jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932537, "uuid": "81f39509-de42-4ed3-aefa-67eb11322930", "value": 802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932537, "uuid": "d31b89c6-2486-41ce-abd9-5cf1920dcbb4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932537, "uuid": "ad1e251e-6fa1-4301-b647-c14d70aca0cd", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b88bfe3c-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975980, "uuid": "7549abf7-ba3d-41a6-8dd2-5de5cfc05543", "comment": "Malware payload (Mirai)", "value": "2e4ff647bd8f011c82a92c1f0494e8d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975980, "uuid": "dcefef08-448b-48d3-858b-3f8060c9fe9a", "comment": "Malware payload (Mirai)", "value": "d011aeedc50d14a19a13189e8edc53bfc3f4e8a4eeeebeb8c4102d92fd675ce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975980, "uuid": "8ff2db48-cec8-4057-8bd5-7360be7613ea", "comment": "Malware payload (Mirai)", "value": "5038e0f8c612a9aa9deefc27cad5f434b03f49cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975980, "uuid": "9234c2a5-b538-42f3-92ba-fac7af5fb7b6", "comment": "Malware payload (Mirai)", "value": "a9c10f550a337f63f40f160ab6c9a6fc71907a88b33572005d6086e7fc6da3c773085678ab6953939017c62c0001072b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975980, "uuid": "8c0b3ca7-bd1c-4756-8153-957d3d46cb39", "value": "T183831995B8818B22C5D512BEFA2E118D3323177CE3DE73129D206F24778696B0E77A16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975980, "uuid": "00cbb772-3801-45ef-8e3f-baf1e95908fd", "value": "1536:YOnrEUrZuCFEyWUwhjF3RtLFaW513/QLMYinaX/xjS7o956YJGe:K2ZxuUidRtLFaWfaX/xjSU94MN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975980, "uuid": "b0a94995-1380-4e0f-80c7-f00cce986ccd", "value": 84268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975980, "uuid": "4dcf9d83-e75f-4a51-be3a-43e4991cb95d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975980, "uuid": "55510e8d-80f3-4655-ab70-92f2a84a7e03", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beda32ac-527e-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750936476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936476, "uuid": "f52a566e-2a46-4be2-9de5-e56c028c1637", "comment": "Malware payload", "value": "28e8228e168249e6a6f6d04aa2934654", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936476, "uuid": "ae377097-f8b8-49d1-a808-a104287921f2", "comment": "Malware payload", "value": "d03eff3c397574df0af35396bc2c1bd1f53e87a1160683de66e9e9a41fce52ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936476, "uuid": "25cb5090-548a-4c9f-bcea-786e61d29081", "comment": "Malware payload", "value": "824164c696aab34e3f7babce6a02a53bfd42aced", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750936476, "uuid": "15a77b9a-521e-4169-9e12-7dfc9f194d5d", "comment": "Malware payload", "value": "d959409ea16c624792dfdbcf88e2974182c91408611f3326781134a108f3ec7cf4ab31c1fe1868972d05aaafd3f04730", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936476, "uuid": "09633f87-3428-4c25-8559-bb6cc07698d4", "value": "T119A33B46B8819A12C6E827BABA1D45CD332703F8D3DE7106DC355F6137CB91A0E7B692", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936476, "uuid": "972fd475-92f8-45b7-9b0a-0ed6223d1064", "value": "3072:Gs5iSKYirBMPC+uYKZ2aWDzJ5achop+NR1GHrscFpBrh:b5iXYqW3JUcho8NGQI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750936476, "uuid": "677f05da-4be7-4fce-901f-282e111f92d4", "value": 103456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750936476, "uuid": "a07fb59e-0f38-4c7a-ab46-d167002ad94f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750936476, "uuid": "4ff4e7db-fe2a-45b9-97fc-d3bb859923f9", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070dafb1-52a3-11f0-8bd0-42010a9c0005", "comment": "Malware payload (LummaStealer)", "timestamp": 1750952059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952059, "uuid": "a5dacade-6011-48bd-8827-9042ee2ab629", "comment": "Malware payload (LummaStealer)", "value": "9500802598f85bcd1deb2f924123a548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952059, "uuid": "12fc7a4c-f29a-48ad-94ea-ba3f67c1d69e", "comment": "Malware payload (LummaStealer)", "value": "d0646cc36c5fae9da5d805b050f36ab0fb8d096c4511fd96ca330ca9450b6f91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952059, "uuid": "619ab2a4-7967-493a-98fb-805eacd9324d", "comment": "Malware payload (LummaStealer)", "value": "7a4554fcddc7f202d0109bc9007c7fd65b1dc173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750952059, "uuid": "e1faf1dc-7e92-4144-8f70-2d17d87fe41c", "comment": "Malware payload (LummaStealer)", "value": "2c838e9e55569db16dee4cb515c6cdba1337acfe7e4534b5fdc336cf4a58dcf5c83c401ddb76654d59e69fce21758c3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952059, "uuid": "70e8929e-d102-4937-8535-5bda5b69040b", "value": "T1B855E129D281A1EAFD6A40754551A1A5B462B923CB783FFF43A0E7324F0BBC44F2D764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952059, "uuid": "a8b15517-db2e-4328-8e3f-ff131983d0b4", "value": "f1f4088bde79fbcfaa711f90bc2bbed4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952059, "uuid": "200b2d94-a490-4460-b258-0df8e3142415", "value": "24576:AavuxytTiH9b2zpKJw16YD6+V70LzRJw16YD6+V70Lz:AavuxaiHCpKJetKNJetK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750952059, "uuid": "94c45f76-1c62-46c2-873b-6205d22a7c8c", "value": 1287168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750952059, "uuid": "10804de2-4b29-40b4-b889-d5920b0258e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750952059, "uuid": "082e7573-cacb-4105-b7b0-f51ede0b7153", "value": "Executor 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0f490b-526e-11f0-8bd0-42010a9c0005", "comment": "Malware payload (RedLineStealer)", "timestamp": 1750929335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929335, "uuid": "93f5facb-73f8-4d44-b514-bb6aa10ba978", "comment": "Malware payload (RedLineStealer)", "value": "dd1853bf4e3943a02cc0efd8b53baa44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929335, "uuid": "4d2bd43b-7335-4321-8639-d42d2a291175", "comment": "Malware payload (RedLineStealer)", "value": "d10865bd6526c7578c27e6c1d76fd3c6feb3b11fff8e0d0a3b41090a525b8bc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929335, "uuid": "de80483b-813a-41b7-a4d4-0b1d07a021e6", "comment": "Malware payload (RedLineStealer)", "value": "d9b3af16a3e7b5b52d72c1ffdf4b33aebe8bd96c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750929335, "uuid": "9461e69f-aa79-46a0-8ddd-a4de65ba6e35", "comment": "Malware payload (RedLineStealer)", "value": "692d238230dc373147cd74504a5e99c73527f800e77ff968c445dc091828d967259fe1d49132af7410215c2ad08b3e5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929335, "uuid": "e27b10a6-4a80-4342-a6a1-3772ddd65e83", "value": "T124E40128369E9B12C5FE1BFA0801E0B453BA7DCEA521E71A4FC53CEB3D617920506B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929335, "uuid": "58c40244-7b84-431b-86e8-d9d09af42bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929335, "uuid": "f6413c0a-6315-4bbe-92c2-a40e501a74b5", "value": "12288:bgrAnbpcCWoPhaz0RM2Qfk18gLS7OcSh36aD5hVT/73lKFAnlS:/nbmFz0fJ1xLSgD5JKFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750929335, "uuid": "772c5c35-2114-4f0d-bdaa-3c849516f74d", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750929335, "uuid": "7e7b8483-0136-4c37-9b64-1ac38c38224e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750929335, "uuid": "a4317717-d0e9-4d47-97de-1e2307984762", "value": "SA890098765400000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c205ff6-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975932, "uuid": "263cdec4-81a8-4aaf-83be-b69b6aff4179", "comment": "Malware payload (Mirai)", "value": "14bbef0c7ab516c4214d94b7cb7c811b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975932, "uuid": "7fe3c300-cc32-422d-a842-d87ace78de1c", "comment": "Malware payload (Mirai)", "value": "d13e4a2c37a846dc6551b5d1691aa703bae6b172dd6bfcf0414e1f451554be23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975932, "uuid": "c0a133ef-54ed-4686-a0d7-572aba0fd822", "comment": "Malware payload (Mirai)", "value": "590cda38dc815c8d5b147764c42e977b5edcad29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975932, "uuid": "f830877c-56cf-4874-9292-f0e59ec13ced", "comment": "Malware payload (Mirai)", "value": "fd381be99b2623cb6e1c67ee17a6fbb4a8550b32ea3c7dfa1bf6e3ffab0a0df5b3ada70462d8bc8f8330b8fa21e89ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975932, "uuid": "fa744388-c411-4687-8326-736ff21d8788", "value": "T102A32985B8415B21C6C612BBFD2F008E331297ACE2DE73229D245F6077CA95F0E67E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975932, "uuid": "15988c09-dac0-4141-8ead-f4994a271098", "value": "3072:vcpSFcL3NPw4BC2gxhLJf8a5pZyUSgQ+zsPt:vcp+cL3tw4ATJkaXZyus1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975932, "uuid": "1c91890b-7c06-4506-9a65-2447c073d192", "value": 103728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975932, "uuid": "9c307a8d-6fc4-4a53-882c-1db01010f6fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975932, "uuid": "fd340128-d143-4335-83ca-5c9c673c6fa1", "value": "star.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca2b1ce-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978000, "uuid": "517c27f8-352e-4782-8ed2-9dd828f2d04f", "comment": "Malware payload (Mirai)", "value": "bff3cd6be53499555eb8ec6f09cfacc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978000, "uuid": "dd579b2b-9a8c-40f9-a2ef-f697c41b33b0", "comment": "Malware payload (Mirai)", "value": "d2ca9b6da35c10336a25e6c5e17689907f50fa83702454fff7421f85c65e405e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978000, "uuid": "b4478b69-6d1c-4bc1-acf5-69e494353f69", "comment": "Malware payload (Mirai)", "value": "191d3b7b1c89505f4011a62762d1a1dbde8a13be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978000, "uuid": "ef8bafa1-aa0d-47dd-82b2-9b24e5201fd4", "comment": "Malware payload (Mirai)", "value": "63f2a777b3ab78834e744b6231518ae6d55bbafc3da8e23d012e05bafba18bf930c4e61666ea755259c550e2326e5047", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978000, "uuid": "56c9e489-4cbf-4d89-b76d-7d32d488e342", "value": "T1E1739D63C8281998C69C86F87464DE3B5363E96066C72FF215ABCA76D003EDDF4093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978000, "uuid": "f719f0f7-b577-4d72-855a-4ad4acee4cc9", "value": "1536:p/twSgMCRTm8CFXtBqKmCBB7zR4pgCtPRHk44:plwSrOaLFXtBtmm54pg4NV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978000, "uuid": "48ed612b-fbc4-4c0f-afbd-594ecb5faa1a", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978000, "uuid": "c97d3194-441d-4dde-a010-f63df8c2f809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978000, "uuid": "187548b2-5e64-4342-a7c0-f56cd4ca3294", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e432720-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975936, "uuid": "207a7f6c-de16-4384-95d2-98941507bc26", "comment": "Malware payload (Mirai)", "value": "e90e2f2c6defea2c926428f0ea679dde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975936, "uuid": "2ffc1495-34e1-4783-b90d-4ff162baff9f", "comment": "Malware payload (Mirai)", "value": "d2cc176fd071e11f88526574a742cd9f4ca796886f100d0582d0629a564f3e8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975936, "uuid": "7f41c5c8-4cd6-417d-bd58-5a6eb031da44", "comment": "Malware payload (Mirai)", "value": "03d85292ea17ed3cf7b2ec19c8b6d6b2d19b5246", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975936, "uuid": "9077ceaf-72db-4f06-ad82-0bbed6807859", "comment": "Malware payload (Mirai)", "value": "0b5566c39e9584e763e69fb476b82558a8a48111c79fe626bb88a1b123558e41468ffd9b842000ce13b9be603fdfc141", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975936, "uuid": "44167f47-e000-4d99-9544-9fbdb143bfa6", "value": "T1D9F2E132959B0E71F37219F7B7AC880A460391B0D4A636363461937260D1F7D1EF9B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975936, "uuid": "623cedda-b78e-4a08-be7a-a59e60fe23e8", "value": "768:tpDjpk4mUkBsowUBO/PvNCXmltaRGUXr6cpWsA5sts3UozP:T3pXmoSB+vNCWl8r+cm5swzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975936, "uuid": "5be83928-3ddf-47ed-84a2-32403d5f9cc5", "value": 36340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975936, "uuid": "23dd1538-f1d1-449b-95be-758e3112da28", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975936, "uuid": "fc6d4f32-afbc-41c0-acf0-e18f9565263e", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228b6b43-52e1-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1750978734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978734, "uuid": "bf508e44-b26b-472d-a99c-0a5a63d486d7", "comment": "Malware payload (Amadey)", "value": "f9381679d792fa51a2120edf6ed73265", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978734, "uuid": "a446076c-0a8d-4a6f-9c1d-733192724464", "comment": "Malware payload (Amadey)", "value": "d33f1d71c21fef8d2ec6637854918192e1c30ec737c4fb168a1581c39f54e539", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978734, "uuid": "f983f170-b3cc-4915-83a5-4fa014c956ba", "comment": "Malware payload (Amadey)", "value": "6e6257b53eaa075d8b09061fec8a87f4ec9fb570", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978734, "uuid": "65ea17cd-26a8-4520-996b-e54a070a92fc", "comment": "Malware payload (Amadey)", "value": "73f51514eea9bd1f77a4ecbc96b846d1a0e9220dc66bda2822ca3e378c87b8ff2b36029089183871be96a9184f5dccbe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978734, "uuid": "7cdfb6ca-3037-45f7-9a6f-405ea046afc7", "value": "T170E76A42A7EB0491F9F76E7054F652274537BD066F3184CBB20C2B2A1F732E08A76766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978734, "uuid": "ee86f8cc-2d48-4098-bf5f-6cfa05ac6fd8", "value": "5305619f500f3cf9c7f5cb3df5f39327", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978734, "uuid": "4f9c3bea-4118-457d-8e12-0d24853ba835", "value": "393216:iroS4hwfm/tBHtYl5wA/VTQl7t2iODG7qoYagUx+MLOeE3hykqLmonPG/FgQaYtE:govhZ/qBt0oapgPVlcmKGcth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978734, "uuid": "9c3a2724-1287-4998-9290-1c2fe8d0b55f", "value": 65820200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978734, "uuid": "1ea1ed25-42e7-4716-84de-0189a01d7ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978734, "uuid": "450d7713-c15c-48ee-981e-9323866c481a", "value": "Echelon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c95213c-526c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750928500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750928500, "uuid": "bd2205e2-3e31-414c-980f-e37a5c0f30c7", "comment": "Malware payload", "value": "d5bcb4aff65cfee425ee57c21d277bac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750928500, "uuid": "9ee64032-7bc3-4d4f-b4c6-5dd4890d60dd", "comment": "Malware payload", "value": "d34d674663b3ebfb5a57c65eb73a5660a4ce2ee422e7a38a6b4d71a35925694e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750928500, "uuid": "923e81e5-5ebe-4e9f-ae78-5b5d3a47a32e", "comment": "Malware payload", "value": "46c378976cae20999d81976f02eea1e5ce71b125", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750928500, "uuid": "a23e91ab-0de4-4d99-98da-a583faf9a2fd", "comment": "Malware payload", "value": "3c102c2f49e3edf717750449f073544f4b2e8b27c691764ec83e35aa37adcafbe7433d27cf67375b173d5a479c0bad0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750928500, "uuid": "2a39afe2-aec9-4c63-b35c-b93bf19878e7", "value": "T101B32949FC809B01D5D526BAFA5E51CD33230BBCE3EE7106DD251F2167CA91B0B7AA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750928500, "uuid": "0e36fc7c-8288-4f52-8942-047f54d2bddc", "value": "3072:QY1WWUCNdIi8QRxaYOMj2BOeTtjncyr8+7Fs:rqwxXOMj2QeJjncyrH7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750928500, "uuid": "1c0bf660-1ae1-4b74-b792-85003b808830", "value": 110868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750928500, "uuid": "24e678db-36f2-4a11-ba3f-bb539abe5416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750928500, "uuid": "801dd560-49f6-43b1-8c48-1bf8a56e85fa", "value": "narmv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a7d47e-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900865, "uuid": "79c42fcf-4310-4617-9369-671d193ffe7d", "comment": "Malware payload (Mirai)", "value": "0662709948c800cb549c22fda0f8629a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900865, "uuid": "e212bb04-0d6a-4b8c-b1b6-0c2c538e12b8", "comment": "Malware payload (Mirai)", "value": "d48773aaf10bc150749475f6e19bf0497eef8bbdd86939f21cf6cb8b9e3f2563", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900865, "uuid": "03da0238-2095-4f46-912d-9afa789601fe", "comment": "Malware payload (Mirai)", "value": "5667e296e14c2487401585d95abfe50cf2162a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900865, "uuid": "ae264ca7-eb5f-471c-99b0-c2af997b14d5", "comment": "Malware payload (Mirai)", "value": "8b48faaffc2b60005782306d68806cccf1e8086db8d9f2b8163d5cfef692053e1ed85a4ddd606d518396df91daaa7385", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900865, "uuid": "808c17bf-2b64-4264-8661-11a237a3a96f", "value": "T15AD36B01B72A0647E1A76DB02FFB67F093D9EDD115B15209A41EFF805232BF12886ADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900865, "uuid": "e5d47409-fcb7-4b36-ac06-7a1124d76647", "value": "1536:54FoddfgR/pjQSm4fVzKnCennL4UU0QfB2CX7GlytHUFzEisW4Hgit6VrKJwpjw1:0oddf0W4fI8BZ2zEwHitWKnOSP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900865, "uuid": "99c7f70a-1f1e-4c10-9205-3fd77630f4c7", "value": 133110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900865, "uuid": "b8cc4db9-14c3-4e8d-bb69-2a3eceb8d21e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900865, "uuid": "9752752e-c88c-43b0-90e8-206dd79e774b", "value": "SecuriteInfo.com.Linux.Siggen.9999.952.18884", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eba61c7-5274-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750932101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932101, "uuid": "e2fc8176-1ea3-4044-aaf4-80d94ecb2bea", "comment": "Malware payload", "value": "303995d0c0e2de68d5e4984b34136544", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932101, "uuid": "a7212d4e-2e32-42f3-bf5e-aeb4cc59b7e0", "comment": "Malware payload", "value": "d586cb5dc9c05fb33f20045434f3c4abab2672c98effa6bc4ad0e84d414add81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932101, "uuid": "99e4c785-a4e4-4c5f-9b98-c71107373f25", "comment": "Malware payload", "value": "3f04ee2ead2aca2824b55647b1817c76b4f250d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932101, "uuid": "adaafab0-98f3-4404-b245-5f656a4d8bf1", "comment": "Malware payload", "value": "a4b1c54a6f6b80ff0a422cb869e0ee514a0fdceb59d5a70480a83c5fbdb513df85cb316fecafbb16017ec80ea746157b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932101, "uuid": "25e103f7-f9e9-4540-83e4-3e80c1403d0f", "value": "T10B93F803F8C478FDC08AD2345F9F6236B675F56C1335E29FA795EA312C5AD20DA49680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932101, "uuid": "4242d764-6191-404b-aa8c-595e22b4512c", "value": "1536:U73lAQMPz7bOZTyIRxpGrM6yo/zN60O03FScLptbWxmXJM8Fhl7gWi1tw:wahzvY9cM6j60939LptbWxiFhyXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932101, "uuid": "df59cf13-cca1-45b3-a42a-c4e52fb56676", "value": 90760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932101, "uuid": "a7d753ce-e7bc-4f7d-a9ad-391f68bd578a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932101, "uuid": "fc7be40a-5732-4987-a637-1d5f1ff6c87d", "value": "nx86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a281759b-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975943, "uuid": "51af8535-10da-4e7a-bfe9-31bafa30bbd6", "comment": "Malware payload (Mirai)", "value": "6be8c82019ef5d0ed5c9edb74d54c216", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975943, "uuid": "e7d3eade-698c-4efa-9a49-60cfb0f7bfc9", "comment": "Malware payload (Mirai)", "value": "d618d03cfdec6c129696710f63ecf079b70d56f139de6ef6ba55fe2b13f76ca2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975943, "uuid": "675feaa8-54b4-4329-a95b-a2161e6e92ab", "comment": "Malware payload (Mirai)", "value": "9735371d6f2148041daa52ca24dbff472960107c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975943, "uuid": "ca24c435-ff75-4217-a9e9-c0d2d173f266", "comment": "Malware payload (Mirai)", "value": "9f618b0583e68925b0817ad521c896111a38ab9f451dee8de8fd9f0e01fca97f9c0b5b35a0eefead5a9f4cd41d8f5ae4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975943, "uuid": "3e78e5f2-5144-415e-a5fd-f0f54773cdfc", "value": "T1F3336B36E029DED4C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975943, "uuid": "621cd099-3b3e-4604-b51b-627124ca6bdb", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975943, "uuid": "75176e66-21e5-4982-8149-2a77be5df59a", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975943, "uuid": "ddc0ca9b-4194-43a8-843f-df385f4b4a94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975943, "uuid": "fe0567d7-7ab5-49cc-a3a3-af2cf05e7c7b", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5176592f-5278-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933716, "uuid": "91dc914f-5aa8-435e-b28d-973758810dda", "comment": "Malware payload", "value": "02b3a5f0121fab02f22173c9e738fee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933716, "uuid": "2c079ce0-8d83-4c47-b6e6-5f0a878aa8b5", "comment": "Malware payload", "value": "d73bcb2b67aebb19ff26a840d3380797463133c2c8f61754020794d31a9197d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933716, "uuid": "107738df-0513-4dbd-a8be-21a370694700", "comment": "Malware payload", "value": "2509ce05b7a4c5b27c105b363ba2feb6c7d18b56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933716, "uuid": "0afcb6e9-dd91-42c3-bc36-8bde637a3f23", "comment": "Malware payload", "value": "a24eeb20707b706aedf4d5ac72258edb3d9ed8726cc20f171c56aa35333348c1ce48121475de61524d2fa476b57b6dff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933716, "uuid": "8d4d7bc2-c4fd-4604-8e73-7dbe69b0f0d2", "value": "T12F245043A55001C8E86EE12E1187A51BE5F338E1CFE1B54F2212EB5F39C2EB236D959D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933716, "uuid": "d1fbde7c-3f22-4b84-a497-343668065267", "value": "c5dc0a3ab3f22aeaf807779d165c2e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933716, "uuid": "5af78ee9-d5c7-42de-bc37-5249822cd164", "value": "3072:JxiLLprp23VsbKWtiP5twHeLZN9y6l2eGHtTu2bzOtkNkUeoDReY:JxiZrp23GCrw+FN9lhF8XuqsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933716, "uuid": "bdc06726-8695-4759-921e-5204de4348b8", "value": 212624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933716, "uuid": "da6318df-f445-4479-9d51-c2bd635c9b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933716, "uuid": "0b5466dc-fd25-443b-9ff8-68c725ad6952", "value": "PuTTY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096eade1-523d-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750908255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908255, "uuid": "a3e37c8b-e3e1-47ed-ac38-168e3178f4a3", "comment": "Malware payload", "value": "446faa8ccfe435162f7996d9e989666f", "object_relation": "md5", "Tag": [ { "name": "CITYLIGHT-MEDIA-PRIVATE-LIMITED", "colour": "#682B62", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908255, "uuid": "4f316434-80eb-417c-8f4f-33898894adbf", "comment": "Malware payload", "value": "d883c067f060e0f9643667d83ff7bc55a218151df600b18991b50a4ead513364", "object_relation": "sha256", "Tag": [ { "name": "CITYLIGHT-MEDIA-PRIVATE-LIMITED", "colour": "#682B62", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908255, "uuid": "bbf9425b-596b-4afc-b11a-d897e139ac8a", "comment": "Malware payload", "value": "7448c0894ef17a085a478817a9465a36d2807048", "object_relation": "sha1", "Tag": [ { "name": "CITYLIGHT-MEDIA-PRIVATE-LIMITED", "colour": "#682B62", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750908255, "uuid": "919fdc41-7991-4478-a59e-b564566cc9f2", "comment": "Malware payload", "value": "b2bfa8c623da48c0ebda34d62193f6844f0b68f2e89df228e4ff70c6350e9115431b9886f00dde1ecff0f657e1ef94cc", "object_relation": "sha3-384", "Tag": [ { "name": "CITYLIGHT-MEDIA-PRIVATE-LIMITED", "colour": "#682B62", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908255, "uuid": "65a53f9d-8535-4206-be1f-3554a06f5f31", "value": "T1B8D623A1F145407AE6933A723C7EDB70563ABD2F0790894913087E3A1E3778395FA927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908255, "uuid": "3f27ce2a-b0cc-4474-a8cd-59628c3ddf44", "value": "393216:c54Rpo1BghcZQp3ANMJxMBeoeAXVjtxBo:cuRpoTgGW1rJyvbVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750908255, "uuid": "3be6c9d1-6544-4459-875d-9eb385a89876", "value": 13838848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750908255, "uuid": "a6e7c272-16a7-4398-9b22-43381624fe96", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750908255, "uuid": "f1cf44aa-b1fb-4287-869e-46c16ba289a1", "value": "SonicWall-NetExtender.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c304d7-5245-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750911810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911810, "uuid": "f041dcb7-9a32-479f-86f3-1670de6708cc", "comment": "Malware payload", "value": "07a040777555bac562fd131c98a29e78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911810, "uuid": "5b03b2fe-e634-4d78-8cfe-40e3050f3445", "comment": "Malware payload", "value": "d887c66f595af8ae184a6b5077f834d18ddb093a7d5551d21f4a730f0f4500f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911810, "uuid": "3ad62318-b063-437c-b656-de61ad76de27", "comment": "Malware payload", "value": "d6071cbaf204a6a90216f84ac58ce8b4cd2f8c3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911810, "uuid": "16eda4e2-a818-4a2f-a410-d59f09ba134a", "comment": "Malware payload", "value": "d848c69cfa3f114ec1f45728208bc0693467a97f25185eaaa583167cb9ee17e226cda71fa19a5d9a5b247b7868f1ea12", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911810, "uuid": "69ed8119-8fc1-4e51-a670-c3b18b57d41a", "value": "T1F7B402018F881F8BC5AFCD754A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911810, "uuid": "d380ce60-b4f0-4ede-af5d-6affc65151ef", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750911810, "uuid": "b6fce6ed-2333-4938-9fa4-4dfaf33a572f", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750911810, "uuid": "ecf045c3-f0ba-4723-b114-b6f1ad949d50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911810, "uuid": "53d7c5ab-daf8-4703-a263-bc990b2d97ac", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7828e0ba-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750914024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914024, "uuid": "218f5cfb-fb5f-47db-8291-13af79e50903", "comment": "Malware payload (Mirai)", "value": "83f851553a9d4d3c5b165d5ddaeb64d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914024, "uuid": "c749567d-00e4-431f-a6bd-73ad18956cae", "comment": "Malware payload (Mirai)", "value": "d8aa947123f7edf93e6fdc1f828b5c4f783058a04fb7c807393d5a41783e053a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914024, "uuid": "192733c3-b984-4e22-9287-b5006323564a", "comment": "Malware payload (Mirai)", "value": "25027c828baea1017ea736ad5a5adf7e185bb655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914024, "uuid": "1cb03758-f6c6-4ae2-9d22-4a1e346236b9", "comment": "Malware payload (Mirai)", "value": "f774ebe2b6dcff00e3e09906cf7a28ab8255d23b6809940dc78a1545640c4d1e67c535abada41a33e66bb5ba5c7c38a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914024, "uuid": "7ef4d301-06f3-494d-90ef-789c40b44395", "value": "T1BB230271850E9EB125303C32EED9D7537AE129B1C6672013D6290A3C6FB57131E47E4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914024, "uuid": "81218419-1d9c-4429-8def-591bfbd4c0f5", "value": "768:g/TYCoIxdEk+AxoTZAZHFeq8b3sw9q3UELbUXfi6nVMQHI4vcGpv5:gECFd+A6YHAxs5LRQZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914024, "uuid": "dc346fd1-dceb-4104-bd7d-8bb0970f7dff", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914024, "uuid": "d70456b2-c416-434c-9cad-5ca3a6925ed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914024, "uuid": "a46dfa5d-2676-4595-b890-b3675b30168c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caae0b59-5248-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750913304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913304, "uuid": "eb78fddf-06aa-404f-944b-df1a9238604b", "comment": "Malware payload", "value": "e8c399a261b2b3b978c789e0c3d77d65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913304, "uuid": "926fd608-596e-4ad1-8aa0-4b9b3adad9f0", "comment": "Malware payload", "value": "da1a5fb86d21c58f2483f9af83bf9196053c981606f1a74d5d47c23d843d8f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913304, "uuid": "9df5c376-457e-4a06-9e23-22b97fb1ed89", "comment": "Malware payload", "value": "223fb0b1caf5d3ca38f87e82f235c6310d3476f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913304, "uuid": "948bb892-39ab-4eb2-a8e9-84813ed8e6fd", "comment": "Malware payload", "value": "8c59960a5848e52af46103ccddcc0fc9015837762923bbab0ef5b4bc781340309c95385becfb4b25f698c06171015a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913304, "uuid": "2b1f5984-e5d2-4d77-9d11-ffdd9b2112ca", "value": "T162343B4A7AA51CF5D5BBC139C941150AF9B1789247A0EBCF13D04A9B8F23BE0AE3D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913304, "uuid": "694e4cc8-4a13-4b9c-8fe4-33e105b3d40b", "value": "7fd4a52e3c4f080a3ed6ea549efd9560", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913304, "uuid": "1a6c3a81-c910-4e14-8e1a-b25ffc23e309", "value": "3072:omDmBnlL921czBeTCb8vkbkx4dAjH8ha82srkausWMCDsduG0hc:AwczBeTzcgtQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913304, "uuid": "3500c23d-be3c-417d-ac8f-1ae2702059e0", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913304, "uuid": "ca33cf1b-2a96-47ca-af19-5697c701a9de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913304, "uuid": "8afe9dfd-648f-4abc-9e3d-f4381c88f898", "value": "SecuriteInfo.com.Win64.MalwareX-gen.6869.2505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c93893-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955366, "uuid": "5751a382-819e-46e4-aa66-9c845679d10a", "comment": "Malware payload (Mirai)", "value": "b9111bae5e4b107f9991b507c3a33951", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955366, "uuid": "60bebc91-68c6-4be6-b877-217f0a30af39", "comment": "Malware payload (Mirai)", "value": "dadd69518bd27d606869306e531d09d6dc8f1759e89a2417696950848c3128d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955366, "uuid": "a44c2fe4-c07c-4659-a1d6-0f4dd30dff49", "comment": "Malware payload (Mirai)", "value": "cfed247bb64c2ec5d256540854720303d80fe10b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955366, "uuid": "2a1edf10-7e52-4aa4-b78b-a88eff0d978f", "comment": "Malware payload (Mirai)", "value": "0d576171935bff52f188bd2e76489144f3efe22028938f4a2cda8361d2cd537ac9184772c3f97288bc43aebb63683e28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955366, "uuid": "709f14f5-8c52-450a-b18b-091d29b9e713", "value": "T13C82DF3061AB74F4DBE14431FAEECEC2971A0BB8D1FC36931658AB7C894110655F93CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955366, "uuid": "bf2d8a54-eea7-45ea-8929-ee546945eae6", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaIhymdGUop5h5lq:2dV0P6+kom0tVAoNvm+to1Is3Uoznlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955366, "uuid": "38a14fe0-a859-4368-b1a8-bd57159d2e0f", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955366, "uuid": "a18dbb33-02d2-41c9-baf5-1996b82b0b26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955366, "uuid": "2d054d8b-ecfa-4996-b2b3-b514a837702c", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e29c5cd-52db-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750976365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976365, "uuid": "dc32349b-e400-4f24-bbfd-173a16846a48", "comment": "Malware payload", "value": "bb0b6d3366dc65aa297db3021eff104a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976365, "uuid": "e4b98436-39e5-42ae-abbf-eb9f570ee5d3", "comment": "Malware payload", "value": "db890799b0c9c89689f6f103ee5933f0b0c07fbe0297fb4414bb34e473962733", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976365, "uuid": "aba1a541-897b-49c3-8654-a0c57c980350", "comment": "Malware payload", "value": "83520a6dc9e6b423ab4875e250751ffed067bc74", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976365, "uuid": "9986c3af-2762-4a3e-bfdd-7a0e8515c5f6", "comment": "Malware payload", "value": "67a19dcfe4c13ace70f5f25748eb8d389f0d09620cca1061f4185fa329d837959ddb6c3ea06fe79a6904708238422e3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976365, "uuid": "2b7b478a-e8d8-4fdf-aac4-84dc2ed6ac56", "value": "T137C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B42469E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976365, "uuid": "e1095898-2c4b-40c3-81aa-bd2d514d60a3", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976365, "uuid": "04ce8e66-fc11-480f-aedb-0e30769ec4ba", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976365, "uuid": "54e46666-d84f-4894-9662-f52fe61dfd77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976365, "uuid": "1533d600-9939-4721-9bdf-7707e46e69d8", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797ece99-527b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750935072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935072, "uuid": "6da17ed5-ad72-4222-bb5e-ee5c3509a6a7", "comment": "Malware payload (Mirai)", "value": "1113c41756e5b2159d2142e3818d82a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935072, "uuid": "c6b1ca0c-8540-4bb9-8bff-ed599b6852b1", "comment": "Malware payload (Mirai)", "value": "dbadead6eff01ce4a92270e1fdcf0a07a5be3cd6a4ac025052f8133a988fab6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935072, "uuid": "8364ae9a-809e-4b30-a616-d829db89deea", "comment": "Malware payload (Mirai)", "value": "d0a9b265a5fb5a8e0faf333b014f94476e7b3e32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935072, "uuid": "b0c3b6d3-3302-4f78-82ee-f80ff14f1913", "comment": "Malware payload (Mirai)", "value": "6257aa34aadb835768aa6ce58d98a9e4d36e84c1f46bb7f4ae0b8576e9d9b8d34ff7e988c444071fec57ec6d520024db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935072, "uuid": "5d302101-0650-4049-bbde-a4b66a19f2ae", "value": "T16DD3D8BB77107B6DD268C17904F343E993F6238212A39145B139D63C5DA234C1EEFAA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935072, "uuid": "1985d564-92bd-4d93-b641-75128c8d0d13", "value": "3072:wLXlwxPuyvrcrudJZ6SMjUTFA+ui+yZ47CqgeSjBRyIerejLdzDb+RPm:i9msApDbGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935072, "uuid": "5c4e89f8-f0fa-45ec-838e-2f47df9deda4", "value": 139276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935072, "uuid": "a8738e9f-4ccd-4555-9c3e-6c44dd9922c8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935072, "uuid": "0d9477b2-4641-4675-88c9-3bd20e687e51", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3fdaad-5255-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AgentTesla)", "timestamp": 1750918895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918895, "uuid": "ab9f621c-cad6-4357-bd5c-cb2d9380c953", "comment": "Malware payload (AgentTesla)", "value": "d19fb2c192fc7ba00557aa1b5b44b329", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918895, "uuid": "3a924c35-8a87-461f-ac1c-a9f4a820dc4c", "comment": "Malware payload (AgentTesla)", "value": "dbc5ffc9ec56805dfde8fcff260e329e6d5e6496e6208207f81ece57b6fcb4ca", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918895, "uuid": "a266f59c-df9f-49a0-b47c-e43db862dc5d", "comment": "Malware payload (AgentTesla)", "value": "872134bb4c0be9851d799a2869f141151bd5559a", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750918895, "uuid": "1a152704-fcc6-49bb-992e-83307a8de58b", "comment": "Malware payload (AgentTesla)", "value": "6f33df059f4690b2a754b952824d36c31e19bf42ff6d7459b6867b54b96eb1045d35d02ba8fafbc45af2801b62aedffc", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918895, "uuid": "3eef75f3-82e5-491d-ae3c-c36ed28ac6f9", "value": "T1AC530193CD2887636C339D72633C8646A69D8F5D867E73C84A2A5823470CD6D4F9D287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918895, "uuid": "af096125-91ae-4401-97c8-509a6847e80d", "value": "768:RZ03McOu4BbZM5HMt6ciu1pGpEajlRcvj7VAW+4ki0HVqklBW7g0omg4Vq:RSrtxyGpJhRSki0HVtUg3bAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750918895, "uuid": "3c42d729-6d8e-4fa7-b071-f739af1115dc", "value": 62434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750918895, "uuid": "6d5bfc51-251e-4d17-93b7-913bab3977bc", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750918895, "uuid": "9802c926-deca-4d53-95d0-84ff62023db8", "value": "RFQ 3162189 PRHO64 SB200 OEM Specifications.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "995b1617-529c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1750949298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949298, "uuid": "ebbdd473-37cd-4b66-aae2-783019e5b28b", "comment": "Malware payload (DiscordTokenStealer)", "value": "d7cfce462f0dc20cd34173ec9753caac", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949298, "uuid": "3b607509-d566-43d4-9f54-41e48b295c4e", "comment": "Malware payload (DiscordTokenStealer)", "value": "dc8311edb0823f5c34c4562524bbb228981be8942780b9ffebdce2a4524649dd", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949298, "uuid": "e15c64c2-a98a-43d8-ac12-6f2b66c4b000", "comment": "Malware payload (DiscordTokenStealer)", "value": "7760c72b7c109239e2f9efcd281a42d51b0060ab", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750949298, "uuid": "d7cc249e-73ed-47df-812c-adb0f2f8598d", "comment": "Malware payload (DiscordTokenStealer)", "value": "63a60fd887d1b2fec8609e83592b5291c33d31f0233bfa2cdedca94919726e6b44fc1ce1ca1cceb5c7a3cf09bc34ab34", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949298, "uuid": "b39da24d-11e9-49bf-8b21-d5e8dfb7c1f3", "value": "T1A0F7331D6B947984E354533B8223CE09DAA8E106526FC84F23E424362CB79DF65FFE52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949298, "uuid": "a01e7a6c-a988-45c2-8ace-a073f5fda970", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949298, "uuid": "a27ac667-3ea1-4f0e-882f-6b25bab0c562", "value": "1572864:7ScKiEEb4DVd1AEJ5Rh1+BDDy4gds8KN2IC+oecE8+Gi4UC9q:mtVd1AY5bADDxgds8pLexC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750949298, "uuid": "a9115f59-9f05-4efa-8df5-98a42e7e300f", "value": 73997695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750949298, "uuid": "41074862-57b8-4a67-80bd-490d45c9d35a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750949298, "uuid": "c4f45f53-2ecd-499d-9eda-3618161adf72", "value": "Woofer_Perm2k25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ac7e98-525b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1750921216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921216, "uuid": "d395289f-284c-4cda-81d0-93d40493d411", "comment": "Malware payload (MassLogger)", "value": "5d73dd5e43a5ead509673f62ceb14145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921216, "uuid": "bf4a5290-fcd1-43c2-b2f7-195bab1a2e23", "comment": "Malware payload (MassLogger)", "value": "dd79f49b1ea6c5e7f545e2752618fd71751c1ef33adb3fea3512e322bf8ed597", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921216, "uuid": "bc75f819-07b4-4a95-8aaf-29e1ce4e1a67", "comment": "Malware payload (MassLogger)", "value": "aeb236472e3b4abf7b332b1954e814d149997f15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921216, "uuid": "85db3e12-5eb0-4fe0-ad10-95c521dacc7e", "comment": "Malware payload (MassLogger)", "value": "b5ae236baf84eacfd4e82bcd260a35a6c467b11c2f98b417a999f4d32273272ad6da102d6720c5f034cceb4c0654c184", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921216, "uuid": "fd319af6-ae95-4ecb-985a-178a060f1ee2", "value": "T1F4452356315ED093E3220AFCA42B9AF122676D405A86D25B39F07F5DFCB26418F67383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921216, "uuid": "63170924-21da-4a25-9249-e82287d40187", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921216, "uuid": "40c668d7-bc9a-47ec-862f-e505ac1fdba3", "value": "24576:fMwmfX/MbUH1ArfTjsoMqxvETYAPmlLMda+sV8DXIC/RknSFaEGLqm:fMwk0bQurnBMqxeYOBda+sKDXIC5kSF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750921216, "uuid": "7ac33c97-ad4b-4e00-8932-10b129f6e1d8", "value": 1236960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750921216, "uuid": "97eb4964-bf6f-4056-ae35-613a49c76396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921216, "uuid": "118e04f0-94ea-424e-9efa-d1e6ef27ba72", "value": "rNewOrder20250626001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b688233-5278-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933652, "uuid": "7401baa4-8687-45f4-aa5d-95fd05a96f94", "comment": "Malware payload", "value": "4e61cfa7d791788ae557319e83c63fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933652, "uuid": "063b878a-4266-4e94-8740-3ca3d7e978e7", "comment": "Malware payload", "value": "dd995934bdab89ca6941633dea1ef6e6d9c3982af5b454ecb0a6c440032b30fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933652, "uuid": "daa8d5e8-9e6f-478f-9dfd-d26237634d97", "comment": "Malware payload", "value": "dccb81b59b22bd45f0ea2987ca5397983a4294d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933652, "uuid": "7d0ca983-9346-4dcc-8438-8f1b0d2d0ee5", "comment": "Malware payload", "value": "d8b006ca277f77875d9508c22f155bafeeb4eb719c824065fd7a683ec9ab0070d6b3d17a8ec111fee10242dba211edc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933652, "uuid": "7b5217d9-9119-4f55-bf4f-331f6df8d52a", "value": "T1CEF39243A1A001C8D8AEE23D51856117E5F338E18FE5B54F2216EB1F34C2FB276E999D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933652, "uuid": "1966760d-df24-4f77-83f9-12c3e0c7da79", "value": "c5dc0a3ab3f22aeaf807779d165c2e0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933652, "uuid": "18136b21-2a83-400b-8846-f89b0e61cac3", "value": "3072:Il5AziEES8b+Ou/9kVMwAXo+sCV7Ekjy7/B9QCbeg:I2iEQhYI+jEP1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933652, "uuid": "d2ac9de4-4fba-42c6-8f55-e993f010fead", "value": 158360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933652, "uuid": "98c1a545-41d4-4f78-82ab-52e1100fd53b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933652, "uuid": "150814ed-d90d-4bc1-be74-faaa7cd50d2c", "value": "twain_96.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6cb11c-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750977996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977996, "uuid": "d71c8b7b-08b6-4d72-b241-609229ffd210", "comment": "Malware payload (Mirai)", "value": "43ac65139d7c70340add36eda32fdefe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977996, "uuid": "a48cc1d8-ef74-4e4f-b03f-02aee4dca993", "comment": "Malware payload (Mirai)", "value": "dd9f3e29cf530bcaacf6d22ea59bf78b1b93c34f65f6521c8de705e7c2a56a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977996, "uuid": "e35c3943-716c-477f-9fd2-4fd8a3b5d6ef", "comment": "Malware payload (Mirai)", "value": "ce7c64d5ca0296f5b5763ab6b5a6ced08dca9056", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977996, "uuid": "692f38b4-443e-4c30-b936-1fd1e8861f71", "comment": "Malware payload (Mirai)", "value": "f7de09bac7abf49ce8d61e62b51bbbe4dc81d8a049b748826440c57a2162b15aead932fab5d9b11d456239d664c185ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977996, "uuid": "8807dc6a-3d6d-4f33-859f-456c31e28882", "value": "T1A6933AC6B400DD7DF80FDBBB4463490AB531A7625A931F37676BBD93AC321A04856E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977996, "uuid": "9bbfbe6f-d97f-4d6a-b527-fb8552b5fab2", "value": "1536:DBlFQAe3XjcPnF11dK1tUXAh4ip1IGYj0IjPZ8rEANJ6rE9sMy5vEE5+q1zEHC83:DRPF1LeyXYXW0IrZYd93yNnzEH94G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977996, "uuid": "91fd2f71-0187-4408-afba-6913beb605ff", "value": 91928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977996, "uuid": "bf472267-8f72-420c-8dec-818bc616893d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977996, "uuid": "2c7a93cf-0e66-458b-89d8-4d91fb93eae5", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165c22ab-52ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750955951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955951, "uuid": "673a1c3d-195d-4ffa-be40-08ed94ce2412", "comment": "Malware payload", "value": "aeff906bfb392bf00cf7dd43393397b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955951, "uuid": "321089d7-dec2-480c-9947-25f7a110f2ac", "comment": "Malware payload", "value": "dda1b9f7cc99df39600c5e98685722762fdb214bf2ef00b3d592ab3cc4bd748f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955951, "uuid": "c6a51f35-5818-4296-bcb3-bedab307d632", "comment": "Malware payload", "value": "e922f1413aea19c8e857cec895fc1e5f7e8dbdbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955951, "uuid": "b25de412-9adc-4bfa-a0ce-3fba4af94e07", "comment": "Malware payload", "value": "eabdd2e3a3b7ea6bc963a65cd8232ab00a86b49039624e05abc4c434438b375f505f02f8a9d482f9df3a2d961551decd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955951, "uuid": "667042d6-ab26-45fe-b8b2-5319b1990230", "value": "T135C4F1A377204F91C35195B209F389335AF6199706F39982537DEE107F20A68386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955951, "uuid": "2254b2b5-3ce6-44fe-a3ba-9fe3642a9f1c", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7z7:W7v+mrY2xzf03yvZ/YIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955951, "uuid": "15d2dc3e-9a8e-4873-9598-de897efdf8a5", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955951, "uuid": "a81036f9-7f18-47ba-8f26-699c7ade81b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955951, "uuid": "615f530f-c345-4d3e-a0f6-af0497b08496", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00c289d-52ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955806, "uuid": "f961572f-b419-4ad9-acb6-d0bb40d2a106", "comment": "Malware payload (Mirai)", "value": "b993c2bc164f01133b30055539de5372", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955806, "uuid": "31a9e73f-5f48-44e0-8254-5626765faf25", "comment": "Malware payload (Mirai)", "value": "dfbab2bd0125bc38db8f8643192e413325b983f81eec2d0052fed4ce4b3a3dd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955806, "uuid": "8f126379-cee6-4f46-ba7f-496134387158", "comment": "Malware payload (Mirai)", "value": "ec846cdf019a4af9c735585f123e05c1f4290f78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955806, "uuid": "8b019df8-3c6c-4fcc-ace4-f50586cfa64e", "comment": "Malware payload (Mirai)", "value": "663e25193848b23ccf6d50746747cce98d50a1821c073097e71f038ecce9a64580b22902ae7338dc3c01dd6cc32eea67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955806, "uuid": "70da811d-fdd0-43fa-b91e-8e4f12e57d5f", "value": "T12563951E7E219FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955806, "uuid": "0981d2dd-c0ca-47e1-bcf4-f2a687bfdd25", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatA7:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzoL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955806, "uuid": "bc08bdcd-bdc5-4308-988f-45df55d6cf62", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955806, "uuid": "71fee710-c269-484d-b006-3da076c9e73c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955806, "uuid": "f93fa47d-5d8a-4d7f-b558-d600e8c51c70", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5392cc0c-5243-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910956, "uuid": "ca3cd1d5-1048-4f90-b01e-19e18e298bfe", "comment": "Malware payload (Mirai)", "value": "6fa241132aec164fe013b0be00ee882b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910956, "uuid": "95094ba4-69a7-49d1-b900-340982563564", "comment": "Malware payload (Mirai)", "value": "dffaed1dc45fa25bf7d329cf56ed0bc2413bfc98c794bdcdd55744e6109f7003", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910956, "uuid": "732cc08b-f79d-407d-a2e7-f1d0f20d5a2a", "comment": "Malware payload (Mirai)", "value": "c8f71fc0a75fa43ea6f7126880853c37eef8098c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910956, "uuid": "5028690e-2e25-4880-af11-289015039b3a", "comment": "Malware payload (Mirai)", "value": "1d5fe1a3b36e6848eef97ec089fca18a9a784a078a6f2c408ab7c2b3af8bf60ac872573a108cd6e3b97b948d1db52993", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910956, "uuid": "5f9ab9ea-c76d-4323-a7df-e4da35803a8a", "value": "T18341E8CD9ED18B13CB8CCE85F161C2967C694D86A6A7CE989C9B1CA4486D908303B797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910956, "uuid": "eea6f1a2-f986-492e-a3b1-5dba875555bc", "value": "24:/DbfRDjJrDDDCF8DNfDNKDhDNbDNBXDN7DNJMDQGDOXD3DtDLDZtc4ZDhDmZnRD+:zXJUDNHtJx64mZIF1UsjGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910956, "uuid": "2dc592e6-d215-4a94-b74e-199f052a2864", "value": 2162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910956, "uuid": "c1fedcc6-834e-429f-8686-42097b9b5a35", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910956, "uuid": "59889b14-89b8-4d26-a4cc-0d7e360405d8", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b968109d-5256-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750919287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919287, "uuid": "acdddf53-73ab-41c2-ae38-757eb05fc4de", "comment": "Malware payload", "value": "33f8ec86b139d8cdde2281682a561ba2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919287, "uuid": "6ed37a47-f7ff-49dc-abee-018d20b2a044", "comment": "Malware payload", "value": "e06733f55074f9ef3c484d507ebb9c54a961cdd19960967834fb62080997f0ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919287, "uuid": "ab880c7f-672b-4063-bec2-0ddf557d4fbc", "comment": "Malware payload", "value": "5abdf9495ff3823f9e34bc6c42cae4fa56fa793e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750919287, "uuid": "e62583e1-8a72-41e1-8710-597dacf6f0fe", "comment": "Malware payload", "value": "5acc75e0f2f65619ae38d2408cd89765e3790abda14e1080db7fd4bf9b136a9ccdeca2d7cc3058deb35202bb8e6f7d46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919287, "uuid": "b77cc087-4b95-4410-800c-a9705cbd0251", "value": "T136A33A46B8819A12C6E9267BBA1D45CD332703F8D3DA7106DC355F6237DB91E0E3B682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919287, "uuid": "cd297e97-a468-4971-a3eb-ace9397a1b9f", "value": "3072:8w6ioVsIeb4GZLQAIZ0zLqhodd1WNRlGHrRF5R7B:x6pIUZwLEoddwN2Dl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750919287, "uuid": "41377c9e-6cf6-4ea0-8853-84b9e57655e3", "value": 103456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750919287, "uuid": "b3b7425a-fc4e-4be6-bf2c-e0f1e5f9037c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750919287, "uuid": "731aa1b4-3dcf-4bca-8335-8bac709510a2", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a2f070-5246-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750912198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912198, "uuid": "5cfbf689-2c37-44a2-9f58-5ecf2538e32d", "comment": "Malware payload (Mirai)", "value": "e25a8a4187766fa737d6ec9a19efc49d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912198, "uuid": "29878dae-e95b-48e7-b0a2-4caefe647933", "comment": "Malware payload (Mirai)", "value": "e177d0d832520a3db244aaf3cc4a01b2394c06295f2c6a44d9e1631bf725027d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912198, "uuid": "0f941a95-5094-44ce-b06e-ce6d3dc5b277", "comment": "Malware payload (Mirai)", "value": "9292ac5560de7b1bb938b00d4eb591bf8df38bca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912198, "uuid": "56a91300-70b3-4108-89ec-86a3fe992fd7", "comment": "Malware payload (Mirai)", "value": "7d73ab000608e62eafe327456ef2f3b6698900b5c40e153d33fa8224f04aed03887a66ea7a1646b5e2b7a58fe1bd8955", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912198, "uuid": "1d7416cf-1fac-42ee-bdc9-a71c27274c47", "value": "T11C042A46EA404B13C09627BAFA9F42453323DB58D7EB73059528AFB43F8779E4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912198, "uuid": "d32a441b-e18f-4e22-acfd-ae84903b0edd", "value": "3072:xfAysBn0yiKjlzaZAQimt6pbvmA1gGfK+XPSorM/RkX6plA:xf2n0B2NaZAQimtkSAqGfK+fTrM/RB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750912198, "uuid": "ab51ee54-1daf-4d60-afde-9905fa31c465", "value": 180495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750912198, "uuid": "aa633854-1ef5-44af-a01c-a95b6689d58a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912198, "uuid": "eef0733c-60a0-4b85-ba4a-15bf996fd96a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9564ff6d-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978068, "uuid": "0eaf9d73-118e-48e5-8a85-49e80248d4f6", "comment": "Malware payload (Mirai)", "value": "739ee353afbd8266a6ac474f87194330", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978068, "uuid": "965e5656-7ace-44de-a28e-a331ae4689f6", "comment": "Malware payload (Mirai)", "value": "e17f696f3a378fa4f741e4b211f4309192504c8ba65746bd0de8181d14a6f3b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978068, "uuid": "fbf7e99d-f99c-4b97-b371-cbfb1f78c05b", "comment": "Malware payload (Mirai)", "value": "803952e00780bd05ddfb412594f4e00386a46771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978068, "uuid": "43e97f19-bf00-44a1-8b40-b7414798262e", "comment": "Malware payload (Mirai)", "value": "f2b3c8237b5e7e9fbc8417ee02e05652f76c9d4f58d42662d16ebde174069fac66bf2fa41358d75cd5aa5f8b7b992bbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978068, "uuid": "693547f8-9531-4da4-9179-35d1d027a20e", "value": "T1CF331841F8D299AEC6C4137AA73E658E3351B394D1CF3617CD596F2133CA60F4DAAA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978068, "uuid": "afcb46a5-c580-4cd2-aed6-1619c0d930a8", "value": "768:pZygrYx5AREN20ODEFbcFVfJ+erf5swMCAhgn5JD1yxottCieQM+eBNknvKmziB:pRLMQDEViZswMCAmD1yueQJwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978068, "uuid": "fc4e7a5a-afb7-48c8-a43c-74c85009e197", "value": 50616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978068, "uuid": "74b8c560-8a70-47ea-966e-d9c641d03add", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978068, "uuid": "edc38e7e-84f6-4965-a3af-2a484e2a8589", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36db1e66-5246-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750912197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912197, "uuid": "4c5acb1c-7719-4a73-af36-a5b1a1401da5", "comment": "Malware payload", "value": "2ea3cdb4b5bdfe9725a8f233aa9db385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912197, "uuid": "fe84d425-c8f8-4baa-88ef-293c332c7626", "comment": "Malware payload", "value": "e25404ae44176fc5f50b29d1cc84c277940c14b731e605aaab79e624357efbce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912197, "uuid": "c1aff5a9-b31d-4610-bf79-ae6850f9d1f8", "comment": "Malware payload", "value": "612ffa5c56326c77a5bb5e0b1b471acc33f9dc3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750912197, "uuid": "574a5706-7aa6-48cf-87d7-692e121b493e", "comment": "Malware payload", "value": "f29a7860de0fe0b404a07c0ff3861a4fcde5f3d43b0cc59126bbb0a3bb0f3cd38d233985fa1e45c16b988eebab94b83f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912197, "uuid": "d77babe1-55fc-4086-9a40-a5c3044df55a", "value": "T12BB41228EE4E38C1F3D1E3B8DA0A4BB1B05B79D0C166C1B2BA41E25D95EDDDEC5D0212", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912197, "uuid": "43e21e4e-b03d-42c1-a7aa-d81bd948cc82", "value": "6144:O/izeB+/ow3gK2lc5bvyI0vOHD6BZkDgn358cIF3RI5HkdY1FP98/8ecjfP:3BohHKTyfvOHD6ByD4WcIMkuDmEesP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750912197, "uuid": "a0c366a7-24fd-4a6e-9456-171e5867fb55", "value": 509896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750912197, "uuid": "94bb0137-74ab-4bda-a492-c67191639ce5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750912197, "uuid": "eb0488b9-d516-4b22-95ce-944b525565ea", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da17510f-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900874, "uuid": "97629221-c201-45dd-8784-7c5a11d8fbd1", "comment": "Malware payload (Mirai)", "value": "c710a4ff0a2b5b506e8d91ec16d03955", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900874, "uuid": "c9a8d8d5-5b19-415b-b789-58d56454f379", "comment": "Malware payload (Mirai)", "value": "e27b400f74cef4ed54877b5970f5795679906b9c87fc7355733b6c2cf55a88d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900874, "uuid": "c9e40405-9e5a-4a79-99a9-6940efc12d69", "comment": "Malware payload (Mirai)", "value": "8f6bee512327d93408e85d7d26171f52dfe52241", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900874, "uuid": "2e11da4e-1107-4aba-8a43-4c29935fe208", "comment": "Malware payload (Mirai)", "value": "6acc54c40cf7a4852c965815c49bd781a6b02b1935a69660e1f23e470cc5cf1dbb34cf73bdf7e6202b5115b7951731ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900874, "uuid": "878eb3dc-ef09-4e57-afdc-58afca8f4b84", "value": "T13D149D7AA42C42EBD07B873F0E4752342F36DEAC172347686B2D69348D623349F5999C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900874, "uuid": "c6863506-7eea-4706-9558-5fd6a86de10a", "value": "3072:uRffa7nkW7WzqP17Hv8ozuSYhqYgjq3/tOirQqg9W:qqkW79P1Dv8ozuSwqHqP8ikqg9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900874, "uuid": "a5b798da-b6a7-459d-abcf-3935ad1e4e6b", "value": 197268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900874, "uuid": "4fe42dd1-94f5-4efb-9478-ae356d8ae6ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900874, "uuid": "84c82def-8535-4c49-accd-42da3dcbaa0c", "value": "SecuriteInfo.com.Linux.Siggen.9999.17297.32441", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b586e7-528d-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750942796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942796, "uuid": "a3601373-bb5d-438c-b70f-65dfca64f953", "comment": "Malware payload (Formbook)", "value": "a7a8f601e22afe4a8839d7fd9f054876", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942796, "uuid": "651539f4-9a97-4217-8575-911772e70f01", "comment": "Malware payload (Formbook)", "value": "e3b280fc7bd9dc77cf90901553a8d9e103d8ce3eb4fb4f107599a6c9630ff825", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942796, "uuid": "5dc13be9-89e2-41a4-83ee-7e373a0c766c", "comment": "Malware payload (Formbook)", "value": "bacf6ec1c89a93aba55ef559bbfd2f23d4c2e855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750942796, "uuid": "216ca5ed-4eeb-4bd3-8d83-913d2d6aa01e", "comment": "Malware payload (Formbook)", "value": "f02f9012700ef96383bd9831a8622be0d8102d7fd956917687feb242833e0672f4f07f19914c060eb6c587be728330b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942796, "uuid": "7a5195b3-7b5b-4ede-8684-16ef5247361e", "value": "T17EF4020A6CD3C482D5693FB48993C27889243FD528B3CBDB6FE67D8F39319416502B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942796, "uuid": "be545690-3b6c-4a9f-8904-3e211bb4fae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942796, "uuid": "3e6f8bdf-df29-49af-9d79-c067a8c9c562", "value": "12288:Innb5a8nyN9Z6xg0dHjO/mWQE87z60a3bCKdoW6bJgJEDz:Innb5lyLZ6xg0dDcm/E8P61bCKdVeKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750942796, "uuid": "16bec3ed-1eed-4c0b-98de-9cb33fcddf52", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750942796, "uuid": "ebc41432-4f69-46ff-b306-e2bbeb711512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750942796, "uuid": "90f745ef-6dda-4ef2-b4df-2174ac658a36", "value": "PURCHASE ___ORDER STL_94758574____pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a06def0-52ae-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750957031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957031, "uuid": "1852c578-02a0-4cc5-80c4-878e5738b8d2", "comment": "Malware payload", "value": "10e162c569cc9cf74762ebe3a05485a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957031, "uuid": "cd27e1b1-6378-4ba9-b5fe-e2a7c61af4dc", "comment": "Malware payload", "value": "e50bb7aebcda0314a6b6e2aeb63c255748ffb96e6c227fbce32138e7213af3e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957031, "uuid": "73d9a1bb-92ee-47c8-a210-22adae6fdb8a", "comment": "Malware payload", "value": "76acc2c7e6fb3d3e5272dc50ae84964bd179fef3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750957031, "uuid": "ff1a8f7b-0bde-4e1b-9700-a7010a32fb4e", "comment": "Malware payload", "value": "ee610dbe73a6f310855cbefb8163090415e53abefe7f1336f190fe2fab64fbc9f2739f0733adfdc38918f6e3df8ce292", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957031, "uuid": "630c0415-36ba-4814-ad5a-4c7158348684", "value": "T1BCA40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB1662D745A4F7E800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957031, "uuid": "c15748e7-be3d-45eb-829b-70be7df57211", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750957031, "uuid": "e13a2579-3d24-4a1e-9a08-bd519cd1967e", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750957031, "uuid": "44f30a20-4985-4648-95e2-fa49c261b873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750957031, "uuid": "3b7d60b5-ce54-4ffe-bc26-e74955bbae81", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb2834b-526c-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750928499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750928499, "uuid": "aa75eeaf-19f1-42d8-91b2-f0c65386d1e9", "comment": "Malware payload (Mirai)", "value": "c7b748fb18bce665ba072138a0a1a05a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750928499, "uuid": "111abefc-2eee-4d8a-ae17-31b10efe67ea", "comment": "Malware payload (Mirai)", "value": "e5229afad3bea719d50865d43ac0fa8268946fa7dc06143de8b8cc46eaab38d9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750928499, "uuid": "297079d2-aa3a-4e6d-8c91-2d9ded25890d", "comment": "Malware payload (Mirai)", "value": "5c6ee0e46e2e2b30230fc2412f6c35420593094c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750928499, "uuid": "7e9a39b3-257e-44ec-b4fc-06cd3aba028d", "comment": "Malware payload (Mirai)", "value": "1e725360b1607f78bf8b116c25fe1b034ea11b2371164c027b75562d1b7c49c83161d5aaa673cb7a7488686bb46fb511", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750928499, "uuid": "b8074a27-47b0-464f-8184-916e5fb3352e", "value": "T13D01F4DCA4B597E31608CE08F16F826C7406C8C0A2E08EF9EDD81939A8DCF00303576A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750928499, "uuid": "93a8a1cc-3152-4e33-8142-0a1c73e79426", "value": "12:3J3FuI5FbL4eC5FxNIl5K5Fif0LKcC5FSgOy5FV9C5Foa95FkSK5FFtM5FUM5FHN:3J30IbLlCxNI7KBKBSgzVEoa9kVFtMU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750928499, "uuid": "b5d28e0a-133e-4967-a17f-f0dfaa543509", "value": 706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750928499, "uuid": "0efc308a-5dc7-4cad-9d38-1fad1de02f73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750928499, "uuid": "0bc2d1ce-f411-4d6d-ba55-a995d59d548b", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04de1005-5238-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750906100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906100, "uuid": "67bd1a34-0f54-4b64-bd8a-b8a2ae681852", "comment": "Malware payload", "value": "8821aef29554a0a47eb852bcb780cdd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906100, "uuid": "c7a5d9be-6f6e-4f2c-b253-9872ba47a3fc", "comment": "Malware payload", "value": "e5ebcd362afdfbe16681791c69ca1622201b6f4f67854f4f0b1f6a7e9c8d2ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906100, "uuid": "c0b65989-fa81-4c22-a625-477d53f37246", "comment": "Malware payload", "value": "d56f6d369399f4f13c3684315c6034f6a5140726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750906100, "uuid": "9c83d581-5493-4732-9a6d-570d28df2509", "comment": "Malware payload", "value": "75db2aa2c352d98098686e2ff3f83c1620fd394a8c6eb6cca1c13c648dff745d7272933d4d2e9a1fb7e6810208e4a23f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906100, "uuid": "d3d45eb7-1c71-456b-ba87-18066fe3487e", "value": "T1E1C533159A507EF5EE0BCBF949815136703A76A89FFC2E782A0D43803F2BFD49246791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906100, "uuid": "771468fc-bf95-4630-8c34-75b65cd012ef", "value": "a94bb05e264b67a068bd72877f26e7cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906100, "uuid": "1e0fed78-3832-40c4-99ca-e6551ef33375", "value": "49152:FiGYW5eBUCI8K//sT31YzaCc0B/rw2iNK8/HZXHzhq5p6:Fr52/I8K//qIaF0B/rIDHZXThsp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750906100, "uuid": "48630063-b96d-46c7-b83d-5b8f7ca08d61", "value": 2545664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750906100, "uuid": "e77d92e4-72c5-4fa6-a9d9-559c8534b8b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750906100, "uuid": "be1458d5-b890-4599-823c-60e5ff7e2c9a", "value": "8821aef29554a0a47eb852bcb780cdd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0678818d-52b2-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750958501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750958501, "uuid": "9c96f00d-3c48-4437-9d34-951fb6e51174", "comment": "Malware payload", "value": "8747654887574b9060e1153228f037b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750958501, "uuid": "d532208f-7294-4995-85d0-419f1c4d8228", "comment": "Malware payload", "value": "e678815a84c0dbf67365e85d0a1ab4a50f241da11a3cfb5feee97e39d6a7c918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750958501, "uuid": "9f0f9bac-e5c4-402b-a8b4-2ebdc25f144b", "comment": "Malware payload", "value": "71ad10b2862d2c1cbcda73946648b4fddc182cce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750958501, "uuid": "aaa7fc0a-b4b0-481d-8fdc-f330bfb706b4", "comment": "Malware payload", "value": "c784722cdd97c354d041d0fc4db1c083e69a73a6b2a0881470d0a572b6fc145c8c6b3274a3dafa4ebe1e8173b059e1fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750958501, "uuid": "b6892188-56fb-42e3-b935-be71e13e7fab", "value": "T153466B17EC9515E5C1EEE2318962A152BB717C486B3123D72BA0F3392FB3BD06A79710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750958501, "uuid": "73259e25-9416-4d78-a512-1c876e3b86bd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750958501, "uuid": "5968d50f-89cb-48ba-ac50-93f5406ebdc4", "value": "49152:obJeNKIQoqlT95VZLE5zdgCRnMwiHh6mfId6HW1obNe0VpY8VvwKTK9Kt6WrQH5E:odRa5jRnRiHYGvFl6WyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750958501, "uuid": "ba1ec2b6-bbb9-4fd9-8ce2-ad4927c2cd03", "value": 5820928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750958501, "uuid": "1f891daf-c35b-4610-84e4-86b3ee865444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750958501, "uuid": "1f5a852a-2308-4ebc-9377-284c66c954cf", "value": "SecuriteInfo.com.Win64.Trojan.Agent.HKA7O4.28549.10479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6a12ad-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913895, "uuid": "dd476b54-9fcd-408f-b604-b2c5f46cb071", "comment": "Malware payload (Mirai)", "value": "a55c4a050c94bd31ce0b35d1f9eb186b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913895, "uuid": "3518cf0e-0297-4448-b13b-52c10c026b76", "comment": "Malware payload (Mirai)", "value": "e7641095f4d479eb201878c9e67cf1624bb47ad97306aab4f6dad9dbf06c3db8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913895, "uuid": "01dda831-8110-41da-a823-63e8d90f5069", "comment": "Malware payload (Mirai)", "value": "66c18dbb2fc8243b6f6fef42a63c6149605ff15c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913895, "uuid": "cb6671c6-2857-411a-bf4d-dcb89988eb67", "comment": "Malware payload (Mirai)", "value": "d5d6e6ad16101426e9d7026898302df84a0d3e032fac11a93e731146ea570949ba187947b26eaef9edf9a2748c5a3389", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913895, "uuid": "1d4d05d4-6f60-4f8e-b640-25760f133acc", "value": "T1F3336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913895, "uuid": "945bea95-8f53-4829-ba24-4d6d20f8cd8e", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913895, "uuid": "50b3a01c-019c-4638-ac51-e19fe9849733", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913895, "uuid": "94ef1b72-ca50-4881-bf7a-525a8804c287", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913895, "uuid": "b2fb5a77-c4d2-44d6-bed0-aee09a2fa178", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8be4453-52ac-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750956223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956223, "uuid": "2e3f098a-718e-4914-9147-55086ca4998d", "comment": "Malware payload (Mirai)", "value": "8d00fee78e888382a20e6e179853a58a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956223, "uuid": "f30b895a-6b6d-4366-8346-0e2e9e6f28a3", "comment": "Malware payload (Mirai)", "value": "e7a168b0adc04d60d076edc9efe2be06d7790f1c37c9b0f313c0e6fecafaf726", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956223, "uuid": "c065f4f7-24d6-4880-9cbc-8e1890fc6cf2", "comment": "Malware payload (Mirai)", "value": "91a49396960e0e96856a910e9454efefd5174933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956223, "uuid": "dec978b4-0008-47c8-9643-7efd48a6f2fe", "comment": "Malware payload (Mirai)", "value": "bdd3648746101c2c67c9e99e1e96e66c9b58dd5f5845b12e6ecc4790f0fb23b207845864aae561b8c2c82d90ec484d7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956223, "uuid": "bb9fecbf-7f40-428d-96d2-fd2561b1e1bc", "value": "T1F2144FC6AF913FBFD81ECD330295DE06169D4A095298BF7B2A64D418F68B10A5DD3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956223, "uuid": "43d20ccd-e3b1-4809-8ffb-12d8ace90795", "value": "3072:TLYgSz1wP9iXvr2C528GSPwZqF2hrihlGUlBi7atY:Y1wP9OhEBihA+i+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750956223, "uuid": "4e444783-a8b4-450d-8a1e-3a2c63c6956d", "value": 203512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750956223, "uuid": "29694de2-fc16-4e21-9858-38ffbc9df47f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956223, "uuid": "b9bd15a4-8e77-44f1-a4b3-83416f2082b9", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a118a40a-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975940, "uuid": "0a83912f-b9e4-4641-87b8-4feb622a5ff6", "comment": "Malware payload (Mirai)", "value": "9981af7633c5fe0e26cb8012fe1294af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975940, "uuid": "d01b347b-c0ad-4b82-82c7-a33520b96f43", "comment": "Malware payload (Mirai)", "value": "e7da058447de1026b02a42fe2e26c99cc4e6f5f8083c37024eddfbea6e8dedbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975940, "uuid": "6f84de02-98e2-4f37-9903-f25a9c6d54e5", "comment": "Malware payload (Mirai)", "value": "abca2195579c671ac2a7060c3382fa41fba20003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975940, "uuid": "48540cc5-90ab-4806-b399-114ee09d8393", "comment": "Malware payload (Mirai)", "value": "0eda86afb7315bbacf808f37a8074cce515b110227fa25da0f6ef4dd17d62cac8469aa69849eda39a447b19ef4b7f43e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975940, "uuid": "728e3b48-736c-4361-b4c5-16f6110d2e3e", "value": "T18503E11DFAE8F629C76D70F662D117C376A090E275AE2E4C83114C68DE3AD4BB50E075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975940, "uuid": "88dbefff-94b0-4785-8de3-c243c630baa9", "value": "768:XULJjHmzPDcZO+T16tHi71Etw8FAtov57Nt/tBEVD0Je9kpfGN/OU+WUw:XeFGzPI10Hi71EtvaC//tOD0jpfYyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975940, "uuid": "6badfa7e-f3e4-44dc-b000-6fd64ecef05a", "value": 39376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975940, "uuid": "b5af4e9e-6c8f-41d0-8c77-307a7bfb65e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975940, "uuid": "81e729fe-afed-49e2-97f9-750c2bda5291", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfbd633e-5268-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750927029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750927029, "uuid": "489a4ed6-8cb8-490d-85ad-0d3df0b815f8", "comment": "Malware payload", "value": "faa77273ebf5f83926bbce901b7df32b", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750927029, "uuid": "9768a752-0e91-44d4-94bd-da1f11911b48", "comment": "Malware payload", "value": "e81bb5d4ea61f4075ee75b7996940ad7e80af99204bfa05c5978a1a6edc6b37d", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750927029, "uuid": "47dd0414-3e88-466f-bad4-a2a366457dbf", "comment": "Malware payload", "value": "b7fe4e66e3b73c1c4cc530516fd4b41550e649da", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750927029, "uuid": "cd9d759d-c610-42e5-a218-09f9721aae0f", "comment": "Malware payload", "value": "19e93516533e75dd7c7fff4ec9ebc77228ff5503ad83bcb1c89f70c8171acf6217a3f11935b9129abee7212a221e2826", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750927029, "uuid": "f701fb0c-e9b3-4084-bb40-9a0bef07f2f7", "value": "T19C75120DF2DABFABDC4B20B314A0024A06CCEC641774D74BDA91673BB5A477E9D2B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750927029, "uuid": "d62576cd-868a-4dea-b087-3fcc8fd9f690", "value": "12288:XGF77n7R+e4tkDmduqRGF77n7R+e4tkDmduq0:XGFfnhqRGFfnhq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750927029, "uuid": "6a42b318-885e-489d-9309-a64e230ee0f9", "value": 1681000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750927029, "uuid": "95e5fbe6-aa12-4ab2-94c4-3f6c7b459bb6", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750927029, "uuid": "b47da9d5-a4c7-435b-9548-c7af6ddedcfc", "value": "update", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ce72ea-52a9-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750954787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954787, "uuid": "1cab19d6-14b4-405b-a2ba-5fd5861bfa92", "comment": "Malware payload", "value": "925a815b94cbd192f68c51f6e156c2ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954787, "uuid": "c682cc71-17fd-4103-80a0-9da62f149309", "comment": "Malware payload", "value": "e8474cf9778a336a35ecac54d2b84e964ee70478c59fc3462c0aaac92a346f60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954787, "uuid": "410f4ca9-5ac3-4706-b8b3-d21b46ea6680", "comment": "Malware payload", "value": "942dc9fa3889ada99292f5227355e4f99687454c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750954787, "uuid": "a53e6f40-8ff5-4c8c-88fd-2b348eccd540", "comment": "Malware payload", "value": "6d5fbc10d4316135386839223cc86c4d7477e5c58069eabd62c1a6cf62fcfb98cbc3f589816c66da051813d3be061d78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954787, "uuid": "cce5bdd4-1089-4cb9-b920-a8c51b74af46", "value": "T190963319D513C0D3E8DB2074FF6A6E8A18B22C931547D53CC9D2B73988A6F617B4E293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954787, "uuid": "8be4f9f0-c367-45ac-bde5-6b5058cebe1e", "value": "bb3fe1bec5cbd486134027daae4ac310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954787, "uuid": "db7e9f10-a6da-44e3-a4f8-f5c13f7e800f", "value": "196608:PncOxRh/7Nzm9E6qxhFDjccqZKpVcoEfFQfYqXwCiPMJjejSxrAhirS:kMR1J/6S3LMoq7qXzikJjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750954787, "uuid": "3c2b86bb-33b1-4b27-a08b-b3ef93cdd09b", "value": 9339904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750954787, "uuid": "02168312-00f4-46a3-a1ec-aed8f37e5b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750954787, "uuid": "9eed1dff-8824-4830-9815-49beda8435af", "value": "SecuriteInfo.com.W32.GenKryptik.HJNZ.tr.13545.6662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03042a05-528a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (AurotunStealer)", "timestamp": 1750941315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941315, "uuid": "f2b9e9f4-d620-4b6b-9855-b0c9e10b5fd7", "comment": "Malware payload (AurotunStealer)", "value": "2602608cde6d1d96bba4e2834629ccff", "object_relation": "md5", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941315, "uuid": "6c613843-171d-429c-a4cb-5e4fb394df43", "comment": "Malware payload (AurotunStealer)", "value": "e84cd4641d318bab0aba1e587a83910d927f05978cbc0334869c45af8094e06c", "object_relation": "sha256", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941315, "uuid": "eb67ed3c-05f3-4cf5-97af-0be9c884b992", "comment": "Malware payload (AurotunStealer)", "value": "b0b38b44305177da1cf0819f73f5bc6426bcf69e", "object_relation": "sha1", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941315, "uuid": "4fff25a7-1ab6-4922-8d69-fd3065648776", "comment": "Malware payload (AurotunStealer)", "value": "4d7ae54a6323c222cc2e9966ebacfc1fd73c72a6477e99f9bcffd7e70bf51c4eb75744898baf55d89f00c88e2cbc9d90", "object_relation": "sha3-384", "Tag": [ { "name": "AurotunStealer", "colour": "#483FD6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941315, "uuid": "2e7e4773-354b-4e12-837d-a3f6d7ff56e5", "value": "T1F4379C286B7498BBDC7FA1B4C8C7078AE2A1B340536083DF791872850FA76F4EE75552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941315, "uuid": "32a0621d-df95-40b2-b9d4-a6da8d352c43", "value": "83cf8c922173ac1fbfd9c26a3a07db5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941315, "uuid": "07544e8f-f00c-462d-84e0-51069eff048e", "value": "393216:p8C8yKx8i20rxYcyCUVWPzaOKL85kNnK8E862ACRbqIV6aeRIbDM1hOQzEf2FsST:fRuRqPSbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750941315, "uuid": "660f7226-1e74-4322-a748-091095759e5f", "value": 23497216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750941315, "uuid": "6346a880-6fcc-41eb-96c6-c93ff3168acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941315, "uuid": "dff99141-a3c0-43be-a4c6-a3c9fadadc56", "value": "2602608cde6d1d96bba4e2834629ccff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "735b10b4-522f-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750902420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750902420, "uuid": "2ddf0071-4b2a-463b-8b56-71edaa856773", "comment": "Malware payload", "value": "a4b264ef3c1bbafd435232da3b5afc34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750902420, "uuid": "fae1aca5-c6af-4c4c-b389-110d5ace01dc", "comment": "Malware payload", "value": "e9ce818708bc6287eb50ca5c01cf492e7ee51f0074cc3d0acd833f9008b39889", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750902420, "uuid": "9f6fa7fd-2be4-4485-82df-da9279198a8c", "comment": "Malware payload", "value": "c637c1ee7424a10e18313996ccadceeb84be4ff3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750902420, "uuid": "86b74fe4-7f67-4390-9850-5052408193ab", "comment": "Malware payload", "value": "618299af33e72169da1d0e7cae7f3b01062ba7428b5c06ffff90ab73e3ac71ef9aaa6811fb716079a7c1c54213532285", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750902420, "uuid": "28315d9b-4e38-4179-b0a4-18c9a80384dc", "value": "T1CEA41212E290D8FEC4DAC070469FD27BFD767C544234BC6B6298F7322B3AE601B16A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750902420, "uuid": "33cc36b6-6169-402f-a275-98f11a360cac", "value": "12288:iD6LPBCvMk0O9na1M80cLt9i5aIaTtpc4W:2+QGO9naz0Szi5anTtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750902420, "uuid": "8efbe246-070d-4ec8-a899-e7c5590971bc", "value": 482032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750902420, "uuid": "18c1f210-5444-4b1a-abdf-a1cb7651bd4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750902420, "uuid": "2ba5e434-ae1c-43fc-b45e-cc50f14f7d01", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5334e2b-52ad-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750956620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956620, "uuid": "0142ddfe-ba74-4aa2-9cf5-7fd89892e568", "comment": "Malware payload", "value": "e16a08611f07b4e54226a4f61d98a19a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956620, "uuid": "9fd3f844-9a7a-4e77-84f4-a91b0375a7f9", "comment": "Malware payload", "value": "e9e6e3c538fce0a6c0b191047124f23bf5e491f474dc6a1ea9126e6f87449ee5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956620, "uuid": "d9f7573d-bc52-4466-941f-2af7038e12f3", "comment": "Malware payload", "value": "20e55094ef452294fac290dbc8f7f4e1061550e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750956620, "uuid": "06fc02c5-5e0a-4844-8430-f47c0ae5cdba", "comment": "Malware payload", "value": "399bbc65e82bdec8a24273fdee5c0066ab51a6cbc22b8ee5a431fed2aaa84dd23fea89fbb5c215c61d5f5ada2fe6ceae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956620, "uuid": "9d53f75e-f07c-404d-a081-030c4c4b93ea", "value": "T1B6E4F1037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956620, "uuid": "cf43f16e-f97b-43c3-bc75-348370731c3a", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750956620, "uuid": "ee2d2bb7-4e4b-4356-ada3-cfaa87612a28", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750956620, "uuid": "b0068733-6215-4698-afee-507158bb829b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750956620, "uuid": "973d0be4-e66a-4c2a-936f-eea64c84afa2", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255c0017-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913885, "uuid": "c9ac0562-d467-4306-91ae-2ddafd6813d7", "comment": "Malware payload (Mirai)", "value": "86fde4b381c6857697d3bdaaa77acd61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913885, "uuid": "8fc119a3-e137-4c9c-a4d6-207e924f6c80", "comment": "Malware payload (Mirai)", "value": "ea136bcdfeb1a8381d88b0546c5ddbb0cb99d22c3b97176b19179a227c455e17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913885, "uuid": "302cf04a-24c7-4f79-885b-f120cc2342b8", "comment": "Malware payload (Mirai)", "value": "92c331c2876aab253da70094704b0789b1a82208", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913885, "uuid": "ef2b28a8-0998-458a-a838-40fb771fbfc4", "comment": "Malware payload (Mirai)", "value": "ca6efd4f1b553bc9c4e538d45255fd2225b19f97a63b22a667cc1c4b5febfcfb758b27223f63b96dbfba846fef97916f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913885, "uuid": "4c4c116a-be0b-4a06-a5be-c0c7c267d183", "value": "T1B6432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913885, "uuid": "65c25b22-f28f-4cd1-99ac-baea36e34a56", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwh:RqtmZPuutfbltZFBSJsBcfDSTFI+BEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913885, "uuid": "9f282c81-2567-4e0a-b868-030094d70f5f", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913885, "uuid": "20947b76-9330-4a3d-9dbf-c293d44aa298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913885, "uuid": "e44b21c8-f410-422e-b309-0732d13a324e", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ffcb68-523b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750907687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907687, "uuid": "c0da0ee0-22da-46b2-b892-e78abdee4652", "comment": "Malware payload", "value": "84aca9b189973e5a6975ddb4ecda64bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907687, "uuid": "e87fa1a1-73ab-4715-acc7-492aab033030", "comment": "Malware payload", "value": "ea671af5bd59c1c4e854c515abf5161d5e760f8e9fdc3d9d56db9a10b6b4da23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907687, "uuid": "20f6267d-159d-4880-877a-0966e86eaad3", "comment": "Malware payload", "value": "386af42989a739f73d6cf50e7505914887c54304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907687, "uuid": "2ede0674-71bb-4280-9431-c902e7178616", "comment": "Malware payload", "value": "0b64250c14f36a743413f5aa0190b377ad2ce520d2d34aa6c5bfdbd1cb29aa116ef75b0a35b9dc5176bc3687e2fd6e41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907687, "uuid": "8804eea5-0209-4cc2-aa61-6cbd5031e58e", "value": "T1DCE4F1037308A756DF4BA83A82CBFD31B7C2799113D096627A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907687, "uuid": "7af3dc13-856b-49dd-9360-651deb6d8847", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750907687, "uuid": "444e4e5e-ad41-429d-b1df-cba76856497f", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750907687, "uuid": "caf81bc9-ac97-4d0e-9bbf-c7e23a1d66df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907687, "uuid": "29ac2074-6d25-423b-8ffa-a1a7eca229b4", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27931fc-5241-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750910337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910337, "uuid": "45cdce6e-d9f5-4aa0-94af-263be2cca681", "comment": "Malware payload", "value": "7893901bbfda89d9e6fb2cb8ab64c96d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910337, "uuid": "8a0f61c3-9bf2-4a7f-9869-258bf05bd7cd", "comment": "Malware payload", "value": "eaf913f62b55f583881ff6e34ef5040ff6bc79d69922e222be7247634c04bcce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910337, "uuid": "01d417a7-8c0a-433e-9ef5-3d591b930ad1", "comment": "Malware payload", "value": "958cdb7a2619d0bb9b7f98826fa568ccf7f47565", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910337, "uuid": "2b609ab2-a3f2-47b2-ac9e-d465304062b2", "comment": "Malware payload", "value": "8b1f8c0e3a3333ba113d4bf7bbbc1a397c015bcb1738287a1defbdfde2c98ebc9964784c432a6b5a34198c62df1465c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910337, "uuid": "ab916af9-c7f4-448e-9195-62991091cb76", "value": "T1ABE401037308A756DF4BA83A82CBFD31B7C2799113D096667A80E29F8775726CF0D649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910337, "uuid": "a783f4d2-5bd9-4078-a661-a0e8d111aef8", "value": "12288:0GCt9AoZDmbOxeQPTyDez9kQ8jGMKhmmMnRpOeHc:Y9tZQO92DnhDmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910337, "uuid": "4e55e469-989f-4fb5-a71c-9d0c9452d64e", "value": 657856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910337, "uuid": "26daf4aa-f465-4e22-9c84-140da425deee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910337, "uuid": "c77f9071-2075-4eaa-af65-385f36622f4c", "value": "ppc64le", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7745898f-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750914023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914023, "uuid": "1ca74eeb-3369-4984-95ce-fc15ccf4f0d6", "comment": "Malware payload (Mirai)", "value": "14d5504817500c0e453a985b7c400db7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914023, "uuid": "b1d6a2b5-cb16-4214-a033-c9f4d96a5f33", "comment": "Malware payload (Mirai)", "value": "ec25a66677f57719fe0061e622218e878542a3abccd48500892343ff9b619e09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914023, "uuid": "adc9f996-275f-4793-9c85-90e3ccb56b34", "comment": "Malware payload (Mirai)", "value": "cb7ac4cb9ea2c4404f39ca55be9426bf11253d9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750914023, "uuid": "d4317d5c-e1c9-4e81-bbe9-cdde140b3f35", "comment": "Malware payload (Mirai)", "value": "8b19a502fda2dce74f86e391102cf151f8513088f792112cea22ed13326b22f2d0f5c9a3d05da558a531abad041cc2c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914023, "uuid": "1572d700-f41d-4510-adf7-8e5a416d15f4", "value": "T1AB82CF3051AB75E8DBE14431EEAECEC6971A0BFCD1FC36E2165C7B78894250211F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914023, "uuid": "c034f492-0f56-4a87-91fb-1e9b4fc3ab0a", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMawrhymdGUop5h5l4:6/V0P6+kom0tVAoNvm+to1+s3Uoznl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750914023, "uuid": "08a3a1cd-7292-4707-9d47-f280a4876355", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750914023, "uuid": "d329ac26-6978-4d4c-a682-8163207797c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750914023, "uuid": "b9f9f68a-b03d-479b-a752-cc42e1d90149", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80a61be-522b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750900871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900871, "uuid": "48936eb7-ab08-4d75-9f44-3ba765789408", "comment": "Malware payload (Mirai)", "value": "814632a8fb0114f7d58eb8e62d8c32a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900871, "uuid": "4fd28446-20e7-4574-8bc6-7e2a62ebac8e", "comment": "Malware payload (Mirai)", "value": "ecc1f22d75ab3a641ca0d33e207c3c505d1c946584159a025d4e85086b96e3e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900871, "uuid": "01ed72fd-f727-4bf8-8d99-e169d9737676", "comment": "Malware payload (Mirai)", "value": "f8c35c98ea28826a2d9eb5658be9c73bca61676a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750900871, "uuid": "1c1d2927-e501-40a1-91e7-e3a834274fbd", "comment": "Malware payload (Mirai)", "value": "b9c935b3967c9385babece97cc929f837ac202caab6e0c57a5b9501c7c240583e52c0490f110f5fb1bbab8b9cd85c96b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900871, "uuid": "3315b03c-36f2-469c-9506-79ece045c72b", "value": "T192B33AC6E753D4B2C9930BB012EBE7354531ED92072ACE15E75CFEF46E22682B05A21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900871, "uuid": "0ac594fb-dd43-4fb3-9911-52775e5cf820", "value": "1536:DoVSHQkqUegVdloXkqaNTCmoMw9ari/GUG31gDZ+rkp3uUnArKtrvuGlvSAuVeK6:kwDqUecdloXkqaNG39mFK4S+UnYKtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750900871, "uuid": "f72147b8-2b8b-4194-9af1-0047b72d8a33", "value": 111092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750900871, "uuid": "60eb5e2c-8181-4c76-a690-544a12e58e94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750900871, "uuid": "1b757edb-d645-4710-a620-818c3d57b83b", "value": "SecuriteInfo.com.Linux.Siggen.9999.28284.31314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2fbddf-5248-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Amadey)", "timestamp": 1750913309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913309, "uuid": "22e61060-c351-4cf7-b888-8019ccbc9486", "comment": "Malware payload (Amadey)", "value": "7b8c43ff5287ec4c86921c06bff22ff0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913309, "uuid": "5fe3d10e-eb20-4ea0-9c76-6fae635aae80", "comment": "Malware payload (Amadey)", "value": "ed0b15b82c2dba6a4516c5a0f5268a95fd7fe8aead707272a096d8ef47db92c0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913309, "uuid": "cc08298a-5dc8-4dc3-bbdc-aae16be61861", "comment": "Malware payload (Amadey)", "value": "fb00fdb9cd78f260f5f26fc01aee6bb209d05877", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913309, "uuid": "a303b9fe-4461-471f-b4c4-61b8d706ef42", "comment": "Malware payload (Amadey)", "value": "6f84eeec5d614671671833d857010c68c449f0a950674176d580ec0aed6b3181547d16c5ac5bddf161f2c490408405bb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913309, "uuid": "fa4cd87b-4e28-4b40-ba0e-59accce1db6e", "value": "T1BB944B217813D032D66291721F79FFF585ADA8259B7109DB7BC00F769E202E26A31F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913309, "uuid": "d9f58cb5-a02f-49ef-be34-cb97eaae3dfd", "value": "1e7280afbf80c2800b272220ce0718da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913309, "uuid": "666fb3d6-1430-4381-88bf-2741b9ffdc21", "value": "6144:yPUITO0tKh317lx2DIB4IUvjapNpl3vT0lAkuW8GUi/83FrPKwTIf5UQAOLnm/cd:yPUITO0tKhdlEA4HvKT0lAnW8Basc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913309, "uuid": "9dc90cd0-6c7c-4538-af70-480bc0248d19", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913309, "uuid": "5a0a97a6-708c-4ac7-83e2-1dbb699551e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913309, "uuid": "2e014272-826b-4e2c-a224-beb215dcc992", "value": "SecuriteInfo.com.Win32.MalwareX-gen.12037.4528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94fdd38-5261-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Formbook)", "timestamp": 1750924119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924119, "uuid": "50dff781-9287-4813-a2dd-c9751feebf84", "comment": "Malware payload (Formbook)", "value": "557d489435d6300a871aa130907cb16c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924119, "uuid": "0b9f40b3-9437-49d5-9ce9-fbbb7d8f2bd8", "comment": "Malware payload (Formbook)", "value": "ee2c474d321d710e3e3d5808bde560a2bd3e94cef6d9b457149a2c3300972228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924119, "uuid": "de4793af-7c8e-4c62-ab7a-aef45ad022db", "comment": "Malware payload (Formbook)", "value": "edf503edccd291ac8bece3096ad51edee3127f87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750924119, "uuid": "44e89fb3-2fc4-46c8-961b-951d40344937", "comment": "Malware payload (Formbook)", "value": "e6fece0c18a2a6cbf803b478ade659d8dc41fbcacdea25f11fcffb52e3d641297573bbe59e92e34a7c41fc5bdc2cae37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924119, "uuid": "edb69714-ea57-4174-8108-b7f798abef92", "value": "T18EF40128275B8B22C5BE17F51101D1B193B97EDE2451E32B8FC66CEB7E25782090772B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924119, "uuid": "e3b0c9b0-6100-46c5-a17f-4dfbbe565ed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924119, "uuid": "3ea6ac86-f149-4537-b0d4-c1819ecdb773", "value": "12288:hgru+nbMfa3HDKyVwmp5AvnfVxRf5sGI+2z3oxKS9fCkogk+ysgWa1NubHXROrer:b+nbWIPJp5AvfbCzKK/Pgk+4drshOZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750924119, "uuid": "b41d8019-0e93-48e8-a138-8fe2c617b3cb", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750924119, "uuid": "7a7f61ef-a9ac-4d30-bea9-b3f72b2c4ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750924119, "uuid": "06cf0196-fa6e-4632-8ddc-6d5b487cfb43", "value": "SwiftCopyNotification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef70428-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750975937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975937, "uuid": "06cebb24-c346-4d2e-a4d2-0b57e4e43084", "comment": "Malware payload", "value": "7d9946ba427cd15f99d1281c8d1d44be", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975937, "uuid": "2852aafa-b50c-45ea-8627-8162e704966a", "comment": "Malware payload", "value": "eff152cf814cae5a5e9fd0d4ebdd2a55883d48cd17b96b15d139a97575284892", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975937, "uuid": "e5523990-617f-4af7-bbfe-eb6dc60b43e1", "comment": "Malware payload", "value": "6a1e03dc190338ce9e08cb79ad93ba1b168706f2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975937, "uuid": "6a4fb9b7-c4cc-4a88-9e5c-ca0f9b28abbb", "comment": "Malware payload", "value": "cd14773197752c5d8e3aa8e8593d97b30b0bd5fc7b893c759dde216418335e647a798cdd8e2aec23aceb046807f90a2a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975937, "uuid": "4b3ab758-a79f-4383-bf9e-752b1e216269", "value": "T1D51158DE2B6554D65F9C8F8DB45E934C6B42A1E2BDA42500A29FA86C50D830F3072F76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975937, "uuid": "e33f6f19-2f08-42d7-a154-62bc4bbb171d", "value": "12:3J3hhnEZHQhhUrMEEQhhh8NIYM/EwAQhh3kK/EWHQht5IFQhtPICQhtVaLwIVPQB:3J3q8NIY9KoWKwJVaL9VFxDqBAdXHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975937, "uuid": "24927512-69fb-49b3-97b3-85aae4bca7bc", "value": 996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975937, "uuid": "57cda915-c101-4926-b8bf-50a7e1fe9989", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975937, "uuid": "a36745ca-73e4-4da2-85db-02e1f8d099e0", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600ee494-525b-11f0-8bd0-42010a9c0005", "comment": "Malware payload (MassLogger)", "timestamp": 1750921285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921285, "uuid": "8669d56c-784c-406e-a333-195f1ded9c65", "comment": "Malware payload (MassLogger)", "value": "a317a8172a9fb03f888183a73b3ab2fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921285, "uuid": "0618abe1-1102-428e-b427-7f0c3b0b7fd0", "comment": "Malware payload (MassLogger)", "value": "f10dcedfa178a0bce77e909b072ff0deb66ab588db90b7f5eb3d0bbe8c75215b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921285, "uuid": "4a91da22-c861-473c-9d4b-86e5cf37811b", "comment": "Malware payload (MassLogger)", "value": "9469d891e442777c76090299ed84644101c5acde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750921285, "uuid": "ced58ae5-681c-474a-ba97-fc131fbaabe3", "comment": "Malware payload (MassLogger)", "value": "d934667f073addb735c77dc4cc7766a91477e94a9c224500293f24f9652a811b152e144325dd0ab7b5791ca6beb0c8d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921285, "uuid": "ded82aca-d06b-44b4-aa45-d862b921c0f0", "value": "T176C4F11832AA8F13C5FF27F91901D0B493BABD9E6021E75A8FC12CEB3D657910546B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921285, "uuid": "7ef9d54a-ec36-4d58-8fbd-844c211d55e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921285, "uuid": "35c5d11f-e075-42ba-9f74-9a41f3eaa96e", "value": "12288:sgrynbR1ekTqM0rUmSVIf8M9BBXstP8+Aj6kHl+pYi:YnbRQXM0rL8Qtsmj6Y+ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750921285, "uuid": "f959c06b-37af-4112-84ab-3a31ee267fab", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750921285, "uuid": "5ba5181f-82f0-4ee1-9c82-7dc4bf8d9d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750921285, "uuid": "c2732b93-7611-454c-94ae-65ba8f36fe53", "value": "z1ADIBMerchantServices-MSFChangeNotice260625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0ee4c7-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750976016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976016, "uuid": "f57348c0-d809-4644-bfb4-17903582cc81", "comment": "Malware payload (Mirai)", "value": "b89d9b21b4080527ef50ff15aeb3036f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976016, "uuid": "ff1adcfa-60c2-48cd-ba9f-191f9713f37c", "comment": "Malware payload (Mirai)", "value": "f19ad7bda883990afe53b62e4e0db6a25c3b28a295856a7f0e2eb61783e78306", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976016, "uuid": "9d5ad4d1-d2be-4c2f-9b7d-c2017f97be01", "comment": "Malware payload (Mirai)", "value": "6a1e63aa41db52f03b0cf37da8a82b06b8532f65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976016, "uuid": "24cd90ae-267f-4c5e-be14-83b7cd193edf", "comment": "Malware payload (Mirai)", "value": "abceb16a00b3b3d6624fd9d60379bcaf35bcf079732a1401ddf88098caf41f8a5b5877a7e2cbfce442767613ad2cd303", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976016, "uuid": "67e1a36c-04cd-4d0a-98b3-126b2e076da1", "value": "T13FF32A46EA418A13C0D6177AF6EF424533239B64D3DB73069928BFB43F8679E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976016, "uuid": "ee7eb8d2-e645-4df4-b0d2-3faaedee901a", "value": "3072:dH28bWVeSa/7WcVDIex+Yb3Z7Xeu6ZcmvLg/MM/9fcm:dH2eSa/7WcVDI/Yt7OumcmvLgEM/9fcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976016, "uuid": "7ecead16-7202-43d9-941c-d2335df7a647", "value": 159474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976016, "uuid": "777bd1ae-ac50-40da-9668-c28979f8bd20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976016, "uuid": "56e7ce7b-8474-4c9c-a513-b2996c545843", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef4e9c6-5277-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750933578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933578, "uuid": "87aa8f86-6bc5-41dd-992b-43372c571399", "comment": "Malware payload", "value": "243c031802b50e58b220669e80cad37c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933578, "uuid": "57278c29-cd4a-48f1-9349-9ede5a52c824", "comment": "Malware payload", "value": "f1dd442d3526223d02691abc178bc3c9cb7d5c6e9d3763e2daf037dd0d35c3d0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933578, "uuid": "2fea2151-8a9c-4c27-8a4b-a4cfb7f76bf8", "comment": "Malware payload", "value": "7151e647a3d260653979d7f99852c7090858d1c6", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750933578, "uuid": "c5302308-2c2b-4cfc-bbe9-74d9beefa1ce", "comment": "Malware payload", "value": "4c9e1b3aebeba7ef7490e583a1b30252ec33d9aa3079d37727a870e5355bf51857d22f5fd3493dae8fb99cc95130c099", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933578, "uuid": "ce79eac1-41c4-4e35-968d-03ed64542a35", "value": "T154513391BAD1B0B99636552CDD93A38C652B002310BB4904B96C473CFF42A3F8B635FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933578, "uuid": "52e53081-3c7b-4e8e-8c73-0609a44708ea", "value": "48:Dyr6sCkLBCElimFROCdVn/9d6jsv9E+vpJGAmOWsNWDXrhMr5z7O/AxPv91B:DyrDlCElimFEqdosLh4AvWmO/A11X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750933578, "uuid": "e604c48e-2505-4bfa-aa4d-573d398d2329", "value": 2526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750933578, "uuid": "9e04eda8-eabe-42e7-b1fc-569043300a6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750933578, "uuid": "a4dc8ec3-8419-4ea3-b564-c9a5cb346122", "value": "SKID.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe830630-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750976097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976097, "uuid": "82f16ba7-ee83-4d5b-ac48-2889556cd115", "comment": "Malware payload (Mirai)", "value": "fb6b91ed4f9ffb26bf508a94ac5a42af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976097, "uuid": "e81ec113-e0eb-4386-86f0-8a512d93f195", "comment": "Malware payload (Mirai)", "value": "f2af965af649ea543f4257bc33c3e3738891ce0e693da602aeb053b64a8eb4b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976097, "uuid": "f2321b78-ee4e-4ae2-937f-de8747750921", "comment": "Malware payload (Mirai)", "value": "89fd28b2eefecec15f7c9d72c35674caa195d498", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976097, "uuid": "b3b5430c-6d8f-453b-8c11-d7c3fb12ab18", "comment": "Malware payload (Mirai)", "value": "fa4dfd323777b1a357823295aade996774cdd2be72876a7bc5eb4c310b180bede2a2ac0d756a95153a1a5e1761fd7918", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976097, "uuid": "0a10e1bf-7c1b-4e1f-a3c6-b46a70417e15", "value": "T1F0A3B81E6E25CFBDF769823147B78A21A35833D637E1D685E25CD6001E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976097, "uuid": "948c81d1-514e-4c65-8e86-5e76f9e6a92f", "value": "1536:pwV1/tjCiO2Kple+bSYKbvydvDcMeRp7ktmwD/Hm:C1/tjU2KplGYKbadvwQtmKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976097, "uuid": "2d21fea6-3aea-41ca-9737-c2eb7054355b", "value": 97940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976097, "uuid": "0ef1f46e-a9f9-4827-9932-5b2d04f49b88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976097, "uuid": "65101d74-7164-405d-acd1-e7ce22754393", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84b876d-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955363, "uuid": "3d429809-2f4a-493f-b613-33cb6f4a4dd1", "comment": "Malware payload (Mirai)", "value": "6c2333c5ac80c006a84dbe2e6a154829", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955363, "uuid": "4f1778ac-d6e3-4828-8666-b4c0d6fbf635", "comment": "Malware payload (Mirai)", "value": "f3baab19fe264c7b6b804f08fc8fd4453349c50b6c475aa26337d81ed3a97455", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955363, "uuid": "cb040cc3-3253-4c3f-bf6d-11a8f72ad309", "comment": "Malware payload (Mirai)", "value": "f904527d937d0edecf8a2fc57aae40b6a919571d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955363, "uuid": "660ab8bc-6c89-4012-b2f2-52003dcc26b8", "comment": "Malware payload (Mirai)", "value": "40a458d5c4ee4153ef6d938f923a7744242b4cc50a4f5ffed8615f7011857059a85e3fa048b201c2a20647a9e6567274", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955363, "uuid": "a5ad66db-20d5-4297-a4d4-20e92181f22f", "value": "T187A2E055BF1882CBC832793495D9E5D21253FC62F2ADDC492540C11BF5A33A96874F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955363, "uuid": "7a3dcb23-8f54-476d-8221-a6a7f5e25230", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTv:O98o08kxofBE+ZkXaEbp2F2TWul0c5Qa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955363, "uuid": "bbd745dd-fc5f-40c0-a069-7ffcdb54f022", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955363, "uuid": "fa3787e9-5f4e-4d2b-bfdf-7bc4a7140e1a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955363, "uuid": "16bfe930-7767-4f08-b586-361f4c2bfb90", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef1e34d-52ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955670, "uuid": "495637eb-9282-460e-b0af-ae1e9e637ace", "comment": "Malware payload (Mirai)", "value": "444611908b0c30dea7c640447d1dd142", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955670, "uuid": "cb3c34fc-3030-46f5-9595-3150636772be", "comment": "Malware payload (Mirai)", "value": "f3fd9d401737e0bdf226acdd6636a02576d80ef7b74a2999e9a58bbe51310f7a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955670, "uuid": "0a42e6d8-6b0c-424d-a69f-e545044615de", "comment": "Malware payload (Mirai)", "value": "d983f71888457cd0cd925b14e290c3087db6a873", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955670, "uuid": "de4b661e-7640-4bf7-a2d0-248c62ce2716", "comment": "Malware payload (Mirai)", "value": "ad83d3d7501f439699056d0b1233b37618fa1e191596e52cb1618239e52d7c62bce769702e20688222b4320cfdd854f2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955670, "uuid": "d57b1e8d-f084-4750-bc29-f59989055f4c", "value": "T1EB41E8CD9ED18B13CB8CCE85F161C2967C694D86A6A7CE989C9B1CA4486D908303B797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955670, "uuid": "ed434c12-55f9-4342-b333-97d8b3b7ea79", "value": "24:/DbfRDjJrDDDCF8DNfDNKDhDNbDNBXDN7DNJMDQGDOXD3DtDLDZtc4ZDhDmZnRD8:zXJUDNHtJx64mZIF1UsjGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955670, "uuid": "70d27977-2b3e-41d2-a49f-db5c7795e198", "value": 2161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955670, "uuid": "3c26952e-4744-4483-a274-afd0ab6983b8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955670, "uuid": "8dc6cbd3-2430-4c3c-909a-bb69d9e84163", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a2f922-5284-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750938822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938822, "uuid": "3bb88c73-3322-453f-a5c0-f107a8b5d36a", "comment": "Malware payload", "value": "b436a51f4277a6a1b2298ebe6509eff9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938822, "uuid": "22556d0e-934d-4dc7-8ecf-832e9290cfac", "comment": "Malware payload", "value": "f63d0d31d3b1625e69820b3283a1e6bf0416ec18e5841545cd438bfa911dbbf2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938822, "uuid": "d2feda6f-45da-498f-9d40-d967a627cf16", "comment": "Malware payload", "value": "57c862713ee02ce66cae6083f5ad03bc72322b94", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750938822, "uuid": "02aaad4a-1545-4663-9453-e07f91f74111", "comment": "Malware payload", "value": "9f12126ec99e8f8c48aaefc52b530411238bde58ace0b0999b3288ace0d4f94c7beb78919b58103f137f557165d56be2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938822, "uuid": "0ac0bf63-a0d2-4127-9128-1f0fe213a23b", "value": "T17A660239E25C81A2C197F8FEB0CB836A885303448341689E9B6C855DCAE3D49DDEF57D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938822, "uuid": "bd0b61c5-ae9f-4145-a834-abb8aa366010", "value": "196608:hz3vU5xKLu+KgB902nNcQTIs7vL2jpxmMTvu:hz385oLKEn9z7vKlcOvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750938822, "uuid": "c60b33f8-a7b8-4c68-b3e4-e6d2cfed2426", "value": 6656096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750938822, "uuid": "91f1a2bb-0af3-49fa-894c-1cb8f519b6ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750938822, "uuid": "96377caf-4d2b-41f1-b56a-04fd839bc1ef", "value": "Advanced WPBakery Page Builder-V8.5_updated_merged.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba987e4f-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955367, "uuid": "e616b39e-c9bf-4fe1-9738-e5d713ec1c1b", "comment": "Malware payload (Mirai)", "value": "6c9b2e3f925ea6822dd6d8386187a3e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955367, "uuid": "934c79f5-d2e0-4cce-9ea5-bb712fdea07e", "comment": "Malware payload (Mirai)", "value": "f65c4824cf5446d7f3964422d30dfbbce0051d05ffccd1c98683f34724ce875d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955367, "uuid": "da15e9df-4128-4e1e-8c04-6b0e7584eedf", "comment": "Malware payload (Mirai)", "value": "ddd38d5300194ce949ad433b6d1831b287b3a87b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955367, "uuid": "4a05c84c-6763-4c7b-945f-943da144a096", "comment": "Malware payload (Mirai)", "value": "fd7f74768b804c9bbce82b793e32ee497682468744105e8e81680dee53a54272c1438a70e7ae51c33dd80af06530ebd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955367, "uuid": "17f15f7e-8d0e-46c5-a37f-dd3763537431", "value": "T1C8B2D03C5B111F98DA1EC0BD839D0B503DB81F359182AD5B6206ADC79F968B87453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955367, "uuid": "ddd7805f-fb4c-4119-9e9b-49606e8deeda", "value": "384:deD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtui2hAmd7JgGlzDpH7uNj1Jl:deD8ZSWvZHZbs1row697qohQvg92ai7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955367, "uuid": "c76d00a5-4b67-429b-b268-115a4b9646b5", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955367, "uuid": "edd2b599-7c49-4cb3-9c86-d37680772508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955367, "uuid": "14b99023-29c3-46cb-bca6-d3071e122fd2", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b8bbd0-527c-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750935674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935674, "uuid": "480a953c-a707-478f-a689-f1a25d439a28", "comment": "Malware payload", "value": "b0cd80dc607d231e2c862be867844a92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935674, "uuid": "cfe3b393-d342-4706-80c5-841192eaf4ea", "comment": "Malware payload", "value": "f6f3315aae52d02e3766f00fbc2d03f4f2f185b045b3d7357e58ee7ee2616050", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935674, "uuid": "c5c02490-aa28-4f68-8fa4-f4922b6f854a", "comment": "Malware payload", "value": "53a58dfee6c2fed6831b3775a37a01123221dd02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750935674, "uuid": "26080324-10ad-4f17-9cfb-07319935bd4b", "comment": "Malware payload", "value": "d68ccbd3349d3e18540cf09c3599f3b2825c82dad28f391dcb7ffaffa8999b9e242b7fbb0ccc24f1cf882366a3a492c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935674, "uuid": "7678990b-9883-48c1-91cf-1ec2e811cdb6", "value": "T168C4F1A377204F91C35195B209F389335AF6199706F29982537DEE107F20A6C386BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935674, "uuid": "81d1d930-db64-42fd-8832-9e317e1bad08", "value": "12288:M57U0INmdtgOcyJXDOMzf03gdvZ/yCnEI7zF:W7v+mrY2xzf03yvZ/YIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750935674, "uuid": "fab63b07-4150-4e8f-a01e-ba4f8cf2825b", "value": 592688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750935674, "uuid": "04bacfe1-94b9-44d9-81a6-3339b01214e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750935674, "uuid": "0e88fec6-9243-4358-8dfb-8b4022318da7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea489a1-523b-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750907539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907539, "uuid": "fd8ace48-9560-44b5-a3ce-dbeb89ca3201", "comment": "Malware payload", "value": "d6dd8df094c9f840c08f4d06f118cd34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907539, "uuid": "55c3238b-9d6a-4468-9ea6-c0ec8040a681", "comment": "Malware payload", "value": "f705b8348f60dbfdeb2aece0b772f110533860216bbe24acf17553ee0c9c3dbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907539, "uuid": "e34183eb-d093-4890-b77d-11e6931cefca", "comment": "Malware payload", "value": "da6f074ad4547cda178745fb409504d635948167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750907539, "uuid": "00d790a7-daef-4bd8-b5b8-e52c27d16fb8", "comment": "Malware payload", "value": "5727fe3dbde9ceadb8d1be62d3da29e4a16959c97779fe4f295bd376b15794a22fd4369be7f4690a20a81402cf3fbb25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907539, "uuid": "354ebeba-e49f-44e0-8243-53d2e1a73a8b", "value": "T1F3054A6073F89B1AE4AF6334E035452A87F2B847BAFAEB4F8504E5F919437914C107A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907539, "uuid": "fa0f9d4d-8b6c-43db-b0c5-1aec8dafa716", "value": "12288:rf09RSIkZcJBp829kwFMmTVurJEmbj+fvrBKrGdtcuANuHeviAxLBv/GquGDGY:rf09RSaSXJl3+fViIONuHqnBXG8DGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750907539, "uuid": "a68d3857-55ff-43e0-9ffd-2d6e818b6c9d", "value": 851272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750907539, "uuid": "4362ba46-0624-4d0a-b5dc-b2306462dbd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750907539, "uuid": "2feec930-47ee-40c0-a91d-22702eb36038", "value": "powerplayer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff8525e-5244-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750911568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911568, "uuid": "6c95c157-aac6-48e5-8ada-2358c6bd7e91", "comment": "Malware payload (Mirai)", "value": "8bbca330532d11e3f4fc5c7b8f510878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911568, "uuid": "fc8aae15-ccd1-4cdb-9252-d54efb31c466", "comment": "Malware payload (Mirai)", "value": "f7c507aea3abff7eedd281b30660e96d89f52cf9636dd42aa780de5331e8dba8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911568, "uuid": "a0829e30-4b64-49f6-bc26-7c3d4a0d97f8", "comment": "Malware payload (Mirai)", "value": "38f339dd2192cb0804701a76f54a0af6af90e024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750911568, "uuid": "27f70ccd-b797-4520-98e8-4021fb7c369e", "comment": "Malware payload (Mirai)", "value": "54ea9f5f3b123307fbc7f7e0e259550d6799063740e52cba3c9af76624ab045646122d180df5b94662a65521444b1509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911568, "uuid": "131025b2-d9fb-4dfa-982b-4188723042eb", "value": "T110D3F856F9819B11D5C111BAFE1E128E37231B7CE2DE72029D246F747B8A8BB0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911568, "uuid": "a9a3486f-f8ea-4057-8090-77e5ef2fe668", "value": "3072:rO4cUoKGgaX5A1UreXaS0Go3uoGH7wCthu32GI:rOpfuaXS1GwaIZoG8Yhu32G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750911568, "uuid": "f0fc1086-9b1f-4704-8d1c-78aa78bcee76", "value": 141776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750911568, "uuid": "e44d1f17-b089-4f9c-abbf-671245d2c1c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750911568, "uuid": "80faefd1-0591-4e1c-b6f1-2d3fe85e5fc6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c21b667-524a-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750913896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913896, "uuid": "3ee6b674-2198-4a3a-9ba7-c9c8f1b35e89", "comment": "Malware payload (Mirai)", "value": "5ef83dcaa28b876fa3ac42df2de6aabb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913896, "uuid": "d4271924-36b0-43ea-b55d-3e091612fa64", "comment": "Malware payload (Mirai)", "value": "f7df91d875a4baf5378ba92e5b7ba0288b1b1c56b58392fb2c3a4288a8049648", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913896, "uuid": "4428d562-26d9-485a-8d5c-3b82c25e133f", "comment": "Malware payload (Mirai)", "value": "64379b419070b484c7fefc7904dac3ce8bb2d317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750913896, "uuid": "e46d3b42-3dc8-44bf-b301-40da2ad33df2", "comment": "Malware payload (Mirai)", "value": "97d085cabf410e3adc12519020dda8a9676c8b1611f63f35c786d30e85fe347c37d3d68f02f05012cb0eb84cbd56836d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913896, "uuid": "ab8929f5-cb4d-4612-86e4-e31b13ba8555", "value": "T196338D72F0382CE1CD5016B47A38CD740713ACA591E62C726ECDE99508ABFACB69D7D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913896, "uuid": "a9245c39-9a2d-4f64-b93f-babff1461be1", "value": "768:wmftDukGjqsy2OqpGjyQ7548Qs9cUi+HSFHdTlqD6TRL6r0/7:316OsykGj15TpnH2HDsg/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750913896, "uuid": "790ccdab-5167-49df-ac40-7f23d47c8cb0", "value": 55036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750913896, "uuid": "cb1e07d7-f2ff-40e1-99c5-bf547769e9e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750913896, "uuid": "b08728e7-6602-4585-94c5-de8b49dbecfc", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cab48bf-52db-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750976362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976362, "uuid": "371e6bdd-c8c7-4645-826d-361f93734733", "comment": "Malware payload", "value": "b26fd70069fadd4167259978755a7e83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976362, "uuid": "dd9c4364-a5c6-4828-ba36-fcae50333029", "comment": "Malware payload", "value": "f80e8150cac4de20a790de0dee865b8bd95306b292e266f3997665887c37fbef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976362, "uuid": "dae17c6a-7cf0-4068-a0a9-928e808cb7b1", "comment": "Malware payload", "value": "971727b6809dfd5345d228e32072977be185bcad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750976362, "uuid": "a7b80b9b-aa9c-4609-a322-a68ff8e7e06f", "comment": "Malware payload", "value": "9d9304ad8dd0d931aaa58d4f8498847bc7790146c5266134467414b22d0b4d8201048df336d1d6f06012b0ac4a4127df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976362, "uuid": "a2496eb9-e5b7-4c06-863f-4efaf99c16fb", "value": "T10EB402118F881F8BC5AFCD750A2E167311AEDD9F46CA643E807CDD48B6A6D0D6783C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976362, "uuid": "00119c4b-bb2c-459b-9400-fcdbe298aafd", "value": "12288:7A84JF9Qc8GgZxTM6m1U3snB6NnVuqnAtSyBpywBdlEykR6LkV6N0L8AXwtZJHZz:/M6m1U3rVuqAtSySwY1gEIZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750976362, "uuid": "cb293460-43f2-4ff5-bc0f-ab434ea14050", "value": 509272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750976362, "uuid": "8a638999-1e37-4174-a21a-8d25be81fddb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750976362, "uuid": "ae520226-c42c-4265-bc84-15f0f179e4ab", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be9a62e-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750977999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977999, "uuid": "6bd9f5c9-13e6-4e6c-a95d-5a220cae3f99", "comment": "Malware payload (Mirai)", "value": "3f2a37cb410613a6e6a391b3a9e648e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977999, "uuid": "5ed27c1e-7aeb-4cd9-b023-2c7d3c2e39e2", "comment": "Malware payload (Mirai)", "value": "f884ae8c7e7004aa1eb73115dc45f11e49256ea7ac2bfd0115e58ab2e7f56af4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977999, "uuid": "6a0d39da-448d-48f0-8dcc-5566e13a2342", "comment": "Malware payload (Mirai)", "value": "f7ab74e1fec17029159f17b6f07332989b124196", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977999, "uuid": "4df9c4bc-805f-4fcd-b31c-bdd8a2f98a33", "comment": "Malware payload (Mirai)", "value": "03778df4ab4499a1c32b5d354754d39548f936b8ad3f1782da8f9b5b438cc6594947e2f97e98834d302e642794233cd3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977999, "uuid": "06db523d-e3ae-469d-b8b7-f99f83d2565f", "value": "T16603F158035FAE92C875AD70E17EA1427FBD9FB1D6DE77B92300377A10C529CA538608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977999, "uuid": "c3c158a2-748f-4bb0-9695-b9f4b424a35b", "value": "768:JDxClmS2VG+dl9aSocsYYeOkBMWTOUcpILfvkSTvorgE50IJs3UozE:JDxqoTmyYbWgUcyQSTvorgE5ezE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977999, "uuid": "03c521b7-5be5-4844-a9a2-bfd6c9cd88ae", "value": 39972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977999, "uuid": "873e40be-1be5-4058-8971-ce4f63ae6b87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977999, "uuid": "42b56002-eaf7-459b-992d-5e187bf013cc", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7e4634-52aa-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955072, "uuid": "3e954bf7-350f-4844-b1a7-3dd0680c939b", "comment": "Malware payload (Mirai)", "value": "0d051d0aa982fc2a938229f354ba21bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955072, "uuid": "7ad4ff7d-9ce7-4212-85e7-e29e32578ee0", "comment": "Malware payload (Mirai)", "value": "f8941692367f79d0861d7dbad6d29727d666b319367becc960d4c286b878242a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955072, "uuid": "cf7321ed-3495-48bb-8361-f33e39da8715", "comment": "Malware payload (Mirai)", "value": "7668b4ff98e992a4b3a7354f3733fcd4ab27b003", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955072, "uuid": "bc930a04-fea1-42d8-96dc-c5deb6176585", "comment": "Malware payload (Mirai)", "value": "3dea2579e415b586014a2f7cf5d967da349fb2aeef9e8716f60c522badcbe177943403efa0e177f46041bc957e6f88c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955072, "uuid": "1c51622d-e718-4c90-8006-73a2b38f2ee4", "value": "T121B31996BC419B26C6D026BBFE1E41CD33231F78E2EE31029D156F60A7DB95A0E3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955072, "uuid": "82898403-f771-4a92-9b50-30666cb6caae", "value": "3072:5YPEUSFcymdWWkxWqeVGZoV7holPFuUkhBxl13eis01:5Y8USFcymdWWkxnG0GholtuUu1uin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955072, "uuid": "75c8ba15-9065-4980-9c01-ed026c2a205e", "value": 107808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955072, "uuid": "5315dc6d-7029-4a21-a354-489cae936453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955072, "uuid": "c6179ea8-e6a4-43db-ba81-f9effa8970f8", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdae083-5275-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750932312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932312, "uuid": "dc10bf9a-c2e2-47a4-b2a1-324b66603aed", "comment": "Malware payload", "value": "878403cb415ef96658126111de041701", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932312, "uuid": "76e614a9-7d44-4a03-9d19-33d7e77839f0", "comment": "Malware payload", "value": "f98b5593fbfd6245226c4836d814c33383fe23f6069d87e3ac77d7127952a5e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932312, "uuid": "0c02fb4f-1d11-43c6-96a6-d2ee0e33eb6d", "comment": "Malware payload", "value": "e5b6fdb42c46ff53ed1e40e4d0439d86b3326c70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750932312, "uuid": "e0890a5c-6850-45bd-951a-70ee849ce8b5", "comment": "Malware payload", "value": "0f49907dcbc00f058de0b6c62333a47d7bdde24072e7962aa7753e5080f05fd66348d25f925f0e1a54e6bd634d930ed1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932312, "uuid": "86feb004-d46d-4efa-813f-1f183519da0a", "value": "T177A40294E9819B62C2C801BFFF0F45BC77A31F69E1EA71068D16EB2662D745A4F7E400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932312, "uuid": "077b9f6d-db3f-4958-b2bb-670a19a61024", "value": "12288:ndLGtVtlmIHk6Rtx02O6R+9X8C5SGEzf:pGntlzJx02O6E9X8XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750932312, "uuid": "5cfada23-9fbb-409a-88d8-79f7c50f2012", "value": 480792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750932312, "uuid": "e1c9211f-9f0d-461a-b98e-2420223744f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750932312, "uuid": "fe087c3e-e412-4e28-a87d-d6c1e06850a9", "value": "arm926t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3994ff5b-5270-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750930240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930240, "uuid": "b471ba34-a12b-4be8-a944-54d15f00e1b8", "comment": "Malware payload", "value": "86cf6cd043136404054a1ee580a135ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930240, "uuid": "fd85a21b-2b6a-4361-a5fc-422269e4b625", "comment": "Malware payload", "value": "f9ca4af19eabf12903d95fc63ea8de926cfbf77488fe1fa078c008693cd5ee54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930240, "uuid": "451422cb-2cf9-4c53-85d5-724fc7292a72", "comment": "Malware payload", "value": "9106db23f8277b7015604c8e70e4d37e168e4107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750930240, "uuid": "7c786eb5-8cfe-4845-b8ae-9562fcc9e7a3", "comment": "Malware payload", "value": "23525744883c3a85ed9daabc9636893fe52b9287948807580da14fa2be8b3aa3a262d717d03c5fea7f701078f553db96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930240, "uuid": "e7f9e188-9f49-46a4-aa87-4f1c195b2d4d", "value": "T14B038D637DD24177D4C186B060FA8F26BB7F266603564883DB44BC9A2E719F4DA3A343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930240, "uuid": "82f93914-d555-4b83-b22e-47ae221db311", "value": "bf84d5d1df105a88e94a3b0551127cc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930240, "uuid": "6c7a2a01-434e-4319-a933-b4c34f7556fd", "value": "384:CXOHGxKN9xeJgvDf/TW5btrMowgsEmADCZMLbdTLnD/tu6Hy7CbQrWt+O3:UOmx6CSLHTW5blBwgqO5uU6gQSt+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750930240, "uuid": "456b994f-3f50-4ccd-8590-139e039710a0", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750930240, "uuid": "c45d8530-f120-4165-8a2c-a5b8feae5672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750930240, "uuid": "8209c654-be37-4513-a3b9-98a6e0886280", "value": "ShellCode.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67874e9f-52df-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750977991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977991, "uuid": "aa266cb9-409a-43bd-9794-1c97879d28ea", "comment": "Malware payload (Mirai)", "value": "0545a651a170d7462cb2e7bfa285bc0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977991, "uuid": "34819d23-b89b-4ef5-8156-3be01daed51c", "comment": "Malware payload (Mirai)", "value": "f9f018da695ae9bc49ea11b8f5b8ad4bc3143ef0be64c486d086d1768360ee91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977991, "uuid": "69381174-ac57-4017-bf66-bd9f4e4f4db6", "comment": "Malware payload (Mirai)", "value": "c58f7a9de3cf2e5ee16a1fa8cc069c3aba8c028a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750977991, "uuid": "ca954b11-8111-4557-a51c-5d6cfeb7c63c", "comment": "Malware payload (Mirai)", "value": "7227b34daafa6da28ade4ea498e2f38a305b3d8040518cefe68673d8e028331c36315f1af2f920bdbc359788b6014332", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977991, "uuid": "b42e3ec1-c15c-41a3-8188-b2ae6d91c663", "value": "T15503F27C29A1C695CDFD51F8CBFB8B6A4E210D504582EE0F7858A2605D8B1E134AFEF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977991, "uuid": "50027919-8cfe-4ffc-8342-79fc9ff0e5db", "value": "768:5Co2m59J55FAF489ONiimAYwSGpn0lhUwqMyQqzx2b+QlTf0IHN+JgGlzDpbuR10:5CaX5FoB9qihOSQ0lTRwBCTbNqVJucn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750977991, "uuid": "bf69b5b0-d610-4c20-a484-29e12e3dec17", "value": 41192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750977991, "uuid": "d203a89b-9ca0-425b-a2cd-329cd2a96c32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750977991, "uuid": "229d0b64-5133-4332-a23d-2c4e2913feec", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc61559-52ba-11f0-8bd0-42010a9c0005", "comment": "Malware payload (BlankGrabber)", "timestamp": 1750962162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962162, "uuid": "26fe497c-d322-4079-aa84-1ee182c0492a", "comment": "Malware payload (BlankGrabber)", "value": "71c9a751e6b8fa48de46037d6645d07a", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962162, "uuid": "550aa478-b38a-48c5-ad64-b636f32b7764", "comment": "Malware payload (BlankGrabber)", "value": "fa1a1f9cad1caab91aceccd9156045a741cef7e5775a113c62c27d1fcc115ce6", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962162, "uuid": "0a2969d6-6222-4a82-86e0-1a30a4371ac9", "comment": "Malware payload (BlankGrabber)", "value": "b574b4483ba02ebf1442d101630e84fc907adbeb", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750962162, "uuid": "2f8006d5-153b-4aa5-af45-cfdd20afda09", "comment": "Malware payload (BlankGrabber)", "value": "be8eb65b76063940e9d11cc99c5a1097df3b25c41173aa44051ed2cd1e80daa186eec4f64aeeb9adc493bf03225741bd", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962162, "uuid": "389d06d5-b3c3-4e91-9db0-a85043a0e221", "value": "T1BFF733086BDA15F6F5F7463D8D52C83A97B1BEA21F64C3DB0265422C1E17AD1193F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962162, "uuid": "c9f32e93-9838-4741-b1e7-2d7d65307db2", "value": "c990338f8145dc29c6f38fb73cf05c77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962162, "uuid": "8da02330-bf33-4ae1-be19-7cfb6c0deb8a", "value": "196608:zmpNcvWpOj9fZwQRCgjmpXHIEGn7jdfPjRMsqeXL2yrjAnDkyx:ypRSw8ERIEgfPjSDNWCkyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750962162, "uuid": "2c040f85-d33b-44a3-9168-9228ed5de133", "value": 72351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750962162, "uuid": "31025aab-38ad-4599-86c9-2cd7a2c45d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750962162, "uuid": "937be494-a05c-4e1d-846a-419154494acc", "value": "cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18659143-52e0-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750978288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978288, "uuid": "7b8d819e-0f32-441f-bf53-d2a60e361880", "comment": "Malware payload (Mirai)", "value": "aa62dd62ddecb21772ad9730dd90eb05", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978288, "uuid": "83ae989c-4dfc-4b1a-8dd0-0f97685919b7", "comment": "Malware payload (Mirai)", "value": "fb47199084cab3439344b0b25dc660b8ef851a76d4482256383b26a67e5a2e21", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978288, "uuid": "7d90941c-d1f4-465a-840a-604366975db3", "comment": "Malware payload (Mirai)", "value": "4e6130378e71d5359d81b136c6af63df82cd88dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750978288, "uuid": "79e44c5e-db65-4dc5-8b21-cb212e0106f5", "comment": "Malware payload (Mirai)", "value": "1cfcd2067d4b2bb2326ae4dcf7a7d6c0a029bbb6703eada71cf6fe594371b3bad211e2717153fbfeebfd5a3983ec18a5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978288, "uuid": "662c1763-4d49-45c0-b700-13ad5cd8ee96", "value": "T140519586432A0D3528926B13F269C7A87484D05E18E6FBD1ECE5B6F24F4ED347740B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978288, "uuid": "231ee041-2a0c-4c5c-b5d2-50961c64ce5e", "value": "96:i0hgKhzUw0h7zh7N7Ow0h74h7o78aw0h4hovw0hSh6xw0hYhIcaw0hlh3Aw0hjha:Br679z9JO7949ev7+M7EU7G47Hq7pq7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750978288, "uuid": "cd874818-99b2-41b2-a125-dace3cbf1ee5", "value": 3109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750978288, "uuid": "b7048265-f2d8-4115-b4d7-421899fb5de3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750978288, "uuid": "6489e1c4-c8a6-4c9b-a526-9bb77ec2d432", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c39b8e-52ab-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750955785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955785, "uuid": "6df449c0-5467-4111-9d62-f2b5358ba565", "comment": "Malware payload (Mirai)", "value": "70259cf6012b2ea6a786212035d6c6c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955785, "uuid": "69e04c20-4179-4cf2-a34c-ecb26bed1850", "comment": "Malware payload (Mirai)", "value": "fbce90480674156c7327336c07edebaae62961a37a1f3c2e0990d5bf3d35f084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955785, "uuid": "a06d85ee-d89e-42dc-a6eb-50ffb94b5b9d", "comment": "Malware payload (Mirai)", "value": "b04c569f3b3591c31a296a17fc81396b7142bfcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750955785, "uuid": "6928dd10-6905-402b-b65d-46f84ff6733c", "comment": "Malware payload (Mirai)", "value": "b5720df7485173885177c301ea82e888137678219c32bf0a72c93758c08fca70c780c3003a0461d159086dd8842fd228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955785, "uuid": "ddd0095a-6050-40f9-8ca6-9b444b30fad6", "value": "T18D23F791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955785, "uuid": "72280d3c-fe9e-4583-ac4b-e0c50de9a362", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THS:5DmKF7Gxyk8cqoHAmWurAufsG5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750955785, "uuid": "1ee84d6e-51b9-41a3-a71c-6a4590ef1074", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750955785, "uuid": "d851b3cb-3df3-4dae-8c43-a6646e044154", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750955785, "uuid": "f2620258-cdae-42f0-9702-aa48d83928b7", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11b2998-52da-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750975994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975994, "uuid": "42a32828-7710-45d1-a54f-a4f44aa87117", "comment": "Malware payload (Mirai)", "value": "123af8d8f38f8c7a6218b5b0dfdee6d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975994, "uuid": "ae3ad27f-8c24-4ccb-a711-5a889869add7", "comment": "Malware payload (Mirai)", "value": "fc0bccc09495dfba717d2c3ecb97aedb5e72896c6beea7bf6ff72b0715d3412b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975994, "uuid": "37339336-909e-415b-a85d-2a38b27c7356", "comment": "Malware payload (Mirai)", "value": "d98bf8e770ab602095869df20ccff829fe6012f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750975994, "uuid": "9c6d227e-5ac5-4610-8287-405337c2de94", "comment": "Malware payload (Mirai)", "value": "1386db7e33bdfea93968250028731e2a99f735b94e64da509bfda9e83f7e774816185558f3e7987ea9208d51353db762", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975994, "uuid": "340c08b0-d44d-4012-8848-98f77699a682", "value": "T162732981BC815A13C6D012BBFB6E428D372653A8D2EF7207DD226F21378786B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975994, "uuid": "277e6d06-7230-45a2-986b-26a90fde14ea", "value": "1536:d9jFvAOQ6ZjrWik3mnR+YaD2j8tOIDAcdt/y9RYvzwD:d9jFxhrGYaDGTQvzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750975994, "uuid": "102ea878-32c8-470b-af46-b73fb373e806", "value": 79336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750975994, "uuid": "3278528b-3059-4101-9201-8e3e213ceb40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750975994, "uuid": "c8218de2-c158-4b3d-b023-0104e6b31364", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7035727c-5289-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750941069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941069, "uuid": "b6ee8f1f-c6c2-4df1-8ea9-3c72e311039b", "comment": "Malware payload (Mirai)", "value": "db34f45dc616f2787e2aa869e415d929", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941069, "uuid": "d4251911-c178-414c-bee1-820cfb64581c", "comment": "Malware payload (Mirai)", "value": "fc64355db32c70ba7386418cc0b1d60699f04f4369b4aa16efe76c04c8fdab9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941069, "uuid": "f1400c56-8f06-433a-9fc5-3491d52ee46b", "comment": "Malware payload (Mirai)", "value": "6620988c7abb08517675656b7961b60ca1b98f00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750941069, "uuid": "4b7a3067-8858-432c-8056-038feb24a489", "comment": "Malware payload (Mirai)", "value": "37f4b61b1ae719bd63637789620ed7a6bb0c4ff1e70f531b4d6e8a7b4a23f3550c547105b9c4b2d60826dd0ce7de9232", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941069, "uuid": "51f39705-8cf4-485f-92dd-33f4005fc9e4", "value": "T182832B6DF9408727C6D1227BEA85028D73329B68FEEA3314CD247E343FD6B699D25211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941069, "uuid": "f8dbb7f7-13c5-40a0-b232-38778f4c3fbe", "value": "1536:L4Yh2vZnSQEyr0nfbgw0PVRGXkOX976Sm6POLJAGWSyOV9nIr3GauK6YCpiJHpMA:L/8w0gN7rbPXUw3T48j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750941069, "uuid": "b6cccef8-f426-4137-af0b-492e05effb62", "value": 88584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750941069, "uuid": "8eef1607-93a9-4a75-8d73-197c5be0fb5a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750941069, "uuid": "32839f4b-1a7b-4ff1-aa6d-ec45b800cf0a", "value": "SecuriteInfo.com.Variant.Trojan.Linux.Gafgyt.8.27336.28367", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5226b092-5241-11f0-8bd0-42010a9c0005", "comment": "Malware payload (Mirai)", "timestamp": 1750910095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910095, "uuid": "87d459cc-457d-45f4-a8c4-d88c8ed085d4", "comment": "Malware payload (Mirai)", "value": "ebd921196110a1c57477d8b061aedc14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910095, "uuid": "1cb393bb-be8f-4ba5-bdbd-07dbc0290a7f", "comment": "Malware payload (Mirai)", "value": "ff617b6c18b0e8a6064b33bfd290c90a9467af3f856155e0e49e15071cae99fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910095, "uuid": "546868ba-a1c6-4dba-8c64-5f8fc28b31a0", "comment": "Malware payload (Mirai)", "value": "5c5bebd68fcc15e6218239ef02450b686ac9b8db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750910095, "uuid": "cc1a94d2-e2fa-4275-ac6a-8acae8bf6b91", "comment": "Malware payload (Mirai)", "value": "b298cb9eb37781296279598e54e1ed453b2ffb962531e847fa36d0d247a5464ca2b8b398592e33c67ef68477f2c9ba4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910095, "uuid": "cc182d84-b54b-40ee-aa5d-436c04b8df0e", "value": "T1B6932ACAB401DD7DF80FDBBB4463490AB531A7611A831F27676BFD93AC321A04957E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910095, "uuid": "37e13bc0-5ae9-4740-8283-2a01b41332ca", "value": "1536:qBlFQAe3Xj4j3FB15+R2w7Iupt3dIGYfUyzPhK+8rAwBPWrErwoW5vgUzeA3P4ra:qtjVBPOf7IcXSUy7BUnr3WNRP4rd1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750910095, "uuid": "1e5ddd9a-b191-4b26-8276-8f308af33de7", "value": 91932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750910095, "uuid": "e624246d-bfc5-459c-87ba-5798c8490f8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750910095, "uuid": "cbf1f03c-d99b-4643-bb10-d5e966e9948d", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a02b12-52a6-11f0-8bd0-42010a9c0005", "comment": "Malware payload", "timestamp": 1750953512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953512, "uuid": "f30dca13-a9ad-4363-b136-26b5e9b15b7d", "comment": "Malware payload", "value": "c17190ad802e419d9d746914eb878b6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953512, "uuid": "c2c650c2-f8ac-46e8-bafe-64b2ca841b07", "comment": "Malware payload", "value": "ffca010277761612e3fb13e62e8d94fab671ca74eca8e9dec65f866f6cf48bbc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953512, "uuid": "f49183c3-6d98-4ab7-8dba-c14230d7b09f", "comment": "Malware payload", "value": "24ba6b421077b137c41d6c5e4a93ef3eaf8ae3ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1750953512, "uuid": "3a4b5e37-4329-4780-b2ed-e534e436e374", "comment": "Malware payload", "value": "e6cf0febf0a0c9bd61ef9898aefc374f6275d847582ac26b6d10ccbc9bd8d3e317f868cc4d59b76734de4c592b955dc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953512, "uuid": "743da916-315c-41ca-95b7-2daad50eb072", "value": "T1F7C42241EAB7C0F2F65349320103E7BF8F33C9099165D2A6D742F661EDB1B424A9E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953512, "uuid": "a062e36b-a919-400b-a175-2c989dffc9f2", "value": "12288:5D+Azf/CVCW3ISw+hRNb3W/aTyA9VV/cZWLnR98V+:5D+AznCVNIZ+vNbG/WYWrR98V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1750953512, "uuid": "3504b315-d664-4aa9-9bb9-f9789ecaabed", "value": 587764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1750953512, "uuid": "cdc902df-7063-4c8d-a779-1387a3f692d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1750953512, "uuid": "01b0632a-6c4d-40a1-bc13-3b6f7eef63a6", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }